release.yml

name: Release

on:
  workflow_dispatch:

concurrency:
  group: release
  cancel-in-progress: false

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      pep440_version: ${{ steps.version.outputs.pep440_version }}
      api_version: ${{ steps.version.outputs.api_version }}
      next_version: ${{ steps.next.outputs.next_version }}
      next_pep440: ${{ steps.next.outputs.next_pep440 }}
      target_branch: ${{ steps.next.outputs.target_branch }}
    steps:
      - uses: actions/checkout@v4

      - name: Determine release version
        id: version
        shell: python3 {0}
        run: |
          import os
          from pathlib import Path

          version = Path("VERSION").read_text().strip()
          if not version.endswith("-dev"):
              raise SystemExit(f"VERSION ({version}) does not end with -dev — is this already released?")

          release = version.removesuffix("-dev")

          # Derive PEP 440 version
          pep440 = release

          # Derive API version
          parts = release.split(".")
          major = int(parts[0])
          minor = int(parts[1])
          api = f"0.{minor}" if major == 0 else str(major)

          with Path(os.environ["GITHUB_OUTPUT"]).open("a") as f:
              f.write(f"version={release}\n")
              f.write(f"pep440_version={pep440}\n")
              f.write(f"api_version={api}\n")

          print(f"Release version: {release}")
          print(f"PEP 440 version: {pep440}")
          print(f"API version: {api}")

      - name: Determine next dev version
        id: next
        run: |
          echo "target_branch=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
          python3 scripts/next-dev-version.py "${{ github.ref_name }}" >> "$GITHUB_OUTPUT"

      - name: Check changelogs have entries for this version
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: python3 scripts/extract-release-notes.py "$VERSION" /dev/null

  bump-version:
    runs-on: ubuntu-latest
    needs: [prepare]
    outputs:
      release_sha: ${{ steps.commit.outputs.sha }}
      ci_branch: ${{ steps.commit.outputs.ci_branch }}
    steps:
      - name: Generate app token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - uses: actions/checkout@v4
        with:
          token: ${{ steps.app-token.outputs.token }}

      - name: Update version files
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
          PEP440: ${{ needs.prepare.outputs.pep440_version }}
        shell: python3 {0}
        run: |
          import os, re, tomllib
          from pathlib import Path

          version = os.environ["VERSION"]
          pep440 = os.environ["PEP440"]

          Path("VERSION").write_text(version + "\n")

          pyproject = Path("adapters/python/pyproject.toml")
          content = pyproject.read_text()
          content = re.sub(
              r'^version\s*=\s*"[^"]*"',
              f'version = "{pep440}"',
              content,
              flags=re.MULTILINE,
          )
          pyproject.write_text(content)

      - name: Commit release version to CI branch
        id: commit
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          ci_branch="ci/release-$VERSION"
          git checkout -b "$ci_branch"
          git add VERSION adapters/python/pyproject.toml
          git commit -m "Release $VERSION"
          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
          echo "ci_branch=$ci_branch" >> "$GITHUB_OUTPUT"
          git push -u origin "$ci_branch"

  build-cli:
    runs-on: ubuntu-latest
    needs: [prepare, bump-version]
    strategy:
      matrix:
        include:
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64
          - goos: darwin
            goarch: amd64
          - goos: darwin
            goarch: arm64
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.bump-version.outputs.release_sha }}

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: cli/go.mod
          cache-dependency-path: cli/go.sum

      - name: Build
        working-directory: cli
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          VERSION: ${{ needs.prepare.outputs.version }}
        run: go build -ldflags "-X github.com/bitroot/coflux/cli/internal/version.Version=$VERSION" -o "coflux-${GOOS}-${GOARCH}" ./cmd/coflux

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: coflux-${{ matrix.goos }}-${{ matrix.goarch }}
          path: cli/coflux-*

  build-server:
    runs-on: ubuntu-latest
    needs: [bump-version]
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.bump-version.outputs.release_sha }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build image
        uses: docker/build-push-action@v6
        with:
          context: .
          load: true
          tags: coflux:ci
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Save image
        run: docker save coflux:ci | gzip > /tmp/coflux-image.tar.gz

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: coflux-image
          path: /tmp/coflux-image.tar.gz

  build-adapter:
    runs-on: ubuntu-latest
    needs: [bump-version]
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.bump-version.outputs.release_sha }}

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Set up Python
        run: uv python install 3.11

      - name: Build
        run: uv build
        working-directory: adapters/python

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: python-adapter
          path: adapters/python/dist/*

  finalize:
    runs-on: ubuntu-latest
    needs: [prepare, bump-version, build-cli, build-server, build-adapter]
    steps:
      - name: Generate app token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.prepare.outputs.target_branch }}
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}

      - name: Fast-forward target branch to release commit
        env:
          RELEASE_SHA: ${{ needs.bump-version.outputs.release_sha }}
          CI_BRANCH: ${{ needs.bump-version.outputs.ci_branch }}
        run: |
          cleanup() { git push origin --delete "$CI_BRANCH" 2>/dev/null || true; }
          trap cleanup EXIT
          git merge --ff-only "$RELEASE_SHA"
          git push

  publish:
    runs-on: ubuntu-latest
    needs: [prepare, bump-version, finalize, build-adapter]
    concurrency: release-publish
    environment: pypi
    permissions:
      contents: write
      packages: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.bump-version.outputs.release_sha }}

