stable-release.yml

---
name: Stable Release

"on":
  workflow_dispatch:
    inputs:
      release_tag:
        description: Stable semver tag to create, such as v0.10.0
        required: true
        type: string

# Stable releases are intentionally immutable. Re-running with an existing tag
# or release fails instead of replacing published assets.
concurrency:
  group: ${{ github.workflow }}-${{ inputs.release_tag }}
  cancel-in-progress: false

permissions:
  contents: read

env:
  DATAFILES_ARCHIVE: gomud-ALL-datafiles.zip
  CHECKSUMS_FILE: SHA256SUMS.txt

jobs:
  validate-release:
    name: Validate Stable Release Request
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: read
    env:
      RELEASE_TAG: ${{ inputs.release_tag }}
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    outputs:
      binary_version: ${{ steps.meta.outputs.binary_version }}
    steps:
      # actions/checkout v6.0.3
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
        with:
          persist-credentials: false

      - name: Validate stable release request
        id: meta
        run: |
          set -euo pipefail

          if [ "${GITHUB_REF}" != "refs/heads/master" ]; then
            echo "Stable releases must be run from the master branch." >&2
            exit 1
          fi

          semver_re='^v(0|[1-9][0-9]*)\.'
          semver_re="${semver_re}(0|[1-9][0-9]*)\."
          semver_re="${semver_re}(0|[1-9][0-9]*)$"
          if ! printf '%s\n' "$RELEASE_TAG" | grep -Eq "$semver_re"; then
            echo "release_tag must be a stable semver tag like v0.10.0" >&2
            exit 1
          fi

          if gh api \
            "repos/${GITHUB_REPOSITORY}/git/ref/tags/${RELEASE_TAG}" \
            >/dev/null 2>&1; then
            echo "Tag ${RELEASE_TAG} already exists; stable releases are" \
              "immutable." >&2
            exit 1
          fi

          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            echo "Release ${RELEASE_TAG} already exists; stable releases are" \
              "immutable." >&2
            exit 1
          fi

          binary_version="$(
            awk -F'"' '/^const VERSION = "/ { print $2; exit }' main.go
          )"
          if [ -z "$binary_version" ]; then
            echo "Could not determine binary version from main.go" >&2
            exit 1
          fi

          echo "binary_version=${binary_version}" >> "$GITHUB_OUTPUT"

  test:
    name: Validate Release Source
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    needs: validate-release
    permissions:
      contents: read
    steps:
      # actions/checkout v6.0.3
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-go

      - uses: ./.github/actions/go-checks

  build:
    name: Build Release Binary (${{ matrix.label }})
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    needs:
      - validate-release
      - test
    strategy:
      fail-fast: false
      matrix:
        include:
          - label: Linux amd64
            asset: gomud-linux_x64
          - label: Linux arm64
            asset: gomud-linux_arm64
          - label: Linux arm/v7
            asset: gomud-linux_armv7
          - label: Windows amd64
            asset: gomud-windows_x64.exe
          - label: Windows arm64
            asset: gomud-windows_arm64.exe
          - label: macOS amd64
            asset: gomud-darwin_x64
          - label: macOS arm64
            asset: gomud-darwin_arm64
    permissions:
      contents: read
    env:
      BINARY_VERSION: ${{ needs.validate-release.outputs.binary_version }}
      RELEASE_TARGET_ASSET: ${{ matrix.asset }}
    steps:
      # actions/checkout v6.0.3
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-go

      - name: Build release binary
        run: .github/scripts/build-release-binaries.sh

      - name: Upload release binary
        # actions/upload-artifact v7.0.1
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: release-binary-${{ matrix.asset }}
          path: dist/${{ matrix.asset }}
          if-no-files-found: error

  stage-release:
    name: Stage Stable Release
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    needs:
      - validate-release
      - build
    environment: stable-release
    permissions:
      contents: write
      id-token: write
      attestations: write
    outputs:
      release_id: ${{ steps.draft.outputs.release_id }}
    env:
      RELEASE_TAG: ${{ inputs.release_tag }}
      RELEASE_TITLE: ${{ inputs.release_tag }}
      BINARY_VERSION: ${{ needs.validate-release.outputs.binary_version }}
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      # actions/checkout v6.0.3
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
        with:
          persist-credentials: false

      - name: Recheck stable release immutability
        # The first check catches bad manual inputs early. This second check
        # runs after environment approval in case someone created the tag or
        # release while the workflow was waiting.
        run: |
          set -euo pipefail

          if gh api \
            "repos/${GITHUB_REPOSITORY}/git/ref/tags/${RELEASE_TAG}" \
            >/dev/null 2>&1; then
            echo "Tag ${RELEASE_TAG} already exists; stable releases are" \
              "immutable." >&2
            exit 1
          fi

          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            echo "Release ${RELEASE_TAG} already exists; stable releases are" \
              "immutable." >&2
            exit 1
          fi

