release.yml

name: Release

on:
  push:
    tags:
      - "v[0-9]*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to release (must already be pushed, e.g. v5.10.0-rc1)"
        required: true
      upload_taps:
        description: "Upload to Homebrew/Scoop taps (overrides pre-release skip)"
        type: boolean
        default: false
      upload_repos:
        description: "Upload to package repositories via repogen (overrides pre-release skip)"
        type: boolean
        default: false

permissions:
  contents: write

env:
  IMAGE: ghcr.io/upsun/cli

jobs:
  release:
    runs-on: ubuntu-latest
    environment: production
    permissions:
      contents: write
    outputs:
      tag: ${{ steps.tag.outputs.tag }}
      is_prerelease: ${{ steps.tag.outputs.is_prerelease }}

    steps:
      - name: Resolve tag
        id: tag
        run: |
          TAG="${{ inputs.tag || github.ref_name }}"
          if ! echo "$TAG" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?(\+[a-zA-Z0-9.]+)?$'; then
            echo "::error::Tag '$TAG' does not match semver format (vMAJOR.MINOR.PATCH)"
            exit 1
          fi
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          if [[ "$TAG" == *-* ]]; then
            echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_prerelease=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Check out repository code
        uses: actions/checkout@v4
        with:
          ref: ${{ steps.tag.outputs.tag }}
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: ./go.mod

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: "8.4"
          extensions: curl, openssl, phar, zlib
          tools: composer:v2

      - name: Get Composer cache directory
        id: composer-cache
        run: echo "dir=$(cd legacy && composer config cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache Composer dependencies
        uses: actions/cache@v4
        with:
          path: ${{ steps.composer-cache.outputs.dir }}
          key: ${{ runner.os }}-composer-${{ hashFiles('legacy/composer.lock') }}
          restore-keys: ${{ runner.os }}-composer-

      - name: Install legacy dependencies
        run: cd legacy && composer install --no-interaction

      - name: Get PHP version from Makefile
        id: php-version
        run: echo "version=$(grep '^PHP_VERSION' Makefile | cut -d= -f2 | tr -d ' ')" >> $GITHUB_OUTPUT

      - name: Get tool versions from Makefile
        id: tool-versions
        run: |
          echo "goreleaser=$(grep '^GORELEASER_VERSION' Makefile | cut -d= -f2 | tr -d ' ')" >> $GITHUB_OUTPUT
          echo "repogen=$(grep '^REPOGEN_VERSION' Makefile | cut -d= -f2 | tr -d ' ')" >> $GITHUB_OUTPUT

      - name: Cache PHP binaries
        uses: actions/cache@v4
        id: php-cache
        with:
          path: internal/legacy/archives/php_*
          key: php-binaries-${{ steps.php-version.outputs.version }}

      - name: Download all PHP binaries
        if: steps.php-cache.outputs.cache-hit != 'true'
        run: make download-php

      - name: Write signing keys to files
        id: signing-keys
        run: |
          KEY_DIR=$(mktemp -d)
          echo "key_dir=$KEY_DIR" >> $GITHUB_OUTPUT
          echo "${{ secrets.RSA_SIGNING_KEY }}" > "$KEY_DIR/rsa-signing-key.pem"
          chmod 600 "$KEY_DIR/rsa-signing-key.pem"
          openssl rsa -in "$KEY_DIR/rsa-signing-key.pem" -pubout -out "$KEY_DIR/rsa-signing-key.pub"
          echo "${{ secrets.GPG_SIGNING_KEY }}" | base64 -d > "$KEY_DIR/gpg-signing-key.asc"
          chmod 600 "$KEY_DIR/gpg-signing-key.asc"

      - name: Cache Go binaries
        uses: actions/cache@v4
        with:
          path: ~/go/bin
          key: ${{ runner.os }}-go-bin-goreleaser-${{ steps.tool-versions.outputs.goreleaser }}-repogen-${{ steps.tool-versions.outputs.repogen }}

      - name: Install Go tools
        run: make goreleaser repogen

      - name: Generate GitHub App token for homebrew-tap
        id: app-token
        if: startsWith(github.ref, 'refs/tags/') || inputs.tag
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ vars.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          repositories: homebrew-tap

      - name: Build release (tag)
        if: startsWith(github.ref, 'refs/tags/') || inputs.tag
        env:
          GORELEASER_CURRENT_TAG: ${{ steps.tag.outputs.tag }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAP_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          RSA_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pem
          GPG_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/gpg-signing-key.asc
          CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
          SKIP_UPLOAD_TAPS: ${{ inputs.upload_taps == true && 'false' || 'auto' }}
        run: make release

      - name: Build snapshot (branch)
        if: "!startsWith(github.ref, 'refs/tags/') && !inputs.tag"
        env:
          RSA_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pem
          GPG_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/gpg-signing-key.asc
        run: make snapshot

      - name: Configure AWS credentials
        if: steps.tag.outputs.is_prerelease == 'false' || inputs.upload_repos == true
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-west-1

      - name: Upload packages to repository
        if: steps.tag.outputs.is_prerelease == 'false' || inputs.upload_repos == true
        env:
          GPG_PRIVATE_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/gpg-signing-key.asc
          RSA_PRIVATE_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pem
          RSA_PUBLIC_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pub
        run: bash ./repogen.sh

      - name: Clean up signing keys
        if: always()
        run: |
          rm -rf "${{ steps.signing-keys.outputs.key_dir }}"

  docker:
    runs-on: ${{ matrix.runner }}
    needs: release
    strategy:
      matrix:
        include:
          - runner: ubuntu-latest
            platform: linux/amd64
            suffix: amd64
          - runner: ubuntu-24.04-arm
            platform: linux/arm64
            suffix: arm64
    permissions:
      contents: read
      packages: write
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: https://github.com/${{ github.repository }}.git#${{ needs.release.outputs.tag }}
          platforms: ${{ matrix.platform }}
          push: true
          tags: ${{ env.IMAGE }}:${{ needs.release.outputs.tag }}-${{ matrix.suffix }}
          build-args: |
            VERSION=${{ needs.release.outputs.tag }}
          cache-from: type=gha,scope=${{ matrix.suffix }}
          cache-to: type=gha,mode=max,scope=${{ matrix.suffix }}

  docker-manifest:
    runs-on: ubuntu-latest
    needs: [docker, release]
    permissions:
      contents: read
      packages: write
    steps:
      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create and push versioned manifest
        run: |
          docker buildx imagetools create \
            --tag ${{ env.IMAGE }}:${{ needs.release.outputs.tag }} \
            ${{ env.IMAGE }}:${{ needs.release.outputs.tag }}-amd64 \
            ${{ env.IMAGE }}:${{ needs.release.outputs.tag }}-arm64

      - name: Create and push latest manifest
        if: needs.release.outputs.is_prerelease == 'false'
        run: |
          docker buildx imagetools create \
            --tag ${{ env.IMAGE }}:latest \
            ${{ env.IMAGE }}:${{ needs.release.outputs.tag }}-amd64 \
            ${{ env.IMAGE }}:${{ needs.release.outputs.tag }}-arm64