dev-release.yml

name: Dev Release

on:
  workflow_dispatch:
  push:
    branches:
      - ryan/dev
    paths:
      - ".github/workflows/ci.yml"
      - ".github/workflows/dev-release.yml"
      - ".github/workflows/release.yml"
      - "eslint.config.mjs"
      - "local/**"
      - "package-lock.json"
      - "package.json"
      - "packages/**"
      - "scripts/**"
      - "tsconfig.json"
      - "vitest.config.ts"
      - "vitest.coverage.ts"
      - "vitest.core.config.ts"

permissions:
  contents: write
  packages: write

concurrency:
  group: dev-release-${{ github.ref }}
  cancel-in-progress: false

env:
  IMAGE_NAME: ghcr.io/subboost/subboost

jobs:
  meta:
    runs-on: ubuntu-latest
    outputs:
      build_version: ${{ steps.meta.outputs.build_version }}
      image_name: ${{ steps.meta.outputs.image_name }}
      release_version: ${{ steps.meta.outputs.release_version }}
      short_sha: ${{ steps.meta.outputs.short_sha }}
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "22.19.0"

      - name: Validate dev source
        id: meta
        shell: bash
        run: |
          set -euo pipefail
          if [ "${GITHUB_REF_NAME}" != "ryan/dev" ]; then
            echo "Dev release must run from ryan/dev, got ${GITHUB_REF_NAME}." >&2
            exit 1
          fi
          release_version="$(node -p "require('./package.json').version")"
          short_sha="${GITHUB_SHA::12}"
          echo "release_version=${release_version}" >> "$GITHUB_OUTPUT"
          echo "short_sha=${short_sha}" >> "$GITHUB_OUTPUT"
          echo "build_version=${release_version}+sha.${short_sha}" >> "$GITHUB_OUTPUT"
          echo "image_name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"

  checks:
    runs-on: ubuntu-latest
    needs: meta
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "22.19.0"

      - run: npm ci
      - run: npm run lint
      - run: npm run test:coverage
      - run: npm run check:local-app

  build-image:
    runs-on: ${{ matrix.runner }}
    needs: meta
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            platform: linux/amd64
            runner: ubuntu-latest
          - arch: arm64
            platform: linux/arm64
            runner: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v6

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME || github.actor }}
          password: ${{ secrets.GHCR_PAT || github.token }}

      - name: Build and push ${{ matrix.platform }} image by digest
        id: build_image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: local/Dockerfile
          platforms: ${{ matrix.platform }}
          outputs: type=image,push-by-digest=true,name-canonical=true,push=true
          build-args: |
            APP_RELEASE_VERSION=${{ needs.meta.outputs.release_version }}
            APP_BUILD_SHA=${{ github.sha }}
            APP_VERSION=${{ needs.meta.outputs.build_version }}
            APP_VERSION_TOKEN=${{ needs.meta.outputs.build_version }}
          cache-from: type=gha,scope=selfhost-dev-${{ matrix.arch }}
          cache-to: type=gha,mode=max,scope=selfhost-dev-${{ matrix.arch }}
          provenance: false
          tags: ${{ needs.meta.outputs.image_name }}

      - name: Export digest
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p "${RUNNER_TEMP}/digests"
          digest="${{ steps.build_image.outputs.digest }}"
          touch "${RUNNER_TEMP}/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digest-${{ matrix.arch }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  publish-dev-release:
    runs-on: ubuntu-latest
    needs:
      - meta
      - checks
      - build-image
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "22.19.0"

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME || github.actor }}
          password: ${{ secrets.GHCR_PAT || github.token }}

      - name: Download image digests
        uses: actions/download-artifact@v4
        with:
          pattern: digest-*
          path: ${{ runner.temp }}/digests
          merge-multiple: true

