deploy.yml

name: nix:deploy
on:
  push:
    branches:
      - main
    tags:
      - 'v*'

jobs:
  docker:
    name: deploy::docker

    # This job doesn't work as written on ubuntu-24.04. The problem is described
    # in this issue: https://github.com/actions/runner-images/issues/10443
    runs-on: ubuntu-22.04
    steps:
    - name: Checkout 🛎️
      uses: actions/checkout@v3

    - name: Install Nix ❄
      uses: DeterminateSystems/nix-installer-action@v4

    - name: Link Cachix 🔌
      uses: cachix/cachix-action@v12
      with:
        name: '${{ vars.CACHIX_CACHE_NAME }}'
        authToken: '${{ secrets.CACHIX_CACHE_AUTH_TOKEN }}'

    - name: Login to GitHub Container Registry 📦
      uses: docker/login-action@v1
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Deploy 🚀
      run: nix run .#publish-docker-image ${{ github.ref }}

  # Builds with nix for simplicity
  build-connector-binaries:
    name: build the connector binaries
    strategy:
      matrix:
        include:
          - target: x86_64-linux
          - target: aarch64-linux
    runs-on: ubuntu-24.04
    steps:
    - name: Checkout 🛎️
      uses: actions/checkout@v3

    - name: Install Nix ❄
      uses: DeterminateSystems/nix-installer-action@v4

    - name: Link Cachix 🔌
      uses: cachix/cachix-action@v12
      with:
        name: '${{ vars.CACHIX_CACHE_NAME }}'
        authToken: '${{ secrets.CACHIX_CACHE_AUTH_TOKEN }}'

    - name: Login to GitHub Container Registry 📦
      uses: docker/login-action@v1
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Build statically-linked binary 🔨
      run: |
        nix build --print-build-logs .#mongodb-connector-${{ matrix.target }}
        mkdir -p release
        cp result/bin/mongodb-connector release/mongodb-connector-${{ matrix.target }}

    - name: Upload binaries to workflow artifacts 🚀
      uses: actions/upload-artifact@v4
      with:
        name: mongodb-connector-${{ matrix.target }}
        path: release
        if-no-files-found: error

  # Builds without nix to get Windows binaries
  build-cli-binaries:
    name: build the CLI binaries
    strategy:
      matrix:
        include:
          - runner: ubuntu-24.04
            target: x86_64-unknown-linux-musl
            rustflags: -C target-feature=+crt-static
            linux-packages: musl-tools
          - runner: ubuntu-24.04
            target: aarch64-unknown-linux-musl
            rustflags: -C target-feature=+crt-static
            linux-packages: gcc-aarch64-linux-gnu musl-tools
            linker: /usr/bin/aarch64-linux-gnu-gcc
          - runner: macos-latest
            target: x86_64-apple-darwin
          - runner: macos-latest
            target: aarch64-apple-darwin
          - runner: windows-latest
            target: x86_64-pc-windows-msvc
            rustflags: -C target-feature=+crt-static
            extension: .exe
    runs-on: ${{ matrix.runner }}
    env:
      CARGO_BUILD_TARGET: ${{ matrix.target }}
      CARGO_NET_GIT_FETCH_WITH_CLI: "true"
      RUSTFLAGS: "-D warnings ${{ matrix.rustflags }}"
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@v4

      - name: install protoc
        uses: arduino/setup-protoc@v3
        with:
          version: "25.x"
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: install tools
        run: |
          rustup show
          rustup target add ${{ matrix.target }}

      - name: install other packages required
        if: matrix.linux-packages
        run: |
          sudo apt-get update
          sudo apt-get install -y ${{ matrix.linux-packages }}

      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: "build" # share the cache across jobs

