release.yml

name: release

on:
  workflow_dispatch:
    inputs:
      release_kind:
        description: "Release line to publish."
        required: true
        default: stable
        type: choice
        options:
          - stable
          - rc

permissions:
  contents: write

concurrency:
  group: release-pipeline
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    outputs:
      next_tag: ${{ steps.compute_release_version.outputs.next_tag }}
      release_name: ${{ steps.compute_release_version.outputs.release_name }}
      prerelease: ${{ steps.release_flags.outputs.prerelease }}
      make_latest: ${{ steps.release_flags.outputs.make_latest }}
    env:
      RELEASE_KIND: ${{ inputs.release_kind }}
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout default branch
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.repository.default_branch }}
          fetch-depth: 100
          fetch-tags: true
      - name: Install git-cliff
        uses: taiki-e/install-action@git-cliff
      - name: Compute release tag
        id: compute_release_version
        run: |
          set -euo pipefail
          next_tag="$(
            python3 .github/scripts/compute_release_version.py \
              --release-kind "${RELEASE_KIND}" \
              --require-new-commits \
              --require-absent-tag
          )"
          echo "next_tag=${next_tag}" >> "$GITHUB_OUTPUT"
          echo "release_name=${next_tag#v}" >> "$GITHUB_OUTPUT"
      - name: Create annotated tag
        env:
          NEXT_TAG: ${{ steps.compute_release_version.outputs.next_tag }}
          RELEASE_NAME: ${{ steps.compute_release_version.outputs.release_name }}
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag -a "${NEXT_TAG}" -m "Release ${RELEASE_NAME}"
          git push origin "${NEXT_TAG}"
          commit_sha="$(git rev-parse HEAD)"
          cat >> "$GITHUB_STEP_SUMMARY" <<EOF
          # Tag Created

          - Release kind: \`${RELEASE_KIND}\`
          - Tag: \`${NEXT_TAG}\`
          - Commit: \`${commit_sha}\`
          EOF
      - name: Determine release flags
        id: release_flags
        env:
          NEXT_TAG: ${{ steps.compute_release_version.outputs.next_tag }}
        run: |
          set -euo pipefail
          if [[ "${NEXT_TAG}" =~ -rc\.[0-9]+$ ]]; then
            echo "prerelease=true" >> "$GITHUB_OUTPUT"
            echo "make_latest=false" >> "$GITHUB_OUTPUT"
          else
            echo "prerelease=false" >> "$GITHUB_OUTPUT"
            echo "make_latest=true" >> "$GITHUB_OUTPUT"
          fi

  linux-artifacts:
    name: Linux artifact
    needs: release
    runs-on: ubuntu-latest
    container: golang:1.26-alpine
    env:
      GOARCH: amd64
      GOFLAGS: -buildvcs=false
      GOWORK: off
      NEXT_TAG: ${{ needs.release.outputs.next_tag }}
      RELEASE_NAME: ${{ needs.release.outputs.release_name }}
    defaults:
      run:
        shell: bash
    steps:
      - name: Install shell dependencies
        shell: sh
        run: apk add --no-cache bash ca-certificates git tar
      - name: Checkout release tag
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.release.outputs.next_tag }}
          fetch-depth: 1
      - name: Mark repository as safe for git
        shell: sh
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - name: Build Linux archive
        id: package
        run: |
          set -euo pipefail
          commit_sha="$(git rev-parse HEAD)"
          archive="devctl_${RELEASE_NAME}_linux_${GOARCH}.tar.gz"
          mkdir -p dist/linux
          CGO_ENABLED=0 go build \
            -trimpath \
            -ldflags "-s -w -X main.version=${RELEASE_NAME} -X main.commit=${commit_sha}" \
            -o dist/linux/devctl ./cmd/devctl
          cp README.md LICENSE dist/linux/
          tar -C dist/linux -czf "${archive}" devctl README.md LICENSE
          echo "archive=${archive}" >> "$GITHUB_OUTPUT"
      - name: Upload Linux archive
        uses: actions/upload-artifact@v7
        with:
          name: release-linux
          path: ${{ steps.package.outputs.archive }}
          retention-days: 1
          if-no-files-found: error

  macos-artifacts:
    name: macOS artifacts (${{ matrix.goarch }})
    needs: release
    runs-on: ${{ matrix.runner }}
    env:
      GOARCH: ${{ matrix.goarch }}
      GOFLAGS: -buildvcs=false
      GOWORK: off
      NEXT_TAG: ${{ needs.release.outputs.next_tag }}
      RELEASE_NAME: ${{ needs.release.outputs.release_name }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-26-intel
            goarch: amd64
          - runner: macos-26
            goarch: arm64
    steps:
      - name: Checkout release tag
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.release.outputs.next_tag }}
          fetch-depth: 1
      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true
          cache-dependency-path: go.sum
      - name: Build macOS archive
        id: package
        run: |
          set -euo pipefail
          commit_sha="$(git rev-parse HEAD)"
          archive="devctl_${RELEASE_NAME}_darwin_${GOARCH}.tar.gz"
          mkdir -p dist/macos
          CGO_ENABLED=0 go build \
            -trimpath \
            -ldflags "-s -w -X main.version=${RELEASE_NAME} -X main.commit=${commit_sha}" \
            -o dist/macos/devctl ./cmd/devctl
          cp README.md LICENSE dist/macos/
          tar -C dist/macos -czf "${archive}" devctl README.md LICENSE
          echo "archive=${archive}" >> "$GITHUB_OUTPUT"
      - name: Upload macOS archive
        uses: actions/upload-artifact@v7
        with:
          name: release-macos-${{ matrix.goarch }}
          path: ${{ steps.package.outputs.archive }}
          retention-days: 1
          if-no-files-found: error

  publish-release:
    name: Publish release
    needs:
      - release
      - linux-artifacts
      - macos-artifacts
    runs-on: ubuntu-latest
    env:
      NEXT_TAG: ${{ needs.release.outputs.next_tag }}
      RELEASE_NAME: ${{ needs.release.outputs.release_name }}
      PRERELEASE: ${{ needs.release.outputs.prerelease }}
      MAKE_LATEST: ${{ needs.release.outputs.make_latest }}
      NOTES_PATH: ${{ github.workspace }}/release-notes.md
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout release tag
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.release.outputs.next_tag }}
          fetch-depth: 100
          fetch-tags: true
      - name: Install git-cliff
        uses: taiki-e/install-action@git-cliff
      - name: Generate release notes
        run: |
          set -euo pipefail
          ignore_rc_tags='^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$'
          if [[ "${NEXT_TAG}" =~ -rc\.[0-9]+$ ]]; then
            git-cliff --current --output "${NOTES_PATH}"
          else
            git-cliff --current --ignore-tags "${ignore_rc_tags}" --output "${NOTES_PATH}"
          fi
          {
            echo "# Release Notes"
            echo
            cat "${NOTES_PATH}"
          } >> "$GITHUB_STEP_SUMMARY"
      - name: Download release artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: release-*
          path: release-assets
          merge-multiple: true
      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ env.NEXT_TAG }}
          name: ${{ env.RELEASE_NAME }}
          body_path: ${{ env.NOTES_PATH }}
          prerelease: ${{ env.PRERELEASE }}
          make_latest: ${{ env.MAKE_LATEST }}
          working_directory: release-assets
          draft: true
          files: |
            *.tar.gz