      - name: Create dev image tags
        id: image_manifest
        shell: bash
        env:
          IMAGE_NAME: ${{ needs.meta.outputs.image_name }}
          SHORT_SHA: ${{ needs.meta.outputs.short_sha }}
        run: |
          set -euo pipefail
          mapfile -t digest_files < <(find "${RUNNER_TEMP}/digests" -type f | sort)
          if [ "${#digest_files[@]}" -lt 2 ]; then
            echo "Expected at least two architecture digests, found ${#digest_files[@]}" >&2
            exit 1
          fi

          sources=()
          for file in "${digest_files[@]}"; do
            sources+=("${IMAGE_NAME}@sha256:$(basename "$file")")
          done

          docker buildx imagetools create \
            --metadata-file "${RUNNER_TEMP}/image-metadata.json" \
            --tag "${IMAGE_NAME}:dev" \
            --tag "${IMAGE_NAME}:sha-${SHORT_SHA}" \
            "${sources[@]}"

          digest="$(node -e 'const metadata = require(process.argv[1]); const digest = metadata["containerimage.digest"] || metadata["containerimage.descriptor"]?.digest; if (!digest) { console.error(JSON.stringify(metadata, null, 2)); process.exit(1); } process.stdout.write(digest);' "${RUNNER_TEMP}/image-metadata.json")"
          if [ -z "$digest" ] || [ "$digest" = "null" ]; then
            echo "Failed to resolve multi-platform image digest for ${IMAGE_NAME}:dev" >&2
            exit 1
          fi
          echo "digest=${digest}" >> "$GITHUB_OUTPUT"

      - name: Prepare dev release assets
        shell: bash
        env:
          IMAGE_DIGEST: ${{ steps.image_manifest.outputs.digest }}
          IMAGE_NAME: ${{ needs.meta.outputs.image_name }}
        run: |
          set -euo pipefail
          dev_base_url="https://github.com/${GITHUB_REPOSITORY}/releases/download/dev"
          node scripts/selfhost-release-assets.cjs \
            --output dist/release-assets \
            --tag dev \
            --build-sha "${GITHUB_SHA}" \
            --image "${IMAGE_NAME}@${IMAGE_DIGEST}" \
            --image-tag "${IMAGE_NAME}:dev" \
            --base-url "${dev_base_url}" \
            --installer-release-url "${dev_base_url}/release.json" \
            --installer-update-release-url "${dev_base_url}/release.json" \
            --installer-compose-url "${dev_base_url}/docker-compose.image.yml" \
            --installer-manager-url "${dev_base_url}/subboost-manager" \
            --installer-image "${IMAGE_NAME}:dev"

      - name: Move dev tag
        shell: bash
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag -f dev "${GITHUB_SHA}"
          git push origin "refs/tags/dev" --force

      - name: Create or update dev prerelease
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          IMAGE_DIGEST: ${{ steps.image_manifest.outputs.digest }}
          IMAGE_NAME: ${{ needs.meta.outputs.image_name }}
        run: |
          set -euo pipefail
          notes_file="${RUNNER_TEMP}/dev-release-notes.md"
          cat > "$notes_file" <<EOF
          Automated dev prerelease for ryan/dev.

          - Commit: ${GITHUB_SHA}
          - Image tag: ${IMAGE_NAME}:dev
          - Image digest: ${IMAGE_NAME}@${IMAGE_DIGEST}

          This mutable prerelease follows ryan/dev and is not a stable release announcement.
          EOF

          if gh release view dev >/dev/null 2>&1; then
            gh release edit dev \
              --title "SubBoost dev" \
              --notes-file "$notes_file" \
              --prerelease \
              --draft=false
            gh release upload dev \
              dist/release-assets/release.json \
              dist/release-assets/install.sh \
              dist/release-assets/docker-compose.image.yml \
              dist/release-assets/subboost-manager \
              --clobber
          else
            gh release create dev \
              --title "SubBoost dev" \
              --notes-file "$notes_file" \
              --prerelease \
              --latest=false \
              --verify-tag \
              dist/release-assets/release.json \
              dist/release-assets/install.sh \
              dist/release-assets/docker-compose.image.yml \
              dist/release-assets/subboost-manager
          fi

          release_id="$(gh api "repos/${GITHUB_REPOSITORY}/releases/tags/dev" --jq ".id")"
          gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${release_id}" \
            -F draft=false \
            -F prerelease=true \
            -f make_latest=false \
            >/dev/null