SciMesh/.github/workflows/release.yml

name: release

# Builds static coordinator and worker-agent binaries for every major
# platform on a v* tag push, attaches them (plus SHA-256 checksums) to the
# GitHub Release, and pushes the coordinator image to GHCR.
#
#   git tag v1.0.0 && git push origin v1.0.0
on:
  push:
    tags: ["v*"]

permissions:
  contents: write
  packages: write

jobs:
  binaries:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        os: [linux, darwin, windows]
        arch: [amd64, arm64]
    defaults:
      run:
        working-directory: coordinator
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version-file: coordinator/go.mod
          cache-dependency-path: coordinator/go.sum

      - name: vet
        run: go vet ./...

      - name: build coordinator and worker-agent
        env:
          VERSION: ${{ github.ref_name }}
        run: |
          mkdir -p dist
          for cmd in coordinator worker-agent; do
            CGO_ENABLED=0 GOOS=${{ matrix.os }} GOARCH=${{ matrix.arch }} \
              go build -trimpath \
                -ldflags="-s -w -X main.version=${VERSION#v}" \
                -o "dist/${cmd}-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.os == 'windows' && '.exe' || '' }}" \
                "./cmd/${cmd}"
          done

      - uses: actions/upload-artifact@v4
        with:
          name: binaries-${{ matrix.os }}-${{ matrix.arch }}
          path: coordinator/dist/*
          if-no-files-found: error

  wheel:
    runs-on: ubuntu-latest
    steps:
      # Full history: setuptools_scm derives the package version from the
      # release tag (v1.1.0-alpha.16 -> 1.1.0a16), so the wheel is
      # version-locked to the binaries of the same release.
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: build the scimesh wheel
        run: |
          python -m pip install --quiet build
          python -m build --wheel --outdir dist
          ls -la dist/

      - uses: actions/upload-artifact@v4
        with:
          name: wheel
          path: dist/*.whl
          if-no-files-found: error

  release:
    needs: [binaries, wheel]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          # Only the binary artifacts: the image job also uploads a buildkit
          # cache artifact (*.dockerbuild) that download-artifact cannot fetch.
          pattern: binaries-*
          merge-multiple: true

      - uses: actions/download-artifact@v4
        with:
          name: wheel
          path: artifacts

      - name: checksums
        working-directory: artifacts
        run: sha256sum * > SHA256SUMS.txt

      - name: sign the checksums (RSA-2048/SHA-256)
        env:
          KEY: ${{ secrets.SCIMESH_SIGNING_KEY }}
        working-directory: artifacts
        run: |
          if [ -n "$KEY" ]; then
            printf '%s\n' "$KEY" > /tmp/scimesh-sign-key.pem
            openssl dgst -sha256 -sign /tmp/scimesh-sign-key.pem \
              -out SHA256SUMS.txt.sig SHA256SUMS.txt
            echo "signed SHA256SUMS.txt"
          else
            echo "SCIMESH_SIGNING_KEY is not set; releasing without a signature"
          fi

      - uses: softprops/action-gh-release@v2
        with:
          files: |
            artifacts/*
            install.sh
            install.ps1
            uninstall.sh
            uninstall.ps1
          # Pre-release tags (e.g. v1.1.0-alpha.1) publish as pre-releases.
          prerelease: ${{ contains(github.ref_name, '-alpha') }}
          generate_release_notes: true

  image:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: ghcr.io/${{ github.repository }}/coordinator
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest

      - uses: docker/build-push-action@v6
        with:
          context: coordinator
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            VERSION=${{ github.ref_name }}