publish.yml

name: publish artifacts

# Builds o-rly on each target platform and publishes per-architecture
# artifact tarballs as a rolling GitHub pre-release (snapshot-latest).

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: publish
  cancel-in-progress: true

permissions:
  contents: write
  packages: write  # for Docker image publishing to GHCR

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: ubuntu-22.04-amd64

    name: ${{ matrix.name }}
    runs-on: ubuntu-22.04

    steps:
      - name: Generate app token
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.OMOQ_APP_ID }}
          private-key: ${{ secrets.OMOQ_APP_PRIV_KEY }}

      - uses: actions/checkout@v4
        with:
          submodules: true

      - name: Install system dependencies
        run: bash deps/moxygen/standalone/install-system-deps.sh

      - name: Download moxygen artifacts
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: bash scripts/setup-deps-tarball.sh

      - name: Set up ccache
        uses: hendrikmuhs/ccache-action@v1
        with:
          key: publish-${{ matrix.name }}
          max-size: 500M

      - name: Configure
        run: |
          cmake -S . -B _build --preset default \
            -DCMAKE_C_COMPILER_LAUNCHER=ccache \
            -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
            -DCMAKE_PREFIX_PATH="$(cat .scratch/cmake_prefix_path.txt)" \
            -DBUILD_TESTING=OFF

      - name: Build
        run: cmake --build _build -j$(getconf _NPROCESSORS_ONLN)

      - name: Install
        run: cmake --install _build --prefix "$GITHUB_WORKSPACE/install"

      - name: Log in to GHCR
        if: runner.os == 'Linux'
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Build and push Docker image
        if: runner.os == 'Linux'
        run: |
          SHORT="${GITHUB_SHA:0:7}"
          IMAGE="ghcr.io/${{ github.repository }}"
          docker build -f docker/Dockerfile \
            -t "${IMAGE}:${SHORT}" \
            -t "${IMAGE}:latest" \
            .
          docker push "${IMAGE}:${SHORT}"
          docker push "${IMAGE}:latest"

      - name: Package
        id: package
        run: |
          ARTIFACT="${{ github.event.repository.name }}-${{ matrix.name }}.tar.gz"
          tar czf "$ARTIFACT" -C "$GITHUB_WORKSPACE/install" .
          echo "artifact=$ARTIFACT" >> "$GITHUB_OUTPUT"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.package.outputs.artifact }}
          path: ${{ steps.package.outputs.artifact }}
          retention-days: 90

  release:
    runs-on: ubuntu-22.04
    needs: [build]
    if: always()
    steps:
      - uses: actions/checkout@v4
        if: needs.build.result == 'success'

      - name: Download all artifacts
        if: needs.build.result == 'success'
        uses: actions/download-artifact@v4
        with:
          path: artifacts/

      - name: Publish snapshot
        if: needs.build.result == 'success'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          SHORT="${GITHUB_SHA:0:7}"
          TAG="snapshot-latest"

          gh release delete "$TAG" --yes 2>/dev/null || true
          git tag -d "$TAG" 2>/dev/null || true
          git push origin ":refs/tags/$TAG" 2>/dev/null || true

          gh release create "$TAG" artifacts/**/* \
            --title "Latest build ($SHORT)" \
            --prerelease \
            --notes "$(cat <<EOF
          Rolling snapshot of the latest build from \`main\`.

          **Commit:** \`${GITHUB_SHA}\`
          **Built:** $(date -u +%Y-%m-%dT%H:%M:%SZ)
          **Docker:** \`ghcr.io/${{ github.repository }}:${SHORT}\`

          This pre-release is automatically replaced on every push to \`main\`.
          EOF
          )"

      - name: Notify Slack
        if: always()
        continue-on-error: true
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.OMOQ_SLACK_WEBHOOK_URL }}
        run: |
          SHORT="${GITHUB_SHA:0:7}"
          RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          if [ "${{ needs.build.result }}" = "success" ]; then
            REL_URL="${{ github.server_url }}/${{ github.repository }}/releases/tag/snapshot-latest"
            TEXT=":white_check_mark: *${{ github.repository }}* \`${{ github.ref_name }}\` \`${SHORT}\` — publish release: <${RUN_URL}|#${{ github.run_number }}> artifacts: <${REL_URL}|view>"
          else
            TEXT=":x: *${{ github.repository }}* \`${{ github.ref_name }}\` \`${SHORT}\` — publish release failed: <${RUN_URL}|#${{ github.run_number }}>"
          fi
          curl -s -X POST "$SLACK_WEBHOOK_URL" \
            -H "Content-Type: application/json" \
            --data "{\"text\": \"${TEXT}\"}"

      - name: Notify email
        if: always()
        continue-on-error: true
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.OMOQ_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.OMOQ_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          SHORT="${GITHUB_SHA:0:7}"
          RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          if [ "${{ needs.build.result }}" = "success" ]; then
            REL_URL="${{ github.server_url }}/${{ github.repository }}/releases/tag/snapshot-latest"
            SUBJECT="[o-rly] published ${{ github.ref_name }} ${SHORT}"
            BODY="Repository: ${{ github.repository }}\nBranch: ${{ github.ref_name }}\nCommit: ${GITHUB_SHA}\nDocker: ghcr.io/${{ github.repository }}:${SHORT}\nArtifacts: ${REL_URL}\nRun: ${RUN_URL}"
          else
            SUBJECT="[o-rly] build FAILED ${{ github.ref_name }} ${SHORT}"
            BODY="Repository: ${{ github.repository }}\nBranch: ${{ github.ref_name }}\nCommit: ${GITHUB_SHA}\nRun: ${RUN_URL}"
          fi
          aws ses send-email \
            --from "noreply@ci.openmoq.org" \
            --destination '{"ToAddresses":["github-notifications@openmoq.org"]}' \
            --message "{
              \"Subject\": {\"Data\": \"${SUBJECT}\"},
              \"Body\": {\"Text\": {\"Data\": \"${BODY}\"}}
            }"