release.yaml

name: release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  # Run required checks before creating release
  pre-commit:
    uses: ./.github/workflows/pre-commit.yaml

  tests:
    uses: ./.github/workflows/test.yaml

  create-release:
    needs: [pre-commit, tests]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      version: ${{ steps.get_version.outputs.version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1

      - name: Get version
        id: get_version
        run: |
          if [[ $GITHUB_REF == refs/tags/* ]]; then
            VERSION=${GITHUB_REF#refs/tags/}
          else
            VERSION=$(git describe --tags --always)
          fi
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          echo "Version: ${VERSION}"

      - name: Extract release notes from CHANGELOG
        id: extract_notes
        run: |
          VERSION=${{ steps.get_version.outputs.version }}
          # Extract notes for this version from CHANGELOG.md
          if [ -f CHANGELOG.md ]; then
            # Get content between version header and next version or end
            NOTES=$(awk "/## \[${VERSION#v}\]/{flag=1; next} /## \[/{flag=0} flag" CHANGELOG.md)
            if [ -z "$NOTES" ]; then
              NOTES="Release ${VERSION}"$'\n\n'"Built with Neutrino v0.18.0"$'\n\n'"See [CHANGELOG.md](CHANGELOG.md) for details."
            fi
          else
            NOTES="Release ${VERSION}"
          fi
          echo "notes<<EOF" >> $GITHUB_OUTPUT
          echo "$NOTES" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Create Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create ${{ steps.get_version.outputs.version }} \
            --title "${{ steps.get_version.outputs.version }}" \
            --notes-file - <<'EOF'
          ${{ steps.extract_notes.outputs.notes }}
          EOF

  build-binaries:
    needs: create-release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    strategy:
      matrix:
        include:
          - goos: linux
            goarch: amd64
            output: neutrinod-linux-amd64
          - goos: linux
            goarch: 386
            output: neutrinod-linux-386
          - goos: linux
            goarch: arm64
            output: neutrinod-linux-arm64
          - goos: linux
            goarch: arm
            goarm: 7
            output: neutrinod-linux-armv7
          - goos: linux
            goarch: arm
            goarm: 6
            output: neutrinod-linux-armv6
          - goos: darwin
            goarch: amd64
            output: neutrinod-darwin-amd64
          - goos: darwin
            goarch: arm64
            output: neutrinod-darwin-arm64
          - goos: windows
            goarch: amd64
            output: neutrinod-windows-amd64.exe
          - goos: windows
            goarch: arm64
            output: neutrinod-windows-arm64.exe

    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1

      - name: Get reproducible build timestamp
        id: source_date
        run: echo "epoch=$(git log -1 --pretty=%ct)" >> $GITHUB_OUTPUT

      - name: Set up Go
        uses: actions/setup-go@v7.0.0
        with:
          go-version: '1.27.0'
          cache-dependency-path: neutrino_server/go.sum

      - name: Get dependencies
        working-directory: neutrino_server
        run: go mod download

      - name: Build binary
        working-directory: neutrino_server
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          GOARM: ${{ matrix.goarm }}
          CGO_ENABLED: 0
          SOURCE_DATE_EPOCH: ${{ steps.source_date.outputs.epoch }}
        run: |
          VERSION=${{ needs.create-release.outputs.version }}

          go build \
            -trimpath \
            -buildvcs=false \
            -ldflags="-buildid= -s -w -X main.version=${VERSION}" \
            -o ${{ matrix.output }} \
            ./cmd/neutrinod

      - name: Upload binary artifact
        uses: actions/upload-artifact@v7.0.1
        with:
          name: binary-${{ matrix.output }}
          path: neutrino_server/${{ matrix.output }}
          if-no-files-found: error

  build-docker:
    needs: create-release
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4.2.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4.3.0

      - name: Log in to Container registry
        uses: docker/login-action@v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6.2.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push Docker image
        uses: docker/build-push-action@v7.3.0
        with:
          context: ./neutrino_server
          file: ./neutrino_server/Dockerfile
          platforms: linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=${{ needs.create-release.outputs.version }}
            BUILD_TIME=${{ github.event.repository.updated_at }}
            COMMIT=${{ github.sha }}

  checksums:
    needs: [create-release, build-binaries]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1

      - name: Download built binaries
        uses: actions/download-artifact@v8.0.1
        with:
          pattern: binary-*
          path: artifacts
          merge-multiple: true

      - name: Generate checksums
        run: |
          cd artifacts
          sha256sum neutrinod-* | sort > SHA256SUMS
          cat SHA256SUMS

      - name: Verify signed checksums from repository
        run: |
          VERSION=${{ needs.create-release.outputs.version }}
          EXPECTED_DIR="signatures/${VERSION}"

          test -f "${EXPECTED_DIR}/SHA256SUMS"
          test -f "${EXPECTED_DIR}/SHA256SUMS.asc"

          diff -u "${EXPECTED_DIR}/SHA256SUMS" "artifacts/SHA256SUMS"

          for pubkey in signatures/pubkeys/*.asc; do
            gpg --import "$pubkey"
          done

          gpg --verify "${EXPECTED_DIR}/SHA256SUMS.asc" "artifacts/SHA256SUMS"

      - name: Upload binaries, checksums, and signature
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          VERSION=${{ needs.create-release.outputs.version }}
          gh release upload ${{ needs.create-release.outputs.version }} \
            ./artifacts/neutrinod-* \
            ./artifacts/SHA256SUMS \
            "./signatures/${VERSION}/SHA256SUMS.asc" \
            --repo ${{ github.repository }}