sarin/.github/workflows/release.yaml

name: Build and Release

on:
  release:
    types: [published]

permissions:
  contents: write

jobs:
  nix:
    name: Verify Nix package
    uses: ./.github/workflows/nix.yaml
    permissions:
      contents: read
      pull-requests: write
    with:
      ref: ${{ github.ref }}

  # Gate: the tag must come from main, agree with the pre-release flag, and match
  # the hand-bumped version in nix/package.nix.
  version:
    name: Verify release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      TAG: ${{ github.ref_name }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          ref: ${{ github.ref }}
          # Full history so the tag can be located on main's first-parent line.
          fetch-depth: 0

      - name: Check the tag is on main
        run: |
          git fetch --no-tags origin "+refs/heads/main:refs/remotes/origin/main"
          git rev-list --first-parent refs/remotes/origin/main > "$RUNNER_TEMP/first-parent.txt"
          if ! grep -qxF "$GITHUB_SHA" "$RUNNER_TEMP/first-parent.txt"; then
            echo "::error::$TAG ($GITHUB_SHA) is not on main; releases must be cut from main"
            exit 1
          fi

      - name: Check the tag matches the pre-release flag
        env:
          PRERELEASE: ${{ github.event.release.prerelease }}
        run: |
          # The flag comes from the checkbox, not the tag name, so without this a
          # tag like v1.5.0-rc1 published as stable would move :latest.
          case "$TAG" in
            *-*)
              if [ "$PRERELEASE" != "true" ]; then
                echo "::error::tag '$TAG' carries a pre-release suffix but the release is not marked as a pre-release"
                exit 1
              fi
              ;;
          esac

      - name: Check nix/package.nix matches the release tag
        run: |
          expected="${TAG#v}"
          expected="${expected%%-*}"
          actual="$(sed -n 's/^[[:space:]]*version = "\([^"]*\)".*/\1/p' nix/package.nix | head -1)"
          if [ -z "$actual" ]; then
            echo "::error file=nix/package.nix::could not read the version string"
            exit 1
          fi
          if [ "$actual" != "$expected" ]; then
            echo "::error file=nix/package.nix::version is '$actual' but the release tag is '$TAG' (expected '$expected')"
            exit 1
          fi
          echo "nix/package.nix version '$actual' matches tag '$TAG'"

  build:
    name: Build binaries
    needs: [nix, version]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          ref: ${{ github.ref }}

      - name: Set build metadata
        run: |
          echo "VERSION=$(git describe --tags --always)" >> $GITHUB_ENV
          echo "GIT_COMMIT=$(git rev-parse HEAD)" >> $GITHUB_ENV
          echo "GO_VERSION=$(sed -n 's/^go //p' go.mod)" >> $GITHUB_ENV

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Build binaries
        run: |
          LDFLAGS="-X 'go.aykhans.me/sarin/internal/version.Version=${{ env.VERSION }}' \
                   -X 'go.aykhans.me/sarin/internal/version.GitCommit=${{ env.GIT_COMMIT }}' \
                   -X 'go.aykhans.me/sarin/internal/version.BuildDate=$(date -u +%Y-%m-%dT%H:%M:%SZ)' \
                   -X 'go.aykhans.me/sarin/internal/version.GoVersion=$(go version)' \
                   -s -w"

          CGO_ENABLED=0 GOOS=linux   GOARCH=amd64 go build -ldflags "$LDFLAGS" -o ./sarin-linux-amd64 ./cmd/cli/main.go
          CGO_ENABLED=0 GOOS=linux   GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-linux-arm64 ./cmd/cli/main.go
          CGO_ENABLED=0 GOOS=freebsd GOARCH=amd64 go build -ldflags "$LDFLAGS" -o ./sarin-freebsd-amd64 ./cmd/cli/main.go
          CGO_ENABLED=0 GOOS=freebsd GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-freebsd-arm64 ./cmd/cli/main.go
          CGO_ENABLED=0 GOOS=darwin  GOARCH=amd64 go build -ldflags "$LDFLAGS" -o ./sarin-darwin-amd64 ./cmd/cli/main.go
          CGO_ENABLED=0 GOOS=darwin  GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-darwin-arm64 ./cmd/cli/main.go
          CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -ldflags "$LDFLAGS" -o ./sarin-windows-amd64.exe ./cmd/cli/main.go
          CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-windows-arm64.exe ./cmd/cli/main.go

      - name: Upload Release Assets
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ github.ref_name }}
          files: ./sarin-*

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: |
            VERSION=${{ env.VERSION }}
            GIT_COMMIT=${{ env.GIT_COMMIT }}
            GO_VERSION=${{ env.GO_VERSION }}
          # A pre-release must not take over the tag people get by default.
          tags: |
            ${{ secrets.DOCKERHUB_USERNAME }}/sarin:${{ env.VERSION }}
            ${{ !github.event.release.prerelease && format('{0}/sarin:latest', secrets.DOCKERHUB_USERNAME) || '' }}

  # Moving pointer at the newest stable release, so flake users can follow
  # releases instead of main. Fast-forward only.
  release-branch:
    name: Advance release branch
    needs: build
    if: ${{ !github.event.release.prerelease }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    # Serialize: concurrent releases would otherwise race the push.
    concurrency:
      group: release-branch
      cancel-in-progress: false
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          # The checks below compare against $GITHUB_SHA; check out exactly that.
          ref: ${{ github.sha }}
          fetch-depth: 0

      - name: Point release at the tag
        env:
          TAG: ${{ github.ref_name }}
        run: |
          # Refresh: checkout fetched this, but as of a few seconds ago.
          git fetch --no-tags origin "+refs/heads/release:refs/remotes/origin/release" || true

          if git rev-parse --verify --quiet refs/remotes/origin/release >/dev/null; then
            # At or behind the pointer: a re-run of this or an older release.
            if git merge-base --is-ancestor "$GITHUB_SHA" refs/remotes/origin/release; then
              if [ "$(git rev-parse refs/remotes/origin/release)" = "$GITHUB_SHA" ]; then
                echo "::notice::release is already at $TAG"
              else
                echo "::warning::release is ahead of $TAG; leaving it alone"
              fi
              exit 0
            fi
            # The version job put this commit on main, so a pointer that is neither
            # behind nor ahead is off main history and can never fast-forward again.
            if ! git merge-base --is-ancestor refs/remotes/origin/release "$GITHUB_SHA"; then
              echo "::error::release ($(git rev-parse --short refs/remotes/origin/release)) has diverged from main and can no longer fast-forward to $TAG; reset it by hand"
              exit 1
            fi
          fi

          git push origin "$GITHUB_SHA:refs/heads/release"
          echo "::notice::release branch now points at $TAG"