publish-release.yml

name: publish-release
on:
  workflow_dispatch:
    inputs:
      releaseType:
        description: 'release type (release: publish by tag; nightly: generate nightly version and ignore tag)'
        required: true
        default: 'release'
        type: choice
        options:
          - release
          - nightly
      tag:
        description: 'release tag (required when releaseType=release)'
        required: false
        type: string
      commitId:
        description: 'specific commit SHA to build (optional; used for checkout and nightly suffix)'
        required: false
        type: string

  schedule:
    - cron: '0 22 * * *'

  release:
    types: [published]

env:
  NIGHTLY_BASE_VERSION: '4.0.0'

jobs:
  get-version:
    runs-on: lynx-ubuntu-22.04-medium
    timeout-minutes: 60
    env:
      EVENT_NAME: ${{ github.event_name }}
      REF: ${{ github.ref }}
      REF_NAME: ${{ github.ref_name }}
      INPUT_RELEASE_TYPE: ${{ github.event.inputs.releaseType || '' }}
      INPUT_TAG: ${{ github.event.inputs.tag || '' }}
      INPUT_COMMIT_ID: ${{ github.event.inputs.commitId || '' }}
    outputs:
      version: ${{ steps.resolve_version.outputs.VERSION }}
      ios_storage_type: ${{ steps.resolve_version.outputs.IOS_STORAGE_TYPE }}
      checkout_ref: ${{ steps.resolve_checkout_ref.outputs.CHECKOUT_REF }}
    steps:
      - name: Validate manual inputs
        if: ${{ github.event_name == 'workflow_dispatch' }}
        run: |-
          if [ -n "$INPUT_COMMIT_ID" ] && ! [[ "$INPUT_COMMIT_ID" =~ ^[0-9a-fA-F]{7,40}$ ]]; then
            echo "commitId must be a git SHA (7-40 hex chars)."
            exit 1
          fi

          if [ "$INPUT_RELEASE_TYPE" != "nightly" ] && [ -z "$INPUT_TAG" ]; then
            echo "tag is required when releaseType=release."
            exit 1
          fi

      - name: Resolve release mode
        id: resolve_release_mode
        run: |-
          release_mode="tag_release"

          if [ "$EVENT_NAME" = "schedule" ]; then
            release_mode="nightly"
          elif [ "$EVENT_NAME" = "workflow_dispatch" ] && [ "$INPUT_RELEASE_TYPE" = "nightly" ]; then
            release_mode="nightly"
          elif [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            release_mode="manual_release"
          fi

          echo "RELEASE_MODE=$release_mode" >> "$GITHUB_OUTPUT"

      - name: Resolve checkout ref
        id: resolve_checkout_ref
        env:
          RELEASE_MODE: ${{ steps.resolve_release_mode.outputs.RELEASE_MODE }}
        run: |-
          case "$RELEASE_MODE" in
            nightly)
              checkout_ref="${INPUT_COMMIT_ID:-$GITHUB_SHA}"
              commit_short="${INPUT_COMMIT_ID:-$GITHUB_SHA}"
              ;;
            manual_release)
              checkout_ref="${INPUT_COMMIT_ID:-$REF}"
              commit_short="${INPUT_COMMIT_ID:-$GITHUB_SHA}"
              ;;
            tag_release)
              checkout_ref="$REF"
              commit_short="$GITHUB_SHA"
              ;;
            *)
              echo "Unsupported release mode: $RELEASE_MODE"
              exit 1
              ;;
          esac

          commit_short="$(printf '%s' "$commit_short" | tr '[:upper:]' '[:lower:]')"
          echo "CHECKOUT_REF=$checkout_ref" >> "$GITHUB_OUTPUT"
          echo "COMMIT_SHORT=${commit_short:0:8}" >> "$GITHUB_OUTPUT"

      - name: Resolve version
        id: resolve_version
        env:
          RELEASE_MODE: ${{ steps.resolve_release_mode.outputs.RELEASE_MODE }}
          COMMIT_SHORT: ${{ steps.resolve_checkout_ref.outputs.COMMIT_SHORT }}
          CHECKOUT_REF: ${{ steps.resolve_checkout_ref.outputs.CHECKOUT_REF }}
        run: |-
          case "$RELEASE_MODE" in
            nightly)
              version="${NIGHTLY_BASE_VERSION}-nightly.$(TZ=Asia/Shanghai date +'%Y%m%d%H%M').${GITHUB_RUN_NUMBER}.g${COMMIT_SHORT}"
              storage_type="s3"
              ;;
            manual_release)
              version="$INPUT_TAG"
              storage_type="github_release"
              ;;
            tag_release)
              version="$REF_NAME"
              storage_type="github_release"
              ;;
            *)
              echo "Unsupported release mode: $RELEASE_MODE"
              exit 1
              ;;
          esac

