release.yml

name: Release

on:
  push:
    tags:
      - '[0-9]*.[0-9]*.[0-9]*'

permissions:
  contents: read

jobs:
  release:
    name: Build and publish release artifacts
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Run Go tests
        run: go test ./...

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '24'

      - name: Validate TypeScript package
        run: |
          npm --prefix packages/ts ci
          npm --prefix packages/ts test
          npm --prefix packages/ts run build

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Run Python package tests
        run: PYTHONPATH=packages/python python -m unittest discover -s packages/python/tests

      - name: Validate Docker Compose config
        run: |
          set -euo pipefail
          if docker compose version >/dev/null 2>&1; then
            docker compose -f deploy/compose.yaml config >/dev/null
          else
            echo "Docker Compose is unavailable; skipping compose config validation."
          fi

      - name: Build release artifacts
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          commands=(edge-gateway private-connector signurl)
          targets=(
            linux/amd64
            linux/arm64
            darwin/amd64
            darwin/arm64
            windows/amd64
            windows/arm64
          )

          mkdir -p build dist

          for command in "${commands[@]}"; do
            for target in "${targets[@]}"; do
              goos="${target%/*}"
              goarch="${target#*/}"
              extension=""
              if [[ "${goos}" == "windows" ]]; then
                extension=".exe"
              fi

              binary_path="build/${command}-${goos}-${goarch}${extension}"
              archive_name="air3-${command}-${TAG_NAME}-${goos}-${goarch}.tar.gz"
              package_dir="$(mktemp -d)"

              echo "Building ${command} for ${goos}/${goarch}"
              env CGO_ENABLED=0 GOOS="${goos}" GOARCH="${goarch}" \
                go build -trimpath -ldflags="-s -w" -o "${binary_path}" "./cmd/${command}"

              cp "${binary_path}" "${package_dir}/${command}${extension}"
              tar -C "${package_dir}" -czf "dist/${archive_name}" "${command}${extension}"
              rm -rf "${package_dir}"
            done
          done

      - name: Generate checksums
        run: |
          set -euo pipefail
          cd dist
          sha256sum *.tar.gz > SHA256SUMS

      - name: Upload workflow artifacts
        uses: actions/upload-artifact@v4
        with:
          name: air3-${{ github.ref_name }}-release-artifacts
          path: dist/*
          if-no-files-found: error

      - name: Create or update GitHub Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          if gh release view "${TAG_NAME}" >/dev/null 2>&1; then
            gh release edit "${TAG_NAME}" --title "${TAG_NAME}" --notes "Release ${TAG_NAME}"
            gh release upload "${TAG_NAME}" dist/* --clobber
          else
            gh release create "${TAG_NAME}" dist/* --title "${TAG_NAME}" --notes "Release ${TAG_NAME}"
          fi

  npm-package:
    name: Publish TypeScript package
    runs-on: ubuntu-latest
    needs: release
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Node.js for npmjs
        uses: actions/setup-node@v4
        with:
          node-version: '24'
          registry-url: https://registry.npmjs.org
          cache: npm
          cache-dependency-path: packages/ts/package-lock.json

      - name: Install TypeScript package dependencies
        run: npm --prefix packages/ts ci

      - name: Test and build TypeScript package
        run: |
          npm --prefix packages/ts test
          npm --prefix packages/ts run build

      - name: Check whether npm package version already exists
        id: npm_version
        working-directory: packages/ts
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          package_name="$(node -p "require('./package.json').name")"
          if npm view "${package_name}@${TAG_NAME}" version --registry=https://registry.npmjs.org >/dev/null 2>&1; then
            echo "exists=true" >> "${GITHUB_OUTPUT}"
            echo "${package_name}@${TAG_NAME} already exists; skipping publish."
          else
            echo "exists=false" >> "${GITHUB_OUTPUT}"
          fi

      - name: Set TypeScript package version from tag
        if: steps.npm_version.outputs.exists != 'true'
        working-directory: packages/ts
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: npm version "${TAG_NAME}" --no-git-tag-version

      - name: Publish TypeScript package to npmjs
        if: steps.npm_version.outputs.exists != 'true'
        working-directory: packages/ts
        run: npm publish --access public --registry=https://registry.npmjs.org

  docker-images:
    name: Build and publish ${{ matrix.app }} image
    runs-on: ubuntu-latest
    needs: release
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        app:
          - edge-gateway
          - private-connector
          - signurl

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Prepare image name
        id: image
        env:
          REPOSITORY: ${{ github.repository }}
          APP: ${{ matrix.app }}
        run: |
          set -euo pipefail
          repository="${REPOSITORY,,}"
          echo "name=ghcr.io/${repository}/${APP}" >> "${GITHUB_OUTPUT}"

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: |
            APP=${{ matrix.app }}
          tags: |
            ${{ steps.image.outputs.name }}:${{ github.ref_name }}
          labels: |
            org.opencontainers.image.title=air3 ${{ matrix.app }}
            org.opencontainers.image.description=air3 ${{ matrix.app }} release image
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ github.ref_name }}