release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  preflight:
    name: Release preflight
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.version.outputs.value }}
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true
      - id: version
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]
          version="${RELEASE_TAG#v}"
          test "v$version" = "$RELEASE_TAG"

          GOCACHE="$RUNNER_TEMP/go-cache" CCACHE_DISABLE=1 go test ./pkg/distribution ./internal/toolchain
          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64 windows/arm64; do
            go run ./cmd/toolchain-lock -lock toolchains/toolchains.lock.json -os "${target%/*}" -arch "${target#*/}" >/dev/null
          done
          echo "value=$version" >> "$GITHUB_OUTPUT"

  host_linux_amd64:
    name: Host Linux amd64
    needs: preflight
    uses: ./.github/workflows/release-host.yml
    with:
      runner: ubuntu-24.04
      os: linux
      arch: amd64
      version: ${{ needs.preflight.outputs.version }}

  host_linux_arm64:
    name: Host Linux arm64
    needs: preflight
    uses: ./.github/workflows/release-host.yml
    with:
      runner: ubuntu-24.04-arm
      os: linux
      arch: arm64
      version: ${{ needs.preflight.outputs.version }}

  host_darwin_amd64:
    name: Host macOS amd64
    needs: preflight
    uses: ./.github/workflows/release-host.yml
    with:
      runner: macos-15-intel
      os: darwin
      arch: amd64
      version: ${{ needs.preflight.outputs.version }}
      minimum-macos: "13.0"

  host_darwin_arm64:
    name: Host macOS arm64
    needs: preflight
    uses: ./.github/workflows/release-host.yml
    with:
      runner: macos-15
      os: darwin
      arch: arm64
      version: ${{ needs.preflight.outputs.version }}
      minimum-macos: "13.0"

  host_windows_amd64:
    name: Host Windows amd64
    needs: preflight
    uses: ./.github/workflows/release-host.yml
    with:
      runner: windows-2025
      os: windows
      arch: amd64
      version: ${{ needs.preflight.outputs.version }}

  host_windows_arm64:
    name: Host Windows arm64
    needs: preflight
    uses: ./.github/workflows/release-host.yml
    with:
      runner: windows-11-arm
      os: windows
      arch: arm64
      version: ${{ needs.preflight.outputs.version }}

  assemble_release:
    name: Assemble release
    needs:
      - preflight
      - host_linux_amd64
      - host_linux_arm64
      - host_darwin_amd64
      - host_darwin_arm64
      - host_windows_amd64
      - host_windows_arm64
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true
      - uses: actions/download-artifact@v8
        with:
          pattern: release-host-*
          path: dist
          merge-multiple: true
      - name: Build unsigned release manifest
        env:
          RELEASE_VERSION: ${{ needs.preflight.outputs.version }}
        run: |
          mkdir release-assets
          base_url="https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF_NAME}"
          go run ./cmd/release-index \
            -version "$RELEASE_VERSION" \
            -base-url "$base_url" \
            -toolchains-lock toolchains/toolchains.lock.json \
            dist/*.tar.gz.json dist/*.zip.json \
            > release-assets/release-manifest.json
          find dist -maxdepth 1 -type f \
            \( -name '*.tar.gz' -o -name '*.zip' \) \
            -exec cp {} release-assets/ \;
          cp scripts/install.sh scripts/install.ps1 release-assets/
      - uses: actions/upload-artifact@v7
        with:
          name: release-assembled
          path: release-assets
          if-no-files-found: error
          compression-level: 0
          retention-days: 1

  finalize_release:
    name: Finalize release
    needs: assemble_release
    runs-on: ubuntu-24.04
    environment: release
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true
      - uses: actions/download-artifact@v8
        with:
          name: release-assembled
          path: release-assets

      - name: Generate SHA256SUMS
        run: |
          (
            cd release-assets
            find . -maxdepth 1 -type f ! -name SHA256SUMS -printf '%f\n' | sort | xargs sha256sum > SHA256SUMS
          )
      - name: Create or update draft release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: |
          if gh release view "$GITHUB_REF_NAME" --json isDraft --jq .isDraft > "$RUNNER_TEMP/is-draft" 2>/dev/null; then
            test "$(cat "$RUNNER_TEMP/is-draft")" = true
          else
            gh release create "$GITHUB_REF_NAME" --draft --verify-tag --title "Peeper $GITHUB_REF_NAME" --notes "Open source release candidate. Verify installers and checksums."
          fi
          gh release upload "$GITHUB_REF_NAME" release-assets/* --clobber