release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

permissions: {}

# Releases serialize globally, not per tag: two tags pushed together each start a
# run, and both publish to the same Homebrew and Scoop repositories. queue: max
# because the default, single, cancels whichever release is already waiting when
# the next one arrives — serializing by dropping a release is not serializing.
concurrency:
  group: release
  queue: max
  cancel-in-progress: false

jobs:
  verify:
    name: Verify release source
    permissions:
      contents: read
    uses: ./.github/workflows/ci.yml

  server-e2e:
    name: Verify release on a real server
    permissions:
      contents: read
    uses: ./.github/workflows/e2e-server.yml

  release:
    name: Publish signed release, Homebrew, and Scoop
    needs: [verify, server-e2e]
    runs-on: ubuntu-24.04
    timeout-minutes: 40
    permissions:
      contents: write
      packages: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      # Tags as well as main: lineage validation needs main, and the changelog
      # needs the preceding tag. checkout fetches only the tag being released,
      # so without this every release would log the whole history.
      - name: Fetch release lineage
        run: git fetch --force --tags origin +refs/heads/main:refs/remotes/origin/main

      - name: Validate tag and main lineage
        run: scripts/validate-release-tag.sh "${GITHUB_REF_NAME}" origin/main

      # Against the published release, not against local tags: a tag that exists
      # says nothing about whether its release ran, and a queued release is not
      # stale merely because a newer tag was created while it waited.
      - name: Refuse to publish behind the current release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: scripts/require-newest-release.sh "${GITHUB_REF_NAME}" "${GITHUB_REPOSITORY}"

      - name: Verify release credentials and publication targets
        env:
          GH_TOKEN: ${{ secrets.PACKAGE_REPOS_TOKEN }}
          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
        run: |
          required=(
            GH_TOKEN
            MACOS_NOTARY_ISSUER_ID
            MACOS_NOTARY_KEY
            MACOS_NOTARY_KEY_ID
            MACOS_SIGN_P12
            MACOS_SIGN_PASSWORD
          )
          for name in "${required[@]}"; do
            if [ -z "${!name:-}" ]; then
              echo "Required release secret ${name} is not configured." >&2
              exit 1
            fi
          done
          for repository in labstack/homebrew-tap labstack/scoop-bucket; do
            access=$(gh api "repos/${repository}" --jq '[.default_branch, .permissions.push] | @tsv')
            if [ "$access" != $'main\ttrue' ]; then
              echo "PACKAGE_REPOS_TOKEN must have contents write access to ${repository}:main." >&2
              exit 1
            fi
          done

      - name: Require public discovery controller package
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          visibility=$(gh api orgs/labstack/packages/container/onebox-discovery --jq .visibility)
          if [ "$visibility" != public ]; then
            echo "The onebox-discovery package must be public before a release can reference it." >&2
            exit 1
          fi

      - name: Require public PostgreSQL 18 distribution
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          visibility=$(gh api orgs/labstack/packages/container/onebox-postgres --jq .visibility)
          if [ "$visibility" != public ]; then
            echo "The onebox-postgres package must be public before a release can reference it." >&2
            exit 1
          fi
          docker manifest inspect ghcr.io/labstack/onebox-postgres:18 >/dev/null

      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3

      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # The runner pins this exact release tag in the managed proxy Compose
      # file. Publish the controller before the binary that references it.
      - name: Publish matching discovery controller
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          file: build/package/onebox-discovery.Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ghcr.io/labstack/onebox-discovery:${{ github.ref_name }}
          provenance: mode=max
          sbom: true

      - name: Verify released controller is anonymously pullable
        run: |
          docker logout ghcr.io
          docker buildx imagetools inspect "ghcr.io/labstack/onebox-discovery:${GITHUB_REF_NAME}"

      - name: Publish immutable release
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          distribution: goreleaser
          version: v2.18.0
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PACKAGE_REPOS_TOKEN: ${{ secrets.PACKAGE_REPOS_TOKEN }}
          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}

      # The published artifacts, not a snapshot of them. Until this ran here,
      # nothing checked what a user actually downloads.
      - name: Verify published artifacts
        run: scripts/verify-release-dist.sh dist