release.yml

---
name: release
on:
  push:
    tags:
      - '[0-9]+.[0-9]+.[0-9]+'
  workflow_dispatch:

jobs:
  release:
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v6.0.2

      - name: Set version from tag
        if: github.ref_type == 'tag'
        run: |
          sed -i "s/0.0.0/${GITHUB_REF_NAME}/g" package.json

      - uses: oven-sh/setup-bun@v2.1.3
        with:
          bun-version: 1.3.10

      - uses: actions/setup-node@v6.3.0
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'

      - run: bun install --frozen-lockfile

      - run: bun run build:linux-amd64
      - run: tar czf bin/gitlab-ci-local-linux-amd64.tar.gz -C bin/linux-amd64 gitlab-ci-local

      - run: bun run build:linux-arm64
      - run: tar czf bin/gitlab-ci-local-linux-arm64.tar.gz -C bin/linux-arm64 gitlab-ci-local

      - run: bun run build:win
      - run: (cd bin/win && zip ../gitlab-ci-local-windows-amd64.zip gitlab-ci-local.exe)

      - run: bun run build:macos-x64
      - run: tar czf bin/gitlab-ci-local-darwin-amd64.tar.gz -C bin/macos-x64 gitlab-ci-local

      - run: bun run build:macos-arm64
      - run: tar czf bin/gitlab-ci-local-darwin-arm64.tar.gz -C bin/macos-arm64 gitlab-ci-local

      - name: Install rclone
        run: sudo apt-get update && sudo apt-get install -y rclone

      - name: Download existing ppa from R2
        run: rclone copy r2:${R2_BUCKET}/ ppa/
        env:
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
          RCLONE_CONFIG_R2_TYPE: s3
          RCLONE_CONFIG_R2_PROVIDER: Cloudflare
          RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
          RCLONE_CONFIG_R2_NO_CHECK_BUCKET: true

      - name: Import GPG key and preset passphrase
        run: |
          echo "${GPG_PRIVATE_KEY}" | gpg --batch --import
          echo "allow-preset-passphrase" >> ~/.gnupg/gpg-agent.conf
          gpgconf --kill gpg-agent
          gpgconf --launch gpg-agent
          for keygrip in $(gpg --list-secret-keys --with-keygrip --with-colons madsjon@gmail.com | awk -F: '/grp/{print $10}'); do
            /usr/lib/gnupg/gpg-preset-passphrase --preset --passphrase "${GPG_PASSPHRASE}" "$keygrip"
          done
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      - name: Sign release archives
        run: |
          for f in bin/gitlab-ci-local-*; do
            gpg --batch --default-key "madsjon@gmail.com" --detach-sign --armor "$f"
          done

      - name: Build .deb and sign
        run: ./publish-deb

      - run: bun run build:node

      - name: Publish to npm
        if: github.ref_type == 'tag'
        run: npm publish --provenance

      - name: Create GitHub Release
        if: github.ref_type == 'tag'
        run: |
          gh release create "${GITHUB_REF_NAME}" bin/gitlab-ci-local-* --generate-notes ||
          gh release upload "${GITHUB_REF_NAME}" bin/gitlab-ci-local-* --clobber
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload ppa to Cloudflare R2
        if: github.ref_type == 'tag'
        run: rclone copy ppa/ r2:${R2_BUCKET}/
        env:
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
          RCLONE_CONFIG_R2_TYPE: s3
          RCLONE_CONFIG_R2_PROVIDER: Cloudflare
          RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
          RCLONE_CONFIG_R2_NO_CHECK_BUCKET: true

      - name: Purge Cloudflare cache
        if: github.ref_type == 'tag'
        run: |
          curl -sf -X POST "https://api.cloudflare.com/client/v4/zones/${CLOUDFLARE_ZONE_ID}/purge_cache" \
            -H "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}" \
            -H "Content-Type: application/json" \
            --data '{"purge_everything":true}'
        env:
          CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}