telemt/.github/workflows/release.yml

name: Release

on:
  push:
    tags:
      - '[0-9]+.[0-9]+.[0-9]+'
      - '[0-9]+.[0-9]+.[0-9]+-*'
  workflow_dispatch:

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: "1"
  BINARY_NAME: telemt

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.meta.outputs.version }}
      prerelease: ${{ steps.meta.outputs.prerelease }}
      release_enabled: ${{ steps.meta.outputs.release_enabled }}
    steps:
      - id: meta
        run: |
          set -euo pipefail

          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
            VERSION="${GITHUB_REF#refs/tags/}"
            RELEASE_ENABLED=true
          else
            VERSION="manual-${GITHUB_SHA::7}"
            RELEASE_ENABLED=false
          fi

          if [[ "$VERSION" == *"-alpha"* || "$VERSION" == *"-beta"* || "$VERSION" == *"-rc"* ]]; then
            PRERELEASE=true
          else
            PRERELEASE=false
          fi

          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "prerelease=$PRERELEASE" >> "$GITHUB_OUTPUT"
          echo "release_enabled=$RELEASE_ENABLED" >> "$GITHUB_OUTPUT"

  checks:
    runs-on: ubuntu-latest
    container:
      image: debian:trixie
    steps:
      - run: |
          apt-get update
          apt-get install -y build-essential clang llvm pkg-config curl git

      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - uses: actions/cache@v4
        with:
          path: |
            /github/home/.cargo/registry
            /github/home/.cargo/git
            target
          key: checks-${{ hashFiles('**/Cargo.lock') }}

      - run: cargo fetch --locked
      - run: cargo fmt --all -- --check
      - run: cargo clippy
      - run: cargo test

  build-binaries:
    needs: [prepare, checks]
    runs-on: ubuntu-latest
    container:
      image: debian:trixie

    strategy:
      fail-fast: false
      matrix:
        include:
          - rust_target: x86_64-unknown-linux-gnu
            zig_target: x86_64-unknown-linux-gnu.2.28
            asset_name: telemt-x86_64-linux-gnu
          - rust_target: aarch64-unknown-linux-gnu
            zig_target: aarch64-unknown-linux-gnu.2.28
            asset_name: telemt-aarch64-linux-gnu
          - rust_target: x86_64-unknown-linux-musl
            zig_target: x86_64-unknown-linux-musl
            asset_name: telemt-x86_64-linux-musl
          - rust_target: aarch64-unknown-linux-musl
            zig_target: aarch64-unknown-linux-musl
            asset_name: telemt-aarch64-linux-musl

    steps:
      - run: |
          apt-get update
          apt-get install -y clang llvm pkg-config curl git python3 python3-pip file tar xz-utils

      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rust_target }}

      - uses: actions/cache@v4
        with:
          path: |
            /github/home/.cargo/registry
            /github/home/.cargo/git
            target
          key: build-${{ matrix.zig_target }}-${{ hashFiles('**/Cargo.lock') }}

      - run: |
          python3 -m pip install --user --break-system-packages cargo-zigbuild
          echo "/github/home/.local/bin" >> "$GITHUB_PATH"

      - run: cargo fetch --locked

      - run: |
          cargo zigbuild --release --locked --target "${{ matrix.zig_target }}"

      - run: |
          BIN="target/${{ matrix.rust_target }}/release/${BINARY_NAME}"
          llvm-strip "$BIN" || true

      - run: |
          BIN="target/${{ matrix.rust_target }}/release/${BINARY_NAME}"
          OUT="$RUNNER_TEMP/${{ matrix.asset_name }}"
          mkdir -p "$OUT"
          install -m755 "$BIN" "$OUT/${BINARY_NAME}"

          tar -C "$RUNNER_TEMP" -czf "${{ matrix.asset_name }}.tar.gz" "${{ matrix.asset_name }}"
          sha256sum "${{ matrix.asset_name }}.tar.gz" > "${{ matrix.asset_name }}.sha256"

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.asset_name }}
          path: |
            ${{ matrix.asset_name }}.tar.gz
            ${{ matrix.asset_name }}.sha256

  docker-image:
    name: Docker ${{ matrix.platform }}
    needs: [prepare, build-binaries]
    runs-on: ubuntu-latest

    strategy:
      matrix:
        include:
          - platform: linux/amd64
            artifact: telemt-x86_64-linux-gnu
          - platform: linux/arm64
            artifact: telemt-aarch64-linux-gnu

    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: dist

      - run: |
          mkdir docker-build
          tar -xzf dist/*.tar.gz -C docker-build --strip-components=1

      - uses: docker/setup-buildx-action@v3

      - name: Login
        if: ${{ needs.prepare.outputs.release_enabled == 'true' }}
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/build-push-action@v6
        with:
          context: ./docker-build
          platforms: ${{ matrix.platform }}
          push: ${{ needs.prepare.outputs.release_enabled == 'true' }}
          tags: ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}
          cache-from: type=gha,scope=telemt-${{ matrix.platform }}
          cache-to: type=gha,mode=max,scope=telemt-${{ matrix.platform }}
          provenance: false
          sbom: false

  release:
    if: ${{ needs.prepare.outputs.release_enabled == 'true' }}
    needs: [prepare, build-binaries]
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - uses: actions/download-artifact@v4
        with:
          path: release-artifacts
          pattern: telemt-*

      - run: |
          mkdir upload
          find release-artifacts -type f \( -name '*.tar.gz' -o -name '*.sha256' \) -exec cp {} upload/ \;

      - uses: softprops/action-gh-release@v2
        with:
          files: upload/*
          generate_release_notes: true
          prerelease: ${{ needs.prepare.outputs.prerelease == 'true' }}