release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  packages: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  IMAGE_NAME: ghcr.io/subboost/subboost

jobs:
  meta:
    runs-on: ubuntu-latest
    outputs:
      build_version: ${{ steps.meta.outputs.build_version }}
      image_name: ${{ steps.meta.outputs.image_name }}
      release_version: ${{ steps.meta.outputs.release_version }}
      short_sha: ${{ steps.meta.outputs.short_sha }}
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "22.19.0"

      - name: Validate tag
        id: meta
        shell: bash
        run: |
          set -euo pipefail
          release_version="$(node -p "require('./package.json').version")"
          expected_tag="v${release_version}"
          if [ "${GITHUB_REF_NAME}" != "${expected_tag}" ]; then
            echo "Tag ${GITHUB_REF_NAME} does not match package.json version ${release_version}" >&2
            exit 1
          fi
          short_sha="${GITHUB_SHA::12}"
          echo "release_version=${release_version}" >> "$GITHUB_OUTPUT"
          echo "short_sha=${short_sha}" >> "$GITHUB_OUTPUT"
          echo "build_version=${release_version}+sha.${short_sha}" >> "$GITHUB_OUTPUT"
          echo "image_name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"

  checks:
    runs-on: ubuntu-latest
    needs: meta
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "22.19.0"

      - run: npm ci
      - run: npm run lint
      - run: npm run test:coverage
      - run: npm run check:local-app

  build-image:
    runs-on: ${{ matrix.runner }}
    needs: meta
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            platform: linux/amd64
            runner: ubuntu-latest
          - arch: arm64
            platform: linux/arm64
            runner: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v6

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME || github.actor }}
          password: ${{ secrets.GHCR_PAT || github.token }}

      - name: Build and push ${{ matrix.platform }} image by digest
        id: build_image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: local/Dockerfile
          platforms: ${{ matrix.platform }}
          outputs: type=image,push-by-digest=true,name-canonical=true,push=true
          build-args: |
            APP_RELEASE_VERSION=${{ needs.meta.outputs.release_version }}
            APP_BUILD_SHA=${{ github.sha }}
            APP_VERSION=${{ needs.meta.outputs.build_version }}
            APP_VERSION_TOKEN=${{ needs.meta.outputs.build_version }}
          cache-from: type=gha,scope=selfhost-${{ matrix.arch }}
          cache-to: type=gha,mode=max,scope=selfhost-${{ matrix.arch }}
          # Keep digest artifacts as plain per-architecture images before the final manifest is assembled.
          provenance: false
          tags: ${{ needs.meta.outputs.image_name }}

      - name: Export digest
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p "${RUNNER_TEMP}/digests"
          digest="${{ steps.build_image.outputs.digest }}"
          touch "${RUNNER_TEMP}/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digest-${{ matrix.arch }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  publish-release:
    runs-on: ubuntu-latest
    needs:
      - meta
      - checks
      - build-image
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "22.19.0"

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME || github.actor }}
          password: ${{ secrets.GHCR_PAT || github.token }}

      - name: Download image digests
        uses: actions/download-artifact@v4
        with:
          pattern: digest-*
          path: ${{ runner.temp }}/digests
          merge-multiple: true

      - name: Create multi-platform image tags
        id: image_manifest
        shell: bash
        env:
          IMAGE_NAME: ${{ needs.meta.outputs.image_name }}
          RELEASE_VERSION: ${{ needs.meta.outputs.release_version }}
          SHORT_SHA: ${{ needs.meta.outputs.short_sha }}
        run: |
          set -euo pipefail
          mapfile -t digest_files < <(find "${RUNNER_TEMP}/digests" -type f | sort)
          if [ "${#digest_files[@]}" -lt 2 ]; then
            echo "Expected at least two architecture digests, found ${#digest_files[@]}" >&2
            exit 1
          fi

          sources=()
          for file in "${digest_files[@]}"; do
            sources+=("${IMAGE_NAME}@sha256:$(basename "$file")")
          done

          docker buildx imagetools create \
            --metadata-file "${RUNNER_TEMP}/image-metadata.json" \
            --tag "${IMAGE_NAME}:${GITHUB_REF_NAME}" \
            --tag "${IMAGE_NAME}:${RELEASE_VERSION}" \
            --tag "${IMAGE_NAME}:sha-${SHORT_SHA}" \
            --tag "${IMAGE_NAME}:latest" \
            "${sources[@]}"

          digest="$(node -e 'const metadata = require(process.argv[1]); const digest = metadata["containerimage.digest"] || metadata["containerimage.descriptor"]?.digest; if (!digest) { console.error(JSON.stringify(metadata, null, 2)); process.exit(1); } process.stdout.write(digest);' "${RUNNER_TEMP}/image-metadata.json")"
          if [ -z "$digest" ] || [ "$digest" = "null" ]; then
            echo "Failed to resolve multi-platform image digest for ${IMAGE_NAME}:${GITHUB_REF_NAME}" >&2
            exit 1
          fi
          echo "digest=${digest}" >> "$GITHUB_OUTPUT"

      - name: Prepare selfhost release assets
        shell: bash
        env:
          IMAGE_DIGEST: ${{ steps.image_manifest.outputs.digest }}
          IMAGE_NAME: ${{ needs.meta.outputs.image_name }}
        run: |
          set -euo pipefail
          node scripts/selfhost-release-assets.cjs \
            --output dist/release-assets \
            --tag "${GITHUB_REF_NAME}" \
            --build-sha "${GITHUB_SHA}" \
            --image "${IMAGE_NAME}@${IMAGE_DIGEST}" \
            --image-tag "${IMAGE_NAME}:${GITHUB_REF_NAME}" \
            --base-url "https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF_NAME}"

      - name: Create draft GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "${GITHUB_REF_NAME}" \
            --title "SubBoost ${GITHUB_REF_NAME}" \
            --notes-file docs/release-notes.md \
            --draft \
            dist/release-assets/release.json \
            dist/release-assets/install.sh \
            dist/release-assets/docker-compose.image.yml \
            dist/release-assets/subboost-manager