          version_regex='^[0-9]+\.[0-9]+\.[0-9]+(-((rc|alpha)\.[0-9]+|nightly\.[0-9]{12}\.[0-9]+\.g[0-9a-f]+))?$'
          if ! [[ "$version" =~ $version_regex ]]; then
            echo "Version is invalid"
            exit 1
          fi

          echo "Version is valid"
          echo "Resolved version: $version"
          echo "Release mode: $RELEASE_MODE"
          echo "Checkout ref: $CHECKOUT_REF"
          echo "iOS storage type: $storage_type"
          echo "VERSION=$version" >> "$GITHUB_OUTPUT"
          echo "IOS_STORAGE_TYPE=$storage_type" >> "$GITHUB_OUTPUT"
          {
            echo "### Release version"
            echo
            echo "| Field | Value |"
            echo "| --- | --- |"
            printf '| Release mode | `%s` |\n' "$RELEASE_MODE"
            printf '| Version | `%s` |\n' "$version"
            printf '| Checkout ref | `%s` |\n' "$CHECKOUT_REF"
            printf '| iOS storage type | `%s` |\n' "$storage_type"
          } >> "$GITHUB_STEP_SUMMARY"

  android-explorer-build:
    timeout-minutes: 60
    runs-on: lynx-ubuntu-22.04-large
    needs: get-version
    if: ${{ !contains(needs.get-version.outputs.version, '-nightly.') }}
    steps:
      - name: Download Source
        uses: actions/checkout@v6
        with:
          path: lynx
          ref: ${{ needs.get-version.outputs.checkout_ref }}
          fetch-depth: 0
      - name: Build Explorer App
        uses: ./lynx/.github/actions/android-explorer-build
        with:
          abi-list: armeabi-v7a,x86,x86_64,arm64-v8a
      - name: push to release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ needs.get-version.outputs.version }}
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: '${{ github.workspace }}/lynx/explorer/android/lynx_explorer/build/outputs/apk/noasan/release/LynxExplorer-noasan-release.apk'
          allowUpdates: true
          body: ''

  ios-explorer-build:
    timeout-minutes: 60
    runs-on: lynx-darwin-14-medium
    needs: get-version
    if: ${{ !contains(needs.get-version.outputs.version, '-nightly.') }}
    strategy:
      matrix:
        arch: [arm64, x86_64]
    steps:
      - name: Download Source
        uses: actions/checkout@v6
        with:
          path: lynx
          ref: ${{ needs.get-version.outputs.checkout_ref }}
          fetch-depth: 0
      - name: Build Explorer App
        uses: ./lynx/.github/actions/ios-explorer-build
        with:
          build-arch: ${{ matrix.arch }}
      - name: push explorer to release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ needs.get-version.outputs.version }}
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: '${{ github.workspace }}/lynx/LynxExplorer-${{ matrix.arch }}.app.tar.gz'
          allowUpdates: true
          body: ''

  harmony-explorer-build:
    runs-on: lynx-custom-container
    container:
      image: ghcr.io/lynx-family/ubuntu24.04-harmony@sha256:bf493c3710de3c44bfa84caf402c0727b9310c42497f6e52580ad441ea640ef1
      credentials:
        username: lynx-family
        password: ${{ secrets.GITHUB_TOKEN }}
    needs: get-version
    if: ${{ !contains(needs.get-version.outputs.version, '-nightly.') }}
    defaults:
      run:
        working-directory: ${{ github.workspace }}
        shell: bash
    steps:
      - name: Download Source
        uses: actions/checkout@v6
        with:
          path: lynx
          ref: ${{ needs.get-version.outputs.checkout_ref }}
          fetch-depth: 0
      - name: Build Explorer App
        uses: ./lynx/.github/actions/harmony-explorer-build
      - name: push explorer to release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ needs.get-version.outputs.version }}
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: '${{ github.workspace }}/lynx/explorer/harmony/lynx_explorer/build/default/outputs/default/lynx_explorer-default-unsigned.hap'
          allowUpdates: true
          body: ''