      - name: Download release binaries
        # actions/download-artifact v8.0.1
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          pattern: release-binary-*
          path: bin/
          merge-multiple: true

      - name: Assemble release assets
        run: .github/scripts/assemble-release-assets.sh

      - name: Write release notes
        env:
          RELEASE_KIND: stable
          RELEASE_NOTES_FILE: release-notes.md
        run: .github/scripts/release-notes.sh

      - name: Resolve attestation paths
        id: release-assets
        # Attest binaries and checksums. The datafiles zip is covered by the
        # checksum file because it is assembled inside this workflow.
        run: |
          {
            echo 'attestation_paths<<EOF'
            .github/scripts/release-assets.sh attestation-paths
            echo EOF
          } >> "$GITHUB_OUTPUT"

      - name: Attest release assets
        # actions/attest-build-provenance v4.1.0
        # yamllint disable-line rule:line-length
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
        with:
          subject-path: ${{ steps.release-assets.outputs.attestation_paths }}

      - name: Create stable draft release
        id: draft
        # Draft first so a failed upload does not expose a partial release.
        run: |
          set -euo pipefail

          release_id="$(
            gh api \
              -X POST \
              "repos/${GITHUB_REPOSITORY}/releases" \
              -f "tag_name=${RELEASE_TAG}" \
              -f "target_commitish=${GITHUB_SHA}" \
              -f "name=${RELEASE_TITLE}" \
              -f "body=Stable release assets are uploading." \
              -f "make_latest=true" \
              -F draft=true \
              -F prerelease=false \
              --jq '.id'
          )"

          echo "release_id=${release_id}" >> "$GITHUB_OUTPUT"

      - name: Upload stable release assets
        run: |
          set -euo pipefail

          mapfile -t assets < <(
            .github/scripts/release-assets.sh upload-paths
          )

          gh release upload "$RELEASE_TAG" "${assets[@]}"

      - name: Attach stable release notes
        run: |
          set -euo pipefail

          gh release edit "$RELEASE_TAG" \
            --notes-file release-notes.md \
            --title "$RELEASE_TITLE" \
            --latest

  docker-image:
    name: Publish Stable Docker Image
    needs:
      - validate-release
      - stage-release
    uses: ./.github/workflows/docker-package.yml
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
    with:
      release_tag: ${{ inputs.release_tag }}

  publish:
    name: Publish Stable Release
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    needs:
      - stage-release
      - docker-image
    permissions:
      contents: write
    env:
      RELEASE_ID: ${{ needs.stage-release.outputs.release_id }}
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Publish stable release
        run: |
          set -euo pipefail

          gh api \
            -X PATCH \
            "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
            -F draft=false \
            -F prerelease=false

  cleanup-failed-draft:
    name: Cleanup Failed Stable Draft
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    needs:
      - stage-release
      - docker-image
      - publish
    if: >-
      ${{
        always() &&
        (
          needs.stage-release.result == 'failure' ||
          needs.docker-image.result == 'failure' ||
          needs.publish.result == 'failure'
        )
      }}
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      RELEASE_ID: ${{ needs.stage-release.outputs.release_id }}
      RELEASE_TAG: ${{ inputs.release_tag }}
    steps:
      - name: Delete unpublished stable draft
        run: |
          set -euo pipefail

          # Only delete a draft whose ID came from this run. Looking it up by
          # tag can delete a draft created while this run waited for approval.
          if [ -z "$RELEASE_ID" ]; then
            echo "No draft release ID was created by this workflow run."
            exit 0
          fi

          release_data="$(
            gh api "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
              --jq '[.id, .tag_name, .draft, .target_commitish] | @tsv' \
              2>/dev/null || true
          )"
          if [ -z "$release_data" ]; then
            echo "Draft release ${RELEASE_ID} was not found."
            exit 0
          fi

          IFS=$'\t' read -r release_id tag_name draft target_commitish \
            <<<"$release_data"
          if [ "$tag_name" != "$RELEASE_TAG" ] ||
            [ "$draft" != "true" ] ||
            [ "$target_commitish" != "$GITHUB_SHA" ]; then
            echo "Release ${RELEASE_TAG} is not this run's draft; leaving it."
            exit 0
          fi

          gh api \
            -X DELETE \
            "repos/${GITHUB_REPOSITORY}/releases/${release_id}"

          tag_sha="$(
            gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${RELEASE_TAG}" \
              --jq '.object.sha' \
              2>/dev/null || true
          )"
          if [ "$tag_sha" = "$GITHUB_SHA" ]; then
            gh api \
              -X DELETE \
              "repos/${GITHUB_REPOSITORY}/git/refs/tags/${RELEASE_TAG}"
          elif [ -n "$tag_sha" ]; then
            echo "Tag ${RELEASE_TAG} does not point at this run; leaving it."
          fi