release.yml

---
name: "Release"

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+*"

jobs:
  goreleaser:
    name: "Build and release packages via GoReleaser"
    runs-on: ubuntu-24.04
    permissions:
      id-token: write # For cosign
      packages: write # For GHCR
      contents: read # Not required for public repositories, but for clarity
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
        with:
          fetch-depth: 0

      - name: Set up QEMU
        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # ratchet:docker/setup-qemu-action@v4.1.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # ratchet:docker/setup-buildx-action@v4.1.0

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # ratchet:actions/setup-go@v5
        with:
          go-version-file: "go.mod"

      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # ratchet:sigstore/cosign-installer@v4.1.2
        with:
          cosign-release: "v2.6.1"

      - name: Import GPG key
        id: gpg
        run: |
          echo "${GPG_PRIVATE_KEY}" | gpg --import --passphrase "${GPG_PASSPHRASE}" --batch --allow-secret-key-import

          GPG_KEY_FILE=/tmp/signing-key.gpg
          echo "${GPG_PRIVATE_KEY}" > "${GPG_KEY_FILE}"
          echo "GPG_KEY_FILE=${GPG_KEY_FILE}" >> "${GITHUB_ENV}"
        env:
          GPG_TTY: /dev/ttys000 # Set the GPG_TTY to avoid issues with pinentry
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      - name: Setup snapcraft
        run: |
          sudo snap install snapcraft --classic --channel=7.x/stable

          # See https://github.com/goreleaser/goreleaser/issues/1715
          mkdir -p "$HOME/.cache/snapcraft/download"
          mkdir -p "$HOME/.cache/snapcraft/stage-packages"
        env:
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_TOKEN }}

      - name: Prepare goreleaser file
        run: |
          set -x

          TAG=$(echo $GITHUB_REF | sed 's/refs\/tags\///')
          if [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            yq eval-all '. as $item ireduce ({}; . * $item)' .goreleaser.yml .goreleaser_release_only.yml > .goreleaser_ci.yml
          else
            cp .goreleaser.yml .goreleaser_ci.yml
          fi

      - name: Login to GitHub Container Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # ratchet:docker/login-action@v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # ratchet:docker/login-action@v4.2.0
        with:
          registry: registry.hub.docker.com
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89
        with:
          distribution: goreleaser-pro
          version: "~> v2"
          args: release --clean -f .goreleaser_ci.yml
        env:
          AUR_KEY: ${{ secrets.AUR_KEY }}
          DISABLE_CHANGELOG: ${{ vars.DISABLE_CHANGELOG}}
          GITHUB_TOKEN: ${{ secrets.TENV_GITHUB_TOKEN }}
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_TOKEN }}
          GPG_KEY_FILE: ${{ steps.gpg.outputs.GPG_KEY_FILE }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
          GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
          TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
          CLOUDSMITH_TOKEN: ${{ secrets.CLOUDSMITH_TOKEN }}
          TOFUUTILS_PR_TOKEN: ${{ secrets.TOFUUTILS_PR_TOKEN }}

  publish-chocolatey:
    name: "Publish Chocolatey package"
    runs-on: ubuntu-24.04
    needs:
      - goreleaser
    steps:
      - name: "Checkout tofuutils/chocolatey-packages"
        uses: actions/checkout@v7.0.0
        with:
          repository: tofuutils/chocolatey-packages
          ssh-key: ${{ secrets.CHOCOLATEY_SSH_KEY }}

      - name: Update chocolatey checksums
        run: |
          release_tag=$(echo $GITHUB_REF | sed 's/refs\/tags\///')
          release_version="${release_tag#v}"

          echo "[INFO] Download release's checksums"
          curl \
            -SsL \
            -o /tmp/checksums.txt \
            https://github.com/tofuutils/tenv/releases/download/${release_tag}/tenv_${release_tag}_checksums.txt

          echo "[INFO] Update chocolateyinstall.ps1"
          choco_url="https://github.com/tofuutils/tenv/releases/download/${release_tag}/tenv_${release_tag}_Windows_i386.zip"
          choco_url64="https://github.com/tofuutils/tenv/releases/download/${release_tag}/tenv_${release_tag}_Windows_x86_64.zip"
          choco_sum="$(grep "tenv_${release_tag}_Windows_i386.zip" /tmp/checksums.txt | cut -d ' ' -f 1 | tr -d '\n')"
          choco_sum64="$(grep "tenv_${release_tag}_Windows_x86_64.zip" /tmp/checksums.txt | cut -d ' ' -f 1 | tr -d '\n')"
          rm /tmp/checksums.txt

          sed -i "s~\$url = '.*'~\$url = '${choco_url}'~g" tenv/tools/chocolateyinstall.ps1
          sed -i "s~\$url64 = '.*'~\$url64 = '${choco_url64}'~g" tenv/tools/chocolateyinstall.ps1
          sed -i "s~\$checksum = '.*'~\$checksum = '${choco_sum}'~g" tenv/tools/chocolateyinstall.ps1
          sed -i "s~\$checksum64 = '.*'~\$checksum64 = '${choco_sum64}'~g" tenv/tools/chocolateyinstall.ps1

          echo "[INFO] Push changes back to git"
          git config user.name tofuutils
          git config user.email tofuutils@github.com
          git add -A
          git commit -m "Chocolatey scripts update for tenv version ${release_tag}"
          git tag -a ${release_version} -m "${release_version}"
          git push origin --tags main

  publish-ppa:
    name: "Publish PPA package"
    runs-on: ubuntu-24.04
    needs:
      - goreleaser
    steps:
      - name: Download tenv tarballs
        run: |
          release_tag=$(echo $GITHUB_REF | sed 's/refs\/tags\///')
          release_version="${release_tag#v}"

          mkdir -p ${{ github.workspace }}/tenv-tarball

          echo "[INFO] Download release's tarballs"
          curl \
            -SsL \
            -o ${{ github.workspace }}/tenv-tarball/tenv_${release_tag}_Linux_x86_64.tar.gz \
            https://github.com/tofuutils/tenv/releases/download/${release_tag}/tenv_${release_tag}_Linux_x86_64.tar.gz

      - name: Publish PPA
        uses: yuezk/publish-ppa-package@aef2cd26952551ca7d7f7ed15d75d067364cfa45 # ratchet:yuezk/publish-ppa-package@v2
        with:
          repository: "kvendingoldo/tenv"
          gpg_private_key: ${{ secrets.PPA_GPG_PRIVATE_KEY }}
          gpg_passphrase: ${{ secrets.PPA_GPG_PASSPHRASE }}
          tarball: ${{ github.workspace }}/tenv-tarball/tenv*.tar.gz
          deb_email: "kvendingoldo@gmail.com"
          deb_fullname: "tenv"