release.yml

name: Release Catalog Service

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: Semantic release tag, for example v0.20.7
        required: true
        type: string

permissions:
  contents: write

concurrency:
  group: catalog-service-release
  cancel-in-progress: false

jobs:
  release:
    if: github.repository == 'PastureStack/catalog-service' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    env:
      RELEASE_TAG: ${{ inputs.release_tag }}
      SOURCE_SHA: ${{ github.sha }}
      GH_TOKEN: ${{ github.token }}

    steps:
      - name: Validate release request
        shell: bash
        run: |
          set -Eeuo pipefail
          if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            printf 'Release tag must match vMAJOR.MINOR.PATCH\n' >&2
            exit 1
          fi
          if git ls-remote --exit-code --tags \
            "https://github.com/${GITHUB_REPOSITORY}.git" \
            "refs/tags/${RELEASE_TAG}" >/dev/null 2>&1; then
            printf 'Tag already exists: %s\n' "$RELEASE_TAG" >&2
            exit 1
          fi
          if gh release view "$RELEASE_TAG" \
            --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            printf 'Release already exists: %s\n' "$RELEASE_TAG" >&2
            exit 1
          fi

      - name: Check out the immutable source commit
        shell: bash
        run: |
          set -Eeuo pipefail
          git clone --filter=blob:none \
            "https://github.com/${GITHUB_REPOSITORY}.git" source
          git -C source checkout --detach "$SOURCE_SHA"
          test "$(git -C source rev-parse HEAD)" = "$SOURCE_SHA"
          test -z "$(git -C source status --short)"

      - name: Build, test, and package twice
        shell: bash
        run: |
          set -Eeuo pipefail
          source_epoch="$(git -C source show -s --format=%ct HEAD)"
          image="pasturestack-catalog-service-release:${GITHUB_RUN_ID}"
          source_path="${GITHUB_WORKSPACE}/source"

          docker build \
            --build-arg DAPPER_HOST_ARCH=amd64 \
            --tag "$image" \
            --file source/Dockerfile.dapper \
            source

          run_build() {
            local command=$1
            docker run --rm \
              --volume "${source_path}:/go/src/github.com/PastureStack/catalog-service" \
              --env "DAPPER_UID=$(id -u)" \
              --env "DAPPER_GID=$(id -g)" \
              --env ARCH=amd64 \
              --env "VERSION_OVERRIDE=${RELEASE_TAG}" \
              --env "SOURCE_DATE_EPOCH=${source_epoch}" \
              "$image" "$command"
          }

          run_build ci
          version="${RELEASE_TAG#v}"
          artifact="source/dist/artifacts/catalog-service-${version}.tar.xz"
          test -s "$artifact"
          cp "$artifact" /tmp/catalog-service-first.tar.xz

          rm -rf source/bin source/dist
          run_build package
          cmp /tmp/catalog-service-first.tar.xz "$artifact"

          mkdir artifact-check
          tar -xJf "$artifact" -C artifact-check
          test -x artifact-check/catalog-service
          test -x artifact-check/catalog-service-sqlite
          test "$(find artifact-check -maxdepth 1 -type f | wc -l)" -eq 2
          sha256sum "$artifact" |
            sed "s#  source/dist/artifacts/#  #" \
            >"${artifact}.sha256"
          (
            cd source/dist/artifacts
            sha256sum --check "catalog-service-${version}.tar.xz.sha256"
          )
          test -z "$(git -C source status --short --untracked-files=no)"

      - name: Publish immutable GitHub release
        shell: bash
        run: |
          set -Eeuo pipefail
          version="${RELEASE_TAG#v}"
          artifact="source/dist/artifacts/catalog-service-${version}.tar.xz"
          checksum="${artifact}.sha256"
          artifact_sha="$(sha256sum "$artifact" | awk '{print $1}')"

          {
            printf '# PastureStack Catalog Service %s\n\n' "$RELEASE_TAG"
            printf 'This release rebuilds an empty catalog index even when the recorded repository commit has not changed.\n\n'
            printf '## Immutable coordinates\n\n'
            printf -- '- Source commit: `%s`\n' "$SOURCE_SHA"
            printf -- '- Artifact SHA-256: `%s`\n\n' "$artifact_sha"
            printf 'The full test suite passed, and two clean builds produced byte-identical archives.\n\n'
            printf 'PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.\n'
          } >release-notes.md

          gh release create "$RELEASE_TAG" \
            "$artifact" \
            "$checksum" \
            --repo "$GITHUB_REPOSITORY" \
            --target "$SOURCE_SHA" \
            --title "PastureStack Catalog Service ${RELEASE_TAG}" \
            --notes-file release-notes.md