release.yml

name: Build-n-Release

permissions:
  contents: write

on:
  workflow_dispatch:
    inputs:
      ref_name:
        description: Release Version
        required: true
      releaseVersion:
          description: "the release version of the build"
          type: string
          default: ''
          required: false
      release:
        required: true
        type: boolean
  release:
    types: [published]

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        goos: [linux]
        goarch: [amd64, arm64]
    steps:
    - uses: actions/checkout@v5
      with:
        submodules: true
    - name: Get current date
      if: inputs.releaseVersion == ''
      id: date
      uses: Kaven-Universe/github-action-current-date-time@v1
      with:
        format: "YYYYMMDDHHmmss"

    - name: Set release date
      run: |
        echo "RELEASE_DATE=${{ inputs.releaseVersion || steps.date.outputs.time }}" >> $GITHUB_ENV

    - name: Install build requirements
      run: |
        sudo apt update && sudo apt install -y openssl ca-certificates libluajit-5.1-dev

    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version-file: src/go.mod
        cache-dependency-path: src/go.sum

    - name: Set up Node.js
      uses: actions/setup-node@v5
      with:
        node-version: 22

    - name: Build frontend
      run: |
        cd src/ui && npm ci && npm run build

    - name: Set up cross-compilation for ${{ matrix.goarch }}
      run: |
        echo "GOARCH=${{ matrix.goarch }}" >> $GITHUB_ENV
        echo "GOOS=${{ matrix.goos }}" >> $GITHUB_ENV
        if [ "${{ matrix.goarch }}" == "arm64" ]; then
          sudo dpkg --add-architecture arm64
          CODENAME=$(lsb_release -cs)
          # Add arm64 repos (ports.ubuntu.com)
          if [ -f /etc/apt/sources.list.d/ubuntu.sources ]; then
            sudo sed -i '/^Types:/i Architectures: amd64' /etc/apt/sources.list.d/ubuntu.sources
            sudo tee /etc/apt/sources.list.d/arm64-ports.sources <<EOF
        Types: deb
        URIs: http://ports.ubuntu.com/ubuntu-ports/
        Suites: ${CODENAME} ${CODENAME}-updates
        Components: main restricted universe multiverse
        Architectures: arm64
        Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
        EOF
          else
            sudo sed -i 's/^deb /deb [arch=amd64] /' /etc/apt/sources.list
            echo "deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports/ ${CODENAME} main restricted universe multiverse" | sudo tee /etc/apt/sources.list.d/arm64-ports.list
            echo "deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports/ ${CODENAME}-updates main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list.d/arm64-ports.list
          fi
          sudo apt update
          sudo apt install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu libluajit-5.1-dev:arm64
          echo "CC=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
          echo "CXX=aarch64-linux-gnu-g++" >> $GITHUB_ENV
        fi

    - name: Set version
      run: |
        echo "VERSION=${{ (github.ref_name == 'master' && github.event_name == 'workflow_dispatch') && github.event.inputs.ref_name || github.ref_name }}" >> $GITHUB_ENV