      - name: build the CLI
        run: |
          # If we're on a tag, use the tag name as the release version.
          if [[ "$GITHUB_REF_TYPE" == 'tag' ]]; then
            # Ensure that the version specified in Cargo.toml is the same as the tag (with a 'v' prefix).
            CARGO_VERSION="$(cargo metadata --format-version=1 | jq -r '.packages | .[] | select(.name == "mongodb-cli-plugin") | .version')"
            echo "Git tag: ${GITHUB_REF_NAME}"
            echo "Cargo version: ${CARGO_VERSION}"

            if [[ "${GITHUB_REF_NAME}" != "v${CARGO_VERSION}" ]]; then
              echo >&2 "The Git tag is \"${GITHUB_REF_NAME}\", but the version in Cargo.toml is \"${CARGO_VERSION}\"."
              echo >&2 'These must be the same, with a "v" prefix for the tag. Aborting.'
              exit 1
            fi
            export RELEASE_VERSION="$GITHUB_REF_NAME"
            echo "RELEASE_VERSION = ${RELEASE_VERSION}"
          fi

          if [[ -n '${{ matrix.linker }}' ]]; then
            TARGET_SCREAMING="$(echo '${{ matrix.target }}' | tr '[:lower:]' '[:upper:]' | tr '-' '_')"
            echo "CARGO_TARGET_${TARGET_SCREAMING}_LINKER"='${{ matrix.linker }}'
            declare "CARGO_TARGET_${TARGET_SCREAMING}_LINKER"='${{ matrix.linker }}'
            export "CARGO_TARGET_${TARGET_SCREAMING}_LINKER"
          fi

          echo "Building for target: ${CARGO_BUILD_TARGET}"
          cargo build --release --package=mongodb-cli-plugin

          mkdir -p release
          mv -v target/${{ matrix.target }}/release/mongodb-cli-plugin release/mongodb-cli-plugin-${{ matrix.target }}${{ matrix.extension }}

      - uses: actions/upload-artifact@v4
        with:
          name: mongodb-cli-plugin-${{ matrix.target }}${{ matrix.extension }}
          path: release
          if-no-files-found: error

  release:
    name: release to GitHub
    needs:
      - docker
      - build-connector-binaries
      - build-cli-binaries
    runs-on: ubuntu-24.04
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          path: release/artifacts
          merge-multiple: true

      - name: generate SHA-256 checksums
        run: |
          cd release/artifacts
          sha256sum * > ./sha256sum
          cat ./sha256sum

      - name: Build connector definition
        run: |
          set -eo pipefail
          export RELEASE_VERSION="$GITHUB_REF_NAME"
          export LINUX_AMD64_SHA256=$(cat release/artifacts/sha256sum   | grep mongodb-cli-plugin-x86_64-unknown-linux-musl  | cut -f1 -d' ')
          export MACOS_AMD64_SHA256=$(cat release/artifacts/sha256sum   | grep mongodb-cli-plugin-x86_64-apple-darwin        | cut -f1 -d' ')
          export WINDOWS_AMD64_SHA256=$(cat release/artifacts/sha256sum | grep mongodb-cli-plugin-x86_64-pc-windows-msvc.exe | cut -f1 -d' ')
          export LINUX_ARM64_SHA256=$(cat release/artifacts/sha256sum   | grep mongodb-cli-plugin-aarch64-unknown-linux-musl | cut -f1 -d' ')
          export MACOS_ARM64_SHA256=$(cat release/artifacts/sha256sum   | grep mongodb-cli-plugin-aarch64-apple-darwin       | cut -f1 -d' ')
          make -C connector-definition build
          cp connector-definition/dist/connector-definition.tgz release/artifacts/

      - name: generate CLI manifest
        run: |
          export VERSION="$GITHUB_REF_NAME"
          ./scripts/generate-manifest.sh
      
      - uses: actions/upload-artifact@v4
        with:
          name: manifest.yaml
          path: release/manifest.yaml
          if-no-files-found: error

      - name: Get version from tag
        id: get-version
        run: |
          echo "tagged_version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
        shell: bash

      - uses: mindsers/changelog-reader-action@v2
        id: changelog-reader
        with:
          version: ${{ steps.get-version.outputs.tagged_version }}
          path: ./CHANGELOG.md

      - name: create a draft release
        uses: ncipollo/release-action@v1
        with:
          draft: true
          tag: v${{ steps.get-version.outputs.tagged_version }}
          body: ${{ steps.changelog-reader.outputs.changes }}
          artifacts: release/artifacts/*