publish.yml

name: publish

on:
  push:
    branches: ['main']
    tags:
      - 'v*.*.*'

concurrency: ${{ github.ref }}

jobs:
  create-draft-release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      RELEASE_ID: ${{ steps.create-release.outputs.result }}
    steps:
      - run: "echo \"RELEASE_TAG=${GITHUB_REF#refs/tags/}\" >> $GITHUB_ENV"
      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 https://github.com/actions/github-script/releases/tag/v8.0.0
        id: create-release
        if: startsWith(github.ref, 'refs/tags/')
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          result-encoding: string
          script: |
            try {
              const response = await github.rest.repos.createRelease({
                draft: true,
                generate_release_notes: true,
                name: process.env.RELEASE_TAG,
                owner: context.repo.owner,
                prerelease: false,
                repo: context.repo.repo,
                tag_name: process.env.RELEASE_TAG,
              });

              return response.data.id;
            } catch (error) {
              core.setFailed(error.message);
            }

  build-binaries:
    strategy:
      matrix:
        os: [linux, darwin, freebsd, windows]
        arch: [amd64, arm64]
    runs-on: ubuntu-latest
    needs: [create-draft-release]
    permissions:
      actions: write
      attestations: write
      checks: write
      contents: write
      id-token: write
      packages: write
      statuses: write
    steps:
      - run: "echo \"RELEASE_TAG=${GITHUB_REF#refs/tags/}\" >> $GITHUB_ENV"
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 https://github.com/actions/checkout/releases/tag/v6.0.2
        with:
          fetch-depth: '0'
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 https://github.com/actions/setup-go/releases/tag/v6.4.0
        with:
          go-version: 1.24.x
      - name: Build binary
        run: GOOS=${{ matrix.os }} GOARCH=${{ matrix.arch }} make build
      - name: Upload release asset
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          _filename=cardano-node-api-${{ env.RELEASE_TAG }}-${{ matrix.os }}-${{ matrix.arch }}
          if [[ ${{ matrix.os }} == windows ]]; then
            _filename=${_filename}.exe
          fi
          cp cardano-node-api ${_filename}
          curl \
            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
            -H "Content-Type: application/octet-stream" \
            --data-binary @${_filename} \
            https://uploads.github.com/repos/${{ github.repository_owner }}/cardano-node-api/releases/${{ needs.create-draft-release.outputs.RELEASE_ID }}/assets?name=${_filename}
      - name: Attest binary
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0 https://github.com/actions/attest/releases/tag/v4.1.0
        with:
          subject-path: 'cardano-node-api'

  build-images:
    runs-on: ubuntu-latest
    needs: [create-draft-release]
    permissions:
      actions: write
      attestations: write
      checks: write
      contents: write
      id-token: write
      packages: write
      statuses: write
    steps:
      - run: "echo \"RELEASE_TAG=${GITHUB_REF#refs/tags/}\" >> $GITHUB_ENV"
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 https://github.com/actions/checkout/releases/tag/v6.0.2
        with:
          fetch-depth: '0'
      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 https://github.com/docker/setup-qemu-action/releases/tag/v4.0.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 https://github.com/docker/setup-buildx-action/releases/tag/v4.0.0
      - name: Login to Docker Hub
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 https://github.com/docker/login-action/releases/tag/v4.0.0
        with:
          username: blinklabs
          password: ${{ secrets.DOCKER_PASSWORD }} # uses token
      - name: Login to GHCR
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 https://github.com/docker/login-action/releases/tag/v4.0.0
        with:
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
          registry: ghcr.io
      - id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0 https://github.com/docker/metadata-action/releases/tag/v6.0.0
        with:
          images: |
            blinklabs/cardano-node-api
            ghcr.io/${{ github.repository }}
          tags: |
            # Only version, no revision
            type=match,pattern=v(.*)-(.*),group=1
            # branch
            type=ref,event=branch
            # semver
            type=semver,pattern={{version}}
      - name: Build images
        id: push
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 https://github.com/docker/build-push-action/releases/tag/v7.0.0
        with:
          outputs: "type=registry,push=true"
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
      - name: Attest Docker Hub image
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0 https://github.com/actions/attest/releases/tag/v4.1.0
        with:
          subject-name: index.docker.io/blinklabs/cardano-node-api
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true
      - name: Attest GHCR image
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0 https://github.com/actions/attest/releases/tag/v4.1.0
        with:
          subject-name: ghcr.io/${{ github.repository }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true
      # Update Docker Hub from README
      - name: Docker Hub Description
        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0 https://github.com/peter-evans/dockerhub-description/releases/tag/v5.0.0
        with:
          username: blinklabs
          password: ${{ secrets.DOCKER_PASSWORD }}
          repository: blinklabs/cardano-node-api
          readme-filepath: ./README.md
          short-description: "HTTP API over the Cardano Node UNIX socket"

  finalize-release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    needs: [create-draft-release, build-binaries, build-images]
    steps:
      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 https://github.com/actions/github-script/releases/tag/v8.0.0
        if: startsWith(github.ref, 'refs/tags/')
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            try {
              await github.rest.repos.updateRelease({
                owner: context.repo.owner,
                repo: context.repo.repo,
                release_id: ${{ needs.create-draft-release.outputs.RELEASE_ID }},
                draft: false,
              });
            } catch (error) {
              core.setFailed(error.message);
            }
      # This updates the documentation on pkg.go.dev and the latest version available via the Go module proxy
      - name: Pull new module version
        if: startsWith(github.ref, 'refs/tags/')
        uses: andrewslotin/go-proxy-pull-action@e5aea3b8b3478fc5b76befda4390513868ed2dc8 # v1.4.0 https://github.com/andrewslotin/go-proxy-pull-action/releases/tag/v1.4.0