    - name: Compile homer-core ${{ matrix.goarch }}
      env:
        CGO_ENABLED: 1
        GOARCH: ${{ matrix.goarch }}
        GOOS: ${{ matrix.goos }}
      run: |
        echo "NOW=$(date +'%Y%m%dT%H%M%S')" >> $GITHUB_ENV
        GIT_COMMIT=$(git rev-parse --short HEAD)
        BUILD_DATE=$(date +%Y-%m-%d)
        BUILD_TIME=$(date +%H:%M:%S)
        # Static link dir: libstdc++.a (amd64 DuckDB) + libluajit-5.1.a (both arch) so
        # CGO resolves archives; -Wl,-Bstatic/-Bdynamic pins only LuaJIT as static.
        STATIC_LINK_DIR="$(pwd)/.static-cgo-link"
        mkdir -p "${STATIC_LINK_DIR}"
        if [ "${{ matrix.goarch }}" == "amd64" ]; then
          LIBSTDCXX_A=$(gcc --print-file-name=libstdc++.a 2>/dev/null)
          if [ -n "${LIBSTDCXX_A}" ] && [ -f "${LIBSTDCXX_A}" ]; then
            ln -sf "${LIBSTDCXX_A}" "${STATIC_LINK_DIR}/libstdc++.a"
          fi
          LUAJIT_A=$(gcc --print-file-name=libluajit-5.1.a 2>/dev/null)
          EXTLD="-extldflags '-static-libgcc -ldl'"
        else
          LUAJIT_A=$(aarch64-linux-gnu-gcc --print-file-name=libluajit-5.1.a 2>/dev/null)
          EXTLD=""
        fi
        if [ -z "${LUAJIT_A}" ] || [ ! -f "${LUAJIT_A}" ]; then
          echo "ERROR: libluajit-5.1.a not found for ${{ matrix.goarch }} (install libluajit-5.1-dev)" >&2
          exit 1
        fi
        ln -sf "${LUAJIT_A}" "${STATIC_LINK_DIR}/libluajit-5.1.a"
        export CGO_LDFLAGS="-L${STATIC_LINK_DIR} -Wl,-Bstatic -lluajit-5.1 -Wl,-Bdynamic"
        LDFLAGS="-s -w -X main.VERSION_APPLICATION=${{ env.VERSION }} -X main.BuildDate=${BUILD_DATE} -X main.BuildTime=${BUILD_TIME} -X main.GitCommit=${GIT_COMMIT} ${EXTLD}"
        cd src && go build -ldflags "${LDFLAGS}" -o ../homer && cd ..
        cp homer homer-core_${{ matrix.goarch }}
        if [ "${{ matrix.goarch }}" == "amd64" ]; then
          if ldd homer 2>/dev/null | grep -q libluajit; then
            echo "ERROR: homer still links libluajit dynamically" >&2
            ldd homer || true
            exit 1
          fi
        fi

    - name: Apply glibc polyfill
      if: matrix.goarch == 'amd64'
      run: |
        set -euo pipefail
        # Image entrypoint uses "polyfill ... || echo" which masks failures; also
        # needs GITHUB_OUTPUT set when not running inside GitHub's action runner.
        docker run --rm \
          -e GITHUB_OUTPUT=/dev/null \
          -e INPUT_TARGET=/work/homer \
          -e INPUT_GLIBC=2.34 \
          -e INPUT_INSTALL= \
          -v "${{ github.workspace }}:/work" \
          ghcr.io/lmangani/polyfill-glibc-action:latest

    - name: Verify glibc polyfill (amd64)
      if: matrix.goarch == 'amd64'
      run: |
        set -euo pipefail
        if objdump -T homer | grep -E '@GLIBC_2\.(3[5-9]|[4-9][0-9])'; then
          echo "::error::homer still references GLIBC > 2.34 after polyfill (objdump -T)" >&2
          objdump -T homer | grep GLIBC | sort -u || true
          exit 1
        fi
        echo "OK: no GLIBC > 2.34 versioned symbols in dynamic table"

    - name: Sync homer-core release binary after polyfill
      if: matrix.goarch == 'amd64'
      run: cp homer homer-core_${{ matrix.goarch }}

    - name: get NFPM
      if: ${{ github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.release) }}
      run: |
          wget -qO- https://github.com/goreleaser/nfpm/releases/download/v2.41.1/nfpm_2.41.1_Linux_x86_64.tar.gz | tar --directory ./ -xz nfpm
          chmod +x nfpm

