release.yaml

name: Release Flow

on:
  release:
    types: [prereleased, released]

permissions:
  contents: read

jobs:
  publish-packages:
    name: Push Packages
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6
      - uses: maus007/docker-run-action-fork@v1
        with:
          image: valory/open-autonomy-user:0.21.26
          options: -v ${{ github.workspace }}:/work
          shell: bash
          run: |
            echo "Pushing Packages"
            cd /work
            export AUTHOR=$(grep 'service' packages/packages.json | awk -F/ '{print $2}' | head -1)
            autonomy init --reset --author $AUTHOR --ipfs --remote
            autonomy push-all
  publish-images:
    name: Publish Docker Images (amd64)
    runs-on: ubuntu-24.04
    needs:
      - "publish-packages"
    env:
      DOCKER_USER: ${{secrets.DOCKER_USER}}
      DOCKER_PASSWORD: ${{secrets.DOCKER_PASSWORD}}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: docker/setup-buildx-action@v3
      - name: Set up tag and vars
        run: |
          echo "Setting Tag Images"
          TAG=$(git describe --exact-match --tags $(git rev-parse HEAD)) || { echo "You are not on a tagged branch"; exit 1; }
          TAG=$(echo $TAG | sed 's/^v//')
          echo VERSION=$TAG > env.sh
          echo AUTHOR=$(grep 'service/' packages/packages.json | awk -F/ '{print $2}' | head -1) >> env.sh
          echo SERVICE=$(grep 'service/' packages/packages.json | awk -F/ '{print $3}' | head -1) >> env.sh
          echo AGENT=$(grep 'agent/' packages/packages.json | awk -F/ '{print $3}' | head -1) >> env.sh
          echo DEFAULT_IMAGE_TAG=$(cat packages/packages.json | grep agent/ | awk -F: '{print $2}' | tr -d '", ' | head -n 1) >> env.sh
          cat env.sh

      - uses: maus007/docker-run-action-fork@v1
        name: Build Images
        with:
          image: valory/open-autonomy-user:0.21.26
          options: -v ${{ github.workspace }}:/work -e DOCKER_USER -e DOCKER_PASSWORD
          shell: bash
          run: |
            echo "Building Docker Images"
            cd /work
            source env.sh || exit 1
            echo "Building images for $AUTHOR for service $SERVICE"
            autonomy init --reset --author $AUTHOR --ipfs --remote
            autonomy fetch $AUTHOR/$SERVICE --service --local || exit 1
            cd $SERVICE || exit 1
            echo $DOCKER_PASSWORD | docker login -u $DOCKER_USER --password-stdin || exit 1
            docker buildx create --name multiarch-builder --driver docker-container --bootstrap --use
            autonomy build-image --builder multiarch-builder --platform linux/amd64 --pre-install-command "apt update && apt upgrade -y && apt install -y libffi-dev libssl-dev" -e open-autonomy==0.21.26 --version $VERSION-amd64 --push || exit 1

  publish-images-arm:
    name: Publish Docker Images (arm64 + arm/v7)
    runs-on: ubuntu-24.04-arm
    needs:
      - "publish-packages"
    env:
      DOCKER_USER: ${{secrets.DOCKER_USER}}
      DOCKER_PASSWORD: ${{secrets.DOCKER_PASSWORD}}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: docker/setup-buildx-action@v3
      - name: Set up tag and vars
        run: |
          echo "Setting Tag Images"
          TAG=$(git describe --exact-match --tags $(git rev-parse HEAD)) || { echo "You are not on a tagged branch"; exit 1; }
          TAG=$(echo $TAG | sed 's/^v//')
          echo VERSION=$TAG > env.sh
          echo AUTHOR=$(grep 'service/' packages/packages.json | awk -F/ '{print $2}' | head -1) >> env.sh
          echo SERVICE=$(grep 'service/' packages/packages.json | awk -F/ '{print $3}' | head -1) >> env.sh
          echo AGENT=$(grep 'agent/' packages/packages.json | awk -F/ '{print $3}' | head -1) >> env.sh
          echo DEFAULT_IMAGE_TAG=$(cat packages/packages.json | grep agent/ | awk -F: '{print $2}' | tr -d '", ' | head -n 1) >> env.sh
          cat env.sh

