op_rbuilder_release.yaml

name: "[op-rbuilder] Release"

on:
  push:
    tags:
      - "op-rbuilder/v*"
  workflow_dispatch:
    inputs:
      draft-release:
        default: false
        description: "Draft Release"
        required: false
        type: boolean
      build-docker:
        default: false
        description: "Build Docker"
        required: false
        type: boolean
      build-binary:
        default: true
        description: "Build Binary"
        required: false
        type: boolean
      features:
        default: ""
        description: "Binary Compilation Features"
        options:
          - ""
          - "redact-sensitive"
          - "flashblocks"
        required: false
        type: choice

jobs:
  extract-version:
    name: Extract version
    runs-on: ubuntu-24.04
    outputs:
      VERSION: ${{ steps.extract-version.outputs.VERSION }}
    steps:
      - name: Extract version
        id: extract-version
        run: |
          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            VERSION="${GITHUB_REF#refs/tags/op-rbuilder/}"
          else
            VERSION="$(echo ${GITHUB_SHA} | cut -c1-7)"
          fi
          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT

          echo "|                     |                        |" >> $GITHUB_STEP_SUMMARY
          echo "| ------------------- | ---------------------- |" >> $GITHUB_STEP_SUMMARY
          echo "| \`GITHUB_REF_TYPE\` | \`${GITHUB_REF_TYPE}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| \`GITHUB_REF_NAME\` | \`${GITHUB_REF_NAME}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| \`GITHUB_REF\`      | \`${GITHUB_REF}\`      |" >> $GITHUB_STEP_SUMMARY
          echo "| \`GITHUB_SHA\`      | \`${GITHUB_SHA}\`      |" >> $GITHUB_STEP_SUMMARY
          echo "| \`VERSION\`         | \`${VERSION}\`         |" >> $GITHUB_STEP_SUMMARY
          echo "| \`FEATURES\`        | \`${{ github.event.inputs.features || 'none' }}\` |" >> $GITHUB_STEP_SUMMARY

  build-binary:
    name: Build binary
    needs: extract-version
    if: ${{ github.event.inputs.build-binary == 'true' || github.event_name == 'push'}} # when manually triggered or version tagged
    runs-on: ${{ matrix.configs.runner }}
    env:
      VERSION: ${{ needs.extract-version.outputs.VERSION }}
    container:
      image: ubuntu:22.04
    permissions:
      contents: write
      packages: write
    strategy:
      matrix:
        configs:
          - target: x86_64-unknown-linux-gnu
            runner: ubuntu-24.04
          - target: aarch64-unknown-linux-gnu
            runner: warp-ubuntu-latest-arm64-32x
          # Paused until docker is pre-installed https://github.com/actions/runner-images/blob/main/images/macos/macos-14-arm64-Readme.md
          # - target: aarch64-apple-darwin
          #   runner: warp-macos-14-arm64-6x
        features:
          - ${{ github.event.inputs.features || '' }}

    steps:
      - name: Install dependencies
        run: |
          apt-get update
          apt-get install -y \
            build-essential \
            curl \
            git \
            libclang-dev \
            libssl-dev \
            pkg-config \
            protobuf-compiler
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y

      - uses: actions/checkout@v4 # must install git before checkout and set safe.directory after checkout because of container

      - name: Build op-rbuilder binary
        run: |
          git config --global --add safe.directory "$(pwd)"
          . $HOME/.cargo/env
          SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct) \
          RUSTFLAGS="--C target-feature=+crt-static -C link-arg=-static-libgcc -C link-arg=-Wl,--build-id=none -C metadata='' --remap-path-prefix=$(pwd)=." \
          CARGO_INCREMENTAL=0 \
          LC_ALL=C \
          TZ=UTC \
          CFLAGS="-D__TIME__=\"\" -D__DATE__=\"\"" \
          CXXFLAGS="-D__TIME__=\"\" -D__DATE__=\"\"" \
          cargo build --release --features=${{ matrix.features }} --locked --target ${{ matrix.configs.target }} --package op-rbuilder
      - name: Upload op-rbuilder artifact
        uses: actions/upload-artifact@v4
        with:
          name: op-rbuilder-${{ env.VERSION }}-${{ matrix.configs.target }}${{ matrix.features && '-' }}${{ matrix.features }}
          path: target/${{ matrix.configs.target }}/release/op-rbuilder

  draft-release:
    name: Draft release
    if: ${{ github.event.inputs.draft-release == 'true' || github.event_name == 'push'}} # when manually triggered or version tagged
    needs: [extract-version, build-binary]
    runs-on: ubuntu-24.04
    env:
      VERSION: ${{ needs.extract-version.outputs.VERSION }}
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download artifacts
        uses: actions/download-artifact@v5
        with:
          merge-multiple: false
          path: artifacts