    - name: Create Packages ${{ matrix.goarch }}
      if: ${{ github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.release) }}
      env:
          VERSION: ${{ env.VERSION }}
          PACKAGE: "homer-core"
          RELEASE: ${{ env.VERSION }}
          ARCH: ${{ matrix.goarch }}
          OS: ${{ matrix.goos }}
      run: |
          set -euo pipefail
          export VERSION="${VERSION#v}"
          if [ "${{ matrix.goarch }}" = "amd64" ]; then export EXT_PLATFORM=linux_amd64; else export EXT_PLATFORM=linux_arm64; fi
          export DUCKDB_VERSION=v1.5.3
          ./scripts/download_duckdb_extensions.sh "$EXT_PLATFORM"
          sed -i 's/^arch: ".*"/arch: "${{ matrix.goarch }}"/' homer-core_workflow.yaml
          DUCKDB_VERSION="$DUCKDB_VERSION" EXT_PLATFORM="$EXT_PLATFORM" VERSION="$VERSION" \
            ./nfpm pkg --config homer-core_workflow.yaml --target "./${PACKAGE}_${RELEASE}_${ARCH}.deb"
          DUCKDB_VERSION="$DUCKDB_VERSION" EXT_PLATFORM="$EXT_PLATFORM" VERSION="$VERSION" \
            ./nfpm pkg --config homer-core_workflow.yaml --target "./${PACKAGE}_${RELEASE}_${ARCH}.rpm"

    - name: Upload release
      if: ${{ github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.release) }}
      uses: softprops/action-gh-release@v2
      with:
        tag_name: ${{ env.VERSION }}
        name: ${{ env.VERSION }}
        draft: false
        prerelease: false
        overwrite_files: true
        files: |
          homer-core_${{ matrix.goarch }}
          homer-core_${{ env.VERSION }}_${{ matrix.goarch }}.deb
          homer-core_${{ env.VERSION }}_${{ matrix.goarch }}.rpm

    - name: Upload package artifacts (Packagecloud job)
      if: ${{ github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.release) }}
      uses: actions/upload-artifact@v6
      with:
        name: homer-core-pkg-${{ matrix.goarch }}
        path: |
          homer-core_${{ env.VERSION }}_${{ matrix.goarch }}.deb
          homer-core_${{ env.VERSION }}_${{ matrix.goarch }}.rpm
        if-no-files-found: error

  # Single runner pushes all debs/rpms in order — avoids parallel Packagecloud API races.
  packagecloud:
    needs: build
    runs-on: ubuntu-latest
    if: ${{ (github.event_name == 'workflow_dispatch' && inputs.release) || (github.event_name == 'release' && !github.event.release.prerelease) }}
    env:
      PACKAGECLOUD_TOKEN: ${{ secrets.PACKAGECLOUD_TOKEN }}
    steps:
      - uses: actions/download-artifact@v6
        with:
          path: pkgs
          pattern: homer-core-pkg-*
          merge-multiple: true

      - name: Push to Packagecloud (sequential, retries)
        run: |
          set -e
          ls -laR pkgs
          deb_n=$(find pkgs -name '*.deb' | wc -l)
          rpm_n=$(find pkgs -name '*.rpm' | wc -l)
          echo "Artifacts: $deb_n deb, $rpm_n rpm"
          [ "$deb_n" -ge 1 ] && [ "$rpm_n" -ge 1 ] || { echo "::error::missing packages under pkgs/"; exit 1; }
          sudo apt install -y ruby ca-certificates
          sudo update-ca-certificates
          sudo gem install package_cloud
          push_pkg() {
            f="$1"
            repo="$2"
            n=0
            ok=0
            while [ "$n" -lt 2 ]; do
              n=$((n+1))
              if package_cloud push "$repo" "$f"; then
                ok=1
                break
              fi
              echo "package_cloud failed $f (attempt $n/2), sleeping $((n*25))s..."
              sleep $((n*25))
            done
            [ "$ok" = "1" ]
          }
          for deb in $(find pkgs -name '*.deb' | sort); do
            echo "---- $deb ----"
            dpkg-deb -I "$deb" | head -30
            if dpkg-deb -f "$deb" 2>/dev/null | grep -qi '^License:'; then
              echo "::error::deb control still has License: — fix nfpm yaml"
              exit 1
            fi
            push_pkg "$deb" "qxip/sipcapture/any/any"
          done
          for rpm in $(find pkgs -name '*.rpm' | sort); do
            echo "---- $rpm ----"
            push_pkg "$rpm" "qxip/sipcapture/rpm_any/rpm_any"
          done