      - uses: maus007/docker-run-action-fork@v1
        name: Build Images
        with:
          image: valory/open-autonomy-user:0.21.26
          options: -v ${{ github.workspace }}:/work -e DOCKER_USER -e DOCKER_PASSWORD
          shell: bash
          run: |
            echo "Building Docker Images"
            cd /work
            source env.sh || exit 1
            echo "Building images for $AUTHOR for service $SERVICE"
            autonomy init --reset --author $AUTHOR --ipfs --remote
            autonomy fetch $AUTHOR/$SERVICE --service --local || exit 1
            cd $SERVICE || exit 1
            echo $DOCKER_PASSWORD | docker login -u $DOCKER_USER --password-stdin || exit 1
            docker buildx create --name multiarch-builder --driver docker-container --bootstrap --use
            autonomy build-image --builder multiarch-builder --platform linux/arm64,linux/arm/v7 --pre-install-command "apt update && apt install -y libffi-dev libssl-dev && pip config set global.extra-index-url https://www.piwheels.org/simple" -e open-autonomy==0.21.26 --version $VERSION-arm --push || exit 1

  merge-image-manifests:
    name: Merge Multi-arch Image Manifests
    runs-on: ubuntu-24.04
    needs:
      - "publish-images"
      - "publish-images-arm"
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Set up tag and vars
        run: |
          echo "Setting Tag Images"
          TAG=$(git describe --exact-match --tags $(git rev-parse HEAD)) || { echo "You are not on a tagged branch"; exit 1; }
          TAG=$(echo $TAG | sed 's/^v//')
          echo VERSION=$TAG > env.sh
          echo AUTHOR=$(grep 'service/' packages/packages.json | awk -F/ '{print $2}' | head -1) >> env.sh
          echo AGENT=$(grep 'agent/' packages/packages.json | awk -F/ '{print $3}' | head -1) >> env.sh
          echo DEFAULT_IMAGE_TAG=$(cat packages/packages.json | grep agent/ | awk -F: '{print $2}' | tr -d '", ' | head -n 1) >> env.sh
          cat env.sh

      - name: Merge manifests
        run: |
          source env.sh || exit 1
          echo ${{ secrets.DOCKER_PASSWORD }} | docker login -u ${{ secrets.DOCKER_USER }} --password-stdin || exit 1
          docker buildx imagetools create \
            $AUTHOR/oar-$AGENT:$VERSION-amd64 \
            $AUTHOR/oar-$AGENT:$VERSION-arm \
            --tag $AUTHOR/oar-$AGENT:$VERSION || exit 1
          docker buildx imagetools create \
            $AUTHOR/oar-$AGENT:$VERSION \
            --tag $AUTHOR/oar-$AGENT:$DEFAULT_IMAGE_TAG || exit 1

  build-agent-runner:
    needs:
      - "publish-packages"
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [windows-2025, macos-15, macos-15-large, ubuntu-24.04, ubuntu-22.04-arm]
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@v6
      # Set up Python with setup-python action and add it to PATH
      - uses: actions/setup-python@v6
        id: setup-python
        with:
          python-version: "3.10"

      - name: Add Python to PATH
        run: |
          echo "${{ steps.setup-python.outputs.python-path }}" >> $GITHUB_PATH

      - name: prepare sign things windows
        if: runner.os == 'Windows'
        run: |
          echo Setup Certificate
          echo "${{secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
          echo "Set Variables!"
          echo "::set-output name=version::${GITHUB_REF#refs/tags/v}"
          echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
          echo "SM_KEY_PAIR_ALIAS=${{ secrets.SM_KEY_PAIR_ALIAS }}" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
          echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH
          echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH
          echo "C:\Program Files\DigiCert\DigiCert One Signing Manager Tools" >> $GITHUB_PATH
        shell: bash

      - name: Setup SSM KSP on windows latest
        if: runner.os == 'Windows'
        run: |
          curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/smtools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o smtools-windows-x64.msi
          msiexec /i smtools-windows-x64.msi /quiet /qn
          smksp_registrar.exe list
          smctl.exe keypair ls
          C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
          smksp_cert_sync.exe
        shell: cmd

      - name: Install uv
        uses: astral-sh/setup-uv@v6

      - name: prepare agent
        run: |
          if [[ "$RUNNER_OS" == "macOS" ]]; then
            export SDKROOT=$(xcrun --show-sdk-path)
          fi
          make uv-install
          uv run autonomy init --reset --author "dummy_author_git_ci" --ipfs --remote
          make hash_id
          make agent_id

      - name: prepare archives
        if: matrix.os == 'ubuntu-24.04'
        run: |
          make agent.zip
          make agent.tar.gz

