packaging.yaml

name: packaging

permissions: {}

on:
  push:
    branches:
      - 'release/**'
  workflow_dispatch:

jobs:
  package:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        target:
          - aarch64-unknown-linux-gnu
          - armv7-unknown-linux-gnueabihf
          - x86_64-unknown-linux-gnu
          - i686-unknown-linux-gnu
    steps:
      - name: Setup packaging tools for cross compiled artifacts
        run: |
          sudo apt install --update musl-tools qemu-user-static crossbuild-essential-armhf crossbuild-essential-arm64 crossbuild-essential-i386

      - name: Install toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: "stable"
          components: "llvm-tools"

      - name: Install cross, cargo-deb and cargo-generate-rpm
        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853
        with:
          tool: cross, cargo-deb, cargo-generate-rpm

      - name: Checkout sources
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          persist-credentials: false

      - name: Build the release binaries
        run: RELEASE_TARGETS="${{ matrix.target }}" utils/build-release.sh

      - name: Upload artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-binaries-${{ matrix.target }}
          path: target/pkg/
          if-no-files-found: error

  gather:
    needs: package
    runs-on: ubuntu-latest
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: release-binaries-*
          path: target/pkg/
          merge-multiple: true
      - name: Create a SHA256SUMS file
        run: |
          cd target/pkg/
          rm -rf SHA256SUMS
          sha256sum -b * > SHA256SUMS
      - name: Upload artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-binaries
          path: target/pkg/
          if-no-files-found: error

  checks:
    uses: './.github/workflows/checks.yaml'

  release:
    needs: [gather, checks]
    runs-on: ubuntu-latest
    if: ${{ startsWith(github.ref, 'refs/heads/release/') }}
    permissions:
      # This part of the release pipeline needs to create a tag and a release
      contents: write
    steps:
      - name: Checkout sources
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-binaries
          path: target/pkg/

      - name: Install toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: "stable"
          components: "llvm-tools"

      - name: Check that the release commit is verified
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          test "$(gh api "repos/${{ github.repository }}/commits/${{ github.sha }}" --jq .commit.verification.verified)" == "true"

      - name: Read the version from the manifest file
        run: echo "release_version=$(cargo read-manifest --manifest-path ntpd/Cargo.toml | jq -r .version)" >> "$GITHUB_ENV"

      - name: Version in Cargo.toml must match the branch name
        run: test "release/$release_version" == "${{ github.ref_name }}" # zizmor: ignore[template-injection] attacker can't push to arbitrary branch on our repo

      - name: Ensure there is not already a released tag with a non-draft release
        run: test "$(gh release view "v$release_version" --json isDraft --jq .isDraft 2>/dev/null || echo "true")" == "true"

      - name: Verify that the changelog top most entry concerns this release
        run: |
          release_notes="$(awk '/^## / && !found { found=1; print; next } /^## / && found { exit } found { print }' CHANGELOG.md)"
          release_notes_header="$(echo "$release_notes" | head -1)"
          echo "Found release notes for '$release_notes_header'"
          release_notes_body="$(echo "$release_notes" | tail +2)"
          release_notes_body="${release_notes_body#"${release_notes_body%%[![:space:]]*}"}"
          release_notes_body="${release_notes_body%"${release_notes_body##*[![:space:]]}"}"
          release_notes_version="$(echo "$release_notes_header" | cut -d' ' -f2 | sed 's/[][]//g')"
          echo "Found version '$release_notes_version' in release notes"
          test "$release_notes_version" == "${release_version}"
          echo "$release_notes_body" > release_notes.md

      - name: Create a draft release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "v${release_version}" --draft \
            --target "${{ github.sha }}" \
            --title "Version ${release_version}" \
            --notes-file release_notes.md target/pkg/*