  android-sdk-release:
    runs-on: ubuntu-22.04
    needs: get-version
    timeout-minutes: 240
    steps:
      - name: Download Source
        uses: actions/checkout@v6
        with:
          path: lynx
          ref: ${{ needs.get-version.outputs.checkout_ref }}
          fetch-depth: 0
      - name: Free up disk space
        uses: ./lynx/.github/actions/free-android-disk
      - name: Python Setup
        uses: actions/setup-python@v6
        with:
          python-version: '3.13'
      - name: Setup Android environment
        uses: ./lynx/.github/actions/setup-android-env
      - name: Install Common Dependencies
        uses: ./lynx/.github/actions/common-deps
        with:
          cache-backend: 'github'
      - name: Android SDK Release
        uses: ./lynx/.github/actions/android-sdk-release
        with:
          version: ${{ needs.get-version.outputs.version }}
          signingKeyId: ${{ secrets.SIGNING_KEY_ID }}
          signingPassword: ${{ secrets.SIGNING_PASSWORD }}
          signingSecretKey: ${{ secrets.SIGNING_SECRET_KEY }}
          abiList: 'armeabi-v7a,x86,x86_64,arm64-v8a'
      - name: Package maven artifacts
        run: |-
          cd $GITHUB_WORKSPACE/lynx
          pushd platform/android
          ./gradlew zipArtifacts -Pversion=${{ needs.get-version.outputs.version }} getArtifactList
          popd
          pushd platform/android/build
          artifact_list=$(<artifact-list)
          echo "::set-output name=artifact_list::$artifact_list"
          popd
        id: build_artifact
      - name: Publish artifact to maven
        uses: lynx-infra/maven-publish-action@53b4da2f23f9cfc4e905b135eda2724fcf5a0f0e
        with:
          portal_api_token: ${{ secrets.PORTAL_API_TOKEN }}
          artifact_path_list: ${{ steps.build_artifact.outputs.artifact_list }}

  ios-sdk-publish:
    timeout-minutes: 60
    runs-on: macos-14
    needs: get-version
    env:
      REPO_LYNX_ARTIFACTS_S3_AK: ${{ secrets.REPO_LYNX_ARTIFACTS_S3_AK }}
      REPO_LYNX_ARTIFACTS_S3_SK: ${{ secrets.REPO_LYNX_ARTIFACTS_S3_SK }}
      REPO_LYNX_ARTIFACTS_S3_BUCKET: ${{ vars.REPO_LYNX_ARTIFACTS_S3_BUCKET }}
      REPO_LYNX_ARTIFACTS_S3_REGION: ${{ vars.REPO_LYNX_ARTIFACTS_S3_REGION }}
      REPO_LYNX_ARTIFACTS_S3_UPLOAD_DOMAIN: ${{ vars.REPO_LYNX_ARTIFACTS_S3_UPLOAD_DOMAIN }}
      REPO_LYNX_ARTIFACTS_S3_PUBLIC_DOMAIN: ${{ vars.REPO_LYNX_ARTIFACTS_S3_PUBLIC_DOMAIN }}
      REPO_LYNX_ARTIFACTS_S3_PATH_PREFIX: ${{ vars.REPO_LYNX_ARTIFACTS_S3_PATH_PREFIX || 'ios-sdk' }}
    steps:
      - name: Download Source
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.get-version.outputs.checkout_ref }}
          fetch-depth: 0
          path: lynx
      - name: Python Setup
        uses: actions/setup-python@v6
        with:
          python-version: '3.13'
      - name: Set up Ruby + specify Bundler version
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '2.6.10'
      - name: Install Common Dependencies
        uses: ./lynx/.github/actions/common-deps
        with:
          cache-backend: github
      - name: Setup Ruby Cache
        uses: ./lynx/.github/actions/ios-common-deps
        with:
          cache-backend: 'github'
      - name: Publish iOS SDK
        uses: ./lynx/.github/actions/ios-sdk-publish
        with:
          version: ${{ needs.get-version.outputs.version }}
          tag: ${{ needs.get-version.outputs.version }}
          storage_type: ${{ needs.get-version.outputs.ios_storage_type }}
          cocoapods_trunk_token: ${{ secrets.COCOAPODS_TRUNK_TOKEN }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          component: all
      - name: Publish iOS dev SDK
        uses: ./lynx/.github/actions/ios-sdk-publish
        env:
          LYNX_ENABLE_RECORDER: 1
        with:
          version: ${{ needs.get-version.outputs.version }}-dev
          tag: ${{ needs.get-version.outputs.version }}
          storage_type: ${{ needs.get-version.outputs.ios_storage_type }}
          cocoapods_trunk_token: ${{ secrets.COCOAPODS_TRUNK_TOKEN }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          component: all