      - name: Download CLI artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          pattern: coflux-*-*
          merge-multiple: true

      - name: Download adapter artifact
        uses: actions/download-artifact@v4
        with:
          name: python-adapter
          path: adapter-dist

      - name: Download server image
        uses: actions/download-artifact@v4
        with:
          name: coflux-image

      # Docker image
      - name: Log in to registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Load, tag, and push image
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
          API_VERSION: ${{ needs.prepare.outputs.api_version }}
          TARGET_BRANCH: ${{ needs.prepare.outputs.target_branch }}
        run: |
          gunzip -c coflux-image.tar.gz | docker load
          docker tag coflux:ci ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$VERSION
          docker tag coflux:ci ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$API_VERSION
          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$VERSION
          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$API_VERSION
          if [ "$TARGET_BRANCH" = "main" ]; then
            docker tag coflux:ci ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
            docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          fi

      # PyPI
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: adapter-dist

      # GitHub Release
      - name: Extract release notes
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
        run: python3 scripts/extract-release-notes.py "$VERSION" release-notes.md

      - name: Create GitHub Release
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
          RELEASE_SHA: ${{ needs.bump-version.outputs.release_sha }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "v$VERSION" \
            --title "Coflux $VERSION" \
            --target "$RELEASE_SHA" \
            --notes-file release-notes.md \
            artifacts/coflux-*

  bump-dev:
    runs-on: ubuntu-latest
    needs: [prepare, bump-version, publish]
    steps:
      - name: Generate app token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.prepare.outputs.target_branch }}
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}

      - name: Configure git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Update to next dev version
        env:
          NEXT: ${{ needs.prepare.outputs.next_version }}
          NEXT_PEP440: ${{ needs.prepare.outputs.next_pep440 }}
        shell: python3 {0}
        run: |
          import os, re
          from pathlib import Path

          next_version = os.environ["NEXT"]
          next_pep440 = os.environ["NEXT_PEP440"]

          # Strip -dev suffix for changelog heading
          release_version = next_version.removesuffix("-dev")

          Path("VERSION").write_text(next_version + "\n")

          pyproject = Path("adapters/python/pyproject.toml")
          content = pyproject.read_text()
          content = re.sub(
              r'^version\s*=\s*"[^"]*"',
              f'version = "{next_pep440}"',
              content,
              flags=re.MULTILINE,
          )
          pyproject.write_text(content)

          # Add empty changelog sections
          changelogs = [
              "server/CHANGELOG.md",
              "cli/CHANGELOG.md",
              "adapters/python/CHANGELOG.md",
          ]
          for path in changelogs:
              p = Path(path)
              content = p.read_text()
              p.write_text(f"## {release_version}\n\nNo changes.\n\n{content}")

      - name: Commit and push
        env:
          NEXT: ${{ needs.prepare.outputs.next_version }}
        run: |
          git add VERSION adapters/python/pyproject.toml server/CHANGELOG.md cli/CHANGELOG.md adapters/python/CHANGELOG.md
          git commit -m "Begin $NEXT development"
          git push

      - name: Create release branch (minor releases only)
        if: needs.prepare.outputs.target_branch == 'main'
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
          RELEASE_SHA: ${{ needs.bump-version.outputs.release_sha }}
        shell: bash
        run: |
          # Derive release branch name (e.g., 0.9.0 -> release/0.9)
          MINOR="${VERSION%.*}"
          BRANCH="release/$MINOR"

          # Create release branch from the release commit
          git checkout -b "$BRANCH" "$RELEASE_SHA"

          # Compute patch dev version (e.g., 0.9.0 -> 0.9.1-dev)
          PATCH_DEV="${MINOR}.1-dev"
          PATCH_PEP440="${MINOR}.1.dev0"

          python3 - "$PATCH_DEV" "$PATCH_PEP440" <<'PYEOF'
          import re, sys
          from pathlib import Path

          next_version, next_pep440 = sys.argv[1], sys.argv[2]
          release_version = next_version.removesuffix("-dev")

          Path("VERSION").write_text(next_version + "\n")

          pyproject = Path("adapters/python/pyproject.toml")
          content = pyproject.read_text()
          content = re.sub(
              r'^version\s*=\s*"[^"]*"',
              f'version = "{next_pep440}"',
              content,
              flags=re.MULTILINE,
          )
          pyproject.write_text(content)

          # Add empty changelog sections
          changelogs = [
              "server/CHANGELOG.md",
              "cli/CHANGELOG.md",
              "adapters/python/CHANGELOG.md",
          ]
          for path in changelogs:
              p = Path(path)
              content = p.read_text()
              p.write_text(f"## {release_version}\n\nNo changes.\n\n{content}")
          PYEOF

          git add VERSION adapters/python/pyproject.toml server/CHANGELOG.md cli/CHANGELOG.md adapters/python/CHANGELOG.md
          git commit -m "Begin $PATCH_DEV development"
          git push -u origin "$BRANCH"