      - name: Record artifacts checksums
        working-directory: artifacts
        run: |
          for dir in $( find . -type d -name "op-rbuilder-*" -printf "%f\n" ); do
            mv    ./$dir                 ./$dir.bak
            mv    ./$dir.bak/op-rbuilder ./$dir
            rm -r ./$dir.bak
          done
          find ./ || true
          for file in $( find ./ -type f ); do
            sha256sum "$file" >> sha256sums.txt
          done;
          cat sha256sums.txt

      - name: Create release draft
        uses: softprops/action-gh-release@v2.0.5
        id: create-release-draft
        with:
          draft: true
          files: artifacts/*
          generate_release_notes: true
          name: op-rbuilder/${{ env.VERSION }}
          tag_name: op-rbuilder/${{ env.VERSION }}

      - name: Write Github Step Summary
        run: |
          echo "---"
          echo "### Release Draft: op-rbuilder/${{ env.VERSION }}" >> $GITHUB_STEP_SUMMARY
          echo "${{ steps.create-release-draft.outputs.url }}" >> $GITHUB_STEP_SUMMARY

  publish-container-image:
    if: ${{ (github.ref_type == 'tag') || (github.event.inputs.build-docker == 'true') }}
    name: Publish container image
    needs: extract-version
    runs-on: ${{ matrix.configs.runner }}
    env:
      VERSION: ${{ needs.extract-version.outputs.VERSION }}
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        configs:
          - platform: linux/amd64
            runner: ubuntu-24.04
          - platform: linux/arm64
            runner: warp-ubuntu-latest-arm64-16x
    steps:
      - name: checkout sources
        uses: actions/checkout@v4

      - name: set env
        run: |
          platform=${{ matrix.configs.platform }}
          echo "PLATFORM=${platform#*/}" >> $GITHUB_ENV

      - name: docker qemu
        uses: docker/setup-qemu-action@v3

      - name: docker buildx
        uses: docker/setup-buildx-action@v3

      - name: docker metadata
        uses: docker/metadata-action@v5
        id: meta
        with:
          images: ghcr.io/${{ github.repository }}
          labels: org.opencontainers.image.source=${{ github.repositoryUrl }}
          tags: |
            type=semver,pattern={{version}},value=${{ env.VERSION }},prefix=v,suffix=-${{ env.PLATFORM }}
            type=sha,suffix=-${{ env.PLATFORM }}

            # Push latest tag for full version only, not for prerelease versions (i.e. not for v1.2.3-rc1)
            type=raw,value=latest,enable=${{ !contains(env.VERSION, '-') }},suffix=-${{ env.PLATFORM }}

      - name: docker login
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: docker build and push op-rbuilder
        uses: docker/build-push-action@v5
        id: build
        with:
          cache-from: type=gha
          cache-to: type=gha,mode=max
          file: Dockerfile
          context: .
          labels: ${{ steps.meta.outputs.labels }}
          platforms: ${{ matrix.configs.platform }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          build-args: |
            FEATURES=${{ github.event.inputs.features || '' }}
            RBUILDER_BIN=op-rbuilder

      - name: export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ env.PLATFORM }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  publish-container-index:
    name: Publish container index
    runs-on: ubuntu-24.04
    env:
      VERSION: ${{ needs.extract-version.outputs.VERSION }}
    needs:
      - extract-version
      - publish-container-image
    steps:
      - name: download digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: setup docker buildx
        uses: docker/setup-buildx-action@v3

      - name: login to ghcr
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: generate container metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          labels: org.opencontainers.image.source=${{ github.repositoryUrl }}
          tags: |
            type=semver,pattern={{version}},value=${{ env.VERSION }},prefix=v
            type=sha

            # Push latest tag for full version only, not for prerelease versions (i.e. not for v1.2.3-rc1)
            type=raw,value=latest,enable=${{ !contains(env.VERSION, '-') }}

      - name: create manifest list and push
        working-directory: /tmp/digests
        run: |
          jq -cr '.tags[]' <<< "$DOCKER_METADATA_OUTPUT_JSON" | while read -r tag; do
            echo "Creating manifest for tag: $tag"
            docker buildx imagetools create -t $tag $(
              printf 'ghcr.io/${{ github.repository }}@sha256:%s ' *
            )
          done

      - name: inspect image
        run: |
          docker buildx imagetools inspect ghcr.io/${{ github.repository }}:${{ env.VERSION }}