  cocoapods-lynx-library-publish:
    timeout-minutes: 30
    runs-on: ubuntu-22.04
    needs: get-version
    environment: rubygems
    permissions:
      contents: read
    steps:
      - name: Download Source
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.get-version.outputs.checkout_ref }}
          fetch-depth: 0
          path: lynx
      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.1'
      - name: Resolve gem version
        id: gem_version
        env:
          RELEASE_VERSION: ${{ needs.get-version.outputs.version }}
        run: |-
          gem_version=$(ruby -e "puts Gem::Version.new(ENV.fetch('RELEASE_VERSION')).to_s")
          echo "Gem version: $gem_version"
          echo "version=$gem_version" >> "$GITHUB_OUTPUT"
      - name: Check published version
        id: published_version
        run: |-
          versions=$(gem list --remote --exact --all cocoapods-lynx-library || true)
          echo "Published versions: ${versions:-none}"
          if echo "$versions" | tr '(), ' '\n' | grep -Fx "${{ steps.gem_version.outputs.version }}" > /dev/null; then
            echo "publish_needed=false" >> "$GITHUB_OUTPUT"
          else
            echo "publish_needed=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Test
        run: |-
          cd $GITHUB_WORKSPACE/lynx/tools/ios_tools/cocoapods-lynx-library
          ruby -Itest test/autolink_test.rb
      - name: Build
        id: build_gem
        env:
          GEM_VERSION: ${{ steps.gem_version.outputs.version }}
        run: |-
          cd $GITHUB_WORKSPACE/lynx/tools/ios_tools/cocoapods-lynx-library
          ruby <<'RUBY'
          path = 'cocoapods-lynx-library.gemspec'
          version = ENV.fetch('GEM_VERSION')
          content = File.read(path)
          updated = content.sub(/spec\.version\s*=\s*['"][^'"]+['"]/, "spec.version = '#{version}'")
          abort "Unable to update #{path} version" if updated == content
          File.write(path, updated)
          RUBY
          gem build cocoapods-lynx-library.gemspec | tee gem-build.log
          gem_file=$(awk -F': ' '/File:/ {print $2}' gem-build.log | tail -n 1)
          echo "gem_file=$gem_file" >> "$GITHUB_OUTPUT"
          ruby -rrubygems/package -e 'spec = Gem::Package.new(ARGV.fetch(0)).spec; puts "#{spec.name} #{spec.version}"; puts spec.summary' "$gem_file"
      - name: Upload gem artifact
        uses: actions/upload-artifact@v5
        with:
          name: cocoapods-lynx-library-${{ steps.gem_version.outputs.version }}
          path: lynx/tools/ios_tools/cocoapods-lynx-library/${{ steps.build_gem.outputs.gem_file }}
      - name: Publish CocoaPods plugin
        if: steps.published_version.outputs.publish_needed == 'true'
        env:
          GEM_HOST_API_KEY: ${{ secrets.RUBYGEMS_API_KEY }}
        run: |-
          cd $GITHUB_WORKSPACE/lynx/tools/ios_tools/cocoapods-lynx-library
          if [ -z "$GEM_HOST_API_KEY" ]; then
            echo "RUBYGEMS_API_KEY is required to publish cocoapods-lynx-library."
            exit 1
          fi
          gem push "${{ steps.build_gem.outputs.gem_file }}"