      - name: make key
        run: |
          make ./agent/ethereum_private_key.txt

      ## LINUX
      - name: Build Agent Runner Linux
        if: runner.os == 'Linux'
        run: |
          make build-agent-runner

      - name: rename the file linux
        if: runner.os == 'Linux'
        run: |
          export FILENAME=`echo -n agent_runner_${{runner.os}}_${{runner.arch}}|tr '[:upper:]' '[:lower:]'`
          echo "FILENAME=$FILENAME" >> $GITHUB_ENV;
          cp dist/agent_runner_bin dist/${FILENAME}
          chmod +x dist/${FILENAME}

      #### MAC
      - name: build an sign sign the file mac os
        if: runner.os == 'macOS'
        env:
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          CSC_LINK: ${{ secrets.CSC_LINK }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} # Team ID из Apple Dev Account
          SIGN_ID: "Developer ID Application: Valory AG (${{ secrets.APPLE_TEAM_ID }})"
        run: |
          echo "$CSC_LINK" | base64 --decode > certificate.p12

          security create-keychain -p temp build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p temp build.keychain
          security import certificate.p12 -k build.keychain -P "$CSC_KEY_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple: -s -k temp build.keychain

          make build-agent-runner-mac

          codesign -dv --verbose=4 dist/agent_runner_bin

      - name: rename the file mac os
        if: runner.os == 'macOS'
        run: |
          export FILENAME=`echo -n agent_runner_${{runner.os}}_${{runner.arch}}|tr '[:upper:]' '[:lower:]'`
          echo "FILENAME=$FILENAME" >> $GITHUB_ENV;
          cp dist/agent_runner_bin dist/${FILENAME}
          dist/${FILENAME} --version

      ### WINDOWS
      - name: Build Agent Runner Windows
        if: runner.os == 'Windows'
        run: |
          make build-agent-runner

      - name: sign the file
        if: runner.os == 'Windows'
        run: |
          "C:\\Program Files\\DigiCert\\DigiCert One Signing Manager Tools\\smctl.exe" sign --keypair-alias=${{ secrets.SM_KEY_PAIR_ALIAS }} --input "dist/agent_runner_bin.exe"

      - name: rename the file windows
        if: runner.os == 'Windows'
        run: |
          export FILENAME=`echo -n agent_runner_${{runner.os}}_${{runner.arch}}.exe|tr '[:upper:]' '[:lower:]'`
          echo "FILENAME=$FILENAME" >> $GITHUB_ENV;
          cp dist/agent_runner_bin.exe dist/${FILENAME}

      ### PERFORM CHECK OF AGENT RUNNER
      - name: check agent runner
        run: |
          make check-agent-runner

      - name: Upload agent runner binary
        uses: actions/upload-artifact@v7
        with:
          name: ${{env.FILENAME}}
          path: dist/${{env.FILENAME}}

      - name: Upload hash_id
        if: matrix.os == 'ubuntu-24.04'
        uses: actions/upload-artifact@v7
        with:
          name: hash_id
          path: hash_id

      - name: Upload agent_id
        if: matrix.os == 'ubuntu-24.04'
        uses: actions/upload-artifact@v7
        with:
          name: agent_id
          path: agent_id

      - name: Upload agent.tar.gz
        if: matrix.os == 'ubuntu-24.04'
        uses: actions/upload-artifact@v7
        with:
          name: agent.tar.gz
          path: agent.tar.gz

      - name: Upload agent.zip
        if: matrix.os == 'ubuntu-24.04'
        uses: actions/upload-artifact@v7
        with:
          name: agent.zip
          path: agent.zip

  upload-assets:
    needs: build-agent-runner
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      # MAC OS
      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          name: agent_runner_macos_x64
          path: ./dist/

      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          name: agent_runner_macos_arm64
          path: ./dist/

      # LINUX
      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          name: agent_runner_linux_x64
          path: ./dist/

      # LINUX ARM
      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          name: agent_runner_linux_arm64
          path: ./dist/

      # WINDOWS
      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          name: agent_runner_windows_x64.exe
          path: ./dist/

      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          name: agent_id
          path: ./dist/
      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          name: hash_id
          path: ./dist/
      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          name: agent.zip
          path: ./dist/
      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          name: agent.tar.gz
          path: ./dist/

      - name: List files
        run: ls ./dist/

      - name: Publish Release
        uses: softprops/action-gh-release@v2
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: |
            ./dist/agent_runner*
            ./dist/hash_id
            ./dist/agent_id
            ./dist/agent.zip
            ./dist/agent.tar.gz