  harmony-sdk-publish:
    name: Publish Harmony SDK (${{ matrix.label }})
    runs-on: lynx-custom-container
    container:
      image: ghcr.io/lynx-family/ubuntu24.04-harmony@sha256:25913874dad0557526b44f9c9ab30b9873080009db85bb569d718d2bb5f0e074
      credentials:
        username: lynx-family
        password: ${{ secrets.GITHUB_TOKEN }}
    defaults:
      run:
        shell: bash
    needs: get-version
    strategy:
      matrix:
        include:
          - version_suffix: ''
            modules: 'default'
            build_param: ''
            label: 'formal'
          - version_suffix: '-dev'
            modules: 'lynx lynx_devtool lynx_base'
            build_param: '--dev'
            label: 'dev'
    steps:
      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          toolchain: stable
          profile: minimal
          override: true
      - name: Install git-cliff
        run: |
          cargo install git-cliff --locked
          git-cliff --version
      - name: Download Source
        uses: actions/checkout@v6
        with:
          path: lynx
          fetch-depth: 0
          fetch-tags: true
          ref: ${{ needs.get-version.outputs.checkout_ref }}
      - name: Get latest tag
        id: get-latest-tag
        uses: ./lynx/.github/actions/get-latest-tag
        with:
          current-tag: ${{ needs.get-version.outputs.version }}
      - name: Install Common Dependencies
        uses: ./lynx/.github/actions/common-deps
        with:
          cache-key-prefix: '-container'
      - name: Generate Change Log
        run: |
          cd $GITHUB_WORKSPACE/lynx
          source tools/envsetup.sh
          COMMIT_ID=$(git rev-list -n 1 ${{ steps.get-latest-tag.outputs.latest-tag }})
          python3 explorer/harmony/script/generate_changelog.py --version ${{ needs.get-version.outputs.version }}${{ matrix.version_suffix }} --modules ${{ matrix.modules }} --base_commit $COMMIT_ID
      - name: Build Harmony SDK
        run: |
          cd $GITHUB_WORKSPACE/lynx
          source tools/envsetup.sh
          pushd platform/harmony && ohpm install && popd
          pushd explorer/harmony && ohpm install && popd
          python3 explorer/harmony/script/build.py ${{ matrix.build_param }} --build_lynx_core --build_har --modules ${{ matrix.modules }} --override_version ${{ needs.get-version.outputs.version }}${{ matrix.version_suffix }}
      - name: Publish Harmony SDK
        run: |
          cd $GITHUB_WORKSPACE/lynx
          source tools/envsetup.sh
          export PUBLISH_KEY_PASSPHRASE=${{ secrets.HARMONY_PUBLISH_KEY_PASSPHRASE }}
          cat << EOF > publish_key
          ${{ secrets.HARMONY_PUBLISH_KEY }}
          EOF
          ohpm config set publish_registry https://ohpm.openharmony.cn/ohpm
          export PUBLISH_ID=${{ secrets.HARMONY_PUBLISH_ID }}
          export KEY_PATH=$GITHUB_WORKSPACE/lynx/publish_key
          python3 explorer/harmony/script/publish.py --modules ${{ matrix.modules }} --version ${{ needs.get-version.outputs.version }}${{ matrix.version_suffix }}

  macos-explorer-release:
    timeout-minutes: 60
    runs-on: lynx-darwin-14-medium
    needs: get-version
    if: ${{ !contains(needs.get-version.outputs.version, '-nightly.') }}
    strategy:
      matrix:
        arch: [arm64, x64]
    steps:
      - name: Download Source
        uses: actions/checkout@v6
        with:
          path: lynx
          ref: ${{ needs.get-version.outputs.checkout_ref }}
          fetch-depth: 0
      - name: Build macOS Explorer
        uses: ./lynx/.github/actions/macos-explorer-build
        with:
          build-arch: ${{ matrix.arch }}
      - name: push explorer to release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ needs.get-version.outputs.version }}
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: '${{ github.workspace }}/lynx/LynxExplorer-macos-${{ matrix.arch }}.app.tar.gz,${{ github.workspace }}/lynx/out/Default/lynx_sdk_macos_${{ matrix.arch }}.zip'
          allowUpdates: true
          body: ''

  windows-explorer-release:
    timeout-minutes: 60
    runs-on: lynx-windows-2022-large
    needs: get-version
    if: ${{ !contains(needs.get-version.outputs.version, '-nightly.') }}
    strategy:
      matrix:
        arch: [x86, x64]
    steps:
      - name: Configure Git
        shell: PowerShell
        run: |
          git config --global core.autocrlf false
          git config --global core.eol lf
          git config --global http.sslBackend "schannel"
        working-directory: ./
      - name: Download Source
        uses: actions/checkout@v6
        with:
          path: lynx
          ref: ${{ needs.get-version.outputs.checkout_ref }}
          fetch-depth: 0
      - name: Python Setup
        uses: actions/setup-python@v6
        with:
          python-version: '3.13'
      - name: Install Common Dependencies
        uses: ./lynx/.github/actions/windows-common-deps
        with:
          target: 'clay'
      - name: Build windows Explorer
        uses: ./lynx/.github/actions/windows-explorer-build
        with:
          build-arch: ${{ matrix.arch }}
      - name: push explorer to release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ needs.get-version.outputs.version }}
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: '${{ github.workspace }}/lynx/LynxExplorer-windows-${{ matrix.arch }}.tar.gz,${{ github.workspace }}/lynx/out/Default/lynx_sdk_windows_${{ matrix.arch }}.zip'
          allowUpdates: true
          body: ''