release-lambda.yml

name: Release lambda

on:
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: txing-release-lambda-${{ github.ref }}
  cancel-in-progress: false

env:
  RELEASE_COMPONENT: lambda
  RELEASE_VERSION_FILE: release/versions/lambda
  RELEASE_TAG_PREFIX: lambda-v
  WITNESS_LAMBDA_ASSET: txing-witness-lambda-linux-aarch64.zip
  CLOUD_RIG_LAMBDA_ASSET: txing-cloud-rig-lambda-linux-aarch64.zip
  CLOUD_MCU_LAMBDA_ASSET: txing-cloud-mcu-lambda-linux-aarch64.zip

jobs:
  metadata:
    name: Resolve release metadata
    runs-on: ubuntu-24.04-arm
    outputs:
      version: ${{ steps.metadata.outputs.version }}
      latest_release_version: ${{ steps.metadata.outputs.latest_release_version }}
      tag: ${{ steps.metadata.outputs.tag }}
      release_target: ${{ steps.metadata.outputs.release_target }}

    steps:
      - name: Check out repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Resolve release metadata
        id: metadata
        shell: bash
        run: |
          set -euo pipefail

          version="$(tr -d '[:space:]' < "$RELEASE_VERSION_FILE")"
          if [[ ! "$version" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
            echo "$RELEASE_VERSION_FILE must contain a semantic version like x.y.z, got: $version" >&2
            exit 1
          fi
          version_major_num=$((10#${BASH_REMATCH[1]}))
          version_minor_num=$((10#${BASH_REMATCH[2]}))
          version_patch_num=$((10#${BASH_REMATCH[3]}))

          if [ "${GITHUB_REF_TYPE}" != "branch" ]; then
            echo "$RELEASE_COMPONENT release workflow must be run manually from a branch, got ref type: ${GITHUB_REF_TYPE}" >&2
            exit 1
          fi

          git fetch --tags --force origin
          latest_release_version=""
          latest_major_num=0
          latest_minor_num=0
          latest_patch_num=0
          while IFS= read -r tag; do
            candidate="${tag#$RELEASE_TAG_PREFIX}"
            if [[ ! "$candidate" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
              continue
            fi
            candidate_major_num=$((10#${BASH_REMATCH[1]}))
            candidate_minor_num=$((10#${BASH_REMATCH[2]}))
            candidate_patch_num=$((10#${BASH_REMATCH[3]}))
            if [ -z "$latest_release_version" ] ||
              (( candidate_major_num > latest_major_num ||
                (candidate_major_num == latest_major_num && candidate_minor_num > latest_minor_num) ||
                (candidate_major_num == latest_major_num && candidate_minor_num == latest_minor_num && candidate_patch_num > latest_patch_num) )); then
              latest_release_version="$candidate"
              latest_major_num="$candidate_major_num"
              latest_minor_num="$candidate_minor_num"
              latest_patch_num="$candidate_patch_num"
            fi
          done < <(git tag --list "$RELEASE_TAG_PREFIX*")

          if [ -n "$latest_release_version" ] &&
            (( version_major_num < latest_major_num ||
              (version_major_num == latest_major_num && version_minor_num < latest_minor_num) ||
              (version_major_num == latest_major_num && version_minor_num == latest_minor_num && version_patch_num <= latest_patch_num) )); then
            echo "$RELEASE_VERSION_FILE version $version must be greater than latest $RELEASE_COMPONENT release tag ${RELEASE_TAG_PREFIX}${latest_release_version}." >&2
            exit 1
          fi

          tag="${RELEASE_TAG_PREFIX}${version}"
          release_target="$(git rev-parse HEAD)"

          {
            echo "### Txing $RELEASE_COMPONENT release"
            echo
            echo "- Component: \`$RELEASE_COMPONENT\`"
            echo "- Version file: \`$RELEASE_VERSION_FILE\`"
            echo "- Version: \`$version\`"
            if [ -n "$latest_release_version" ]; then
              echo "- Latest $RELEASE_COMPONENT release tag: \`${RELEASE_TAG_PREFIX}${latest_release_version}\`"
            else
              echo "- Latest $RELEASE_COMPONENT release tag: none"
            fi
            echo "- Tag: \`$tag\`"
            echo "- Commit: \`$release_target\`"
          } >>"$GITHUB_STEP_SUMMARY"

          echo "version=$version" >>"$GITHUB_OUTPUT"
          echo "latest_release_version=$latest_release_version" >>"$GITHUB_OUTPUT"
          echo "tag=$tag" >>"$GITHUB_OUTPUT"
          echo "release_target=$release_target" >>"$GITHUB_OUTPUT"

      - name: Reject existing immutable release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ steps.metadata.outputs.tag }}
        shell: bash
        run: |
          set -euo pipefail

          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "Release $TAG already exists; releases are immutable." >&2
            exit 1
          fi

          if git ls-remote --exit-code --tags origin "refs/tags/$TAG" >/dev/null 2>&1; then
            echo "Release tag $TAG already exists; releases are immutable." >&2
            exit 1
          fi

  build-lambda:
    name: Build ${{ matrix.function_name }}
    runs-on: ubuntu-24.04-arm
    needs: metadata
    strategy:
      fail-fast: false
      matrix:
        include:
          - function_name: txing-witness-lambda
            working_directory: witness
            package_path: ./cmd/txing-witness-lambda
            version_package: txing.dev/witness/internal/version
            asset_name: txing-witness-lambda-linux-aarch64.zip
          - function_name: txing-cloud-rig-lambda
            working_directory: devices/cloud-mcu/lambda
            package_path: ./cmd/txing-cloud-rig-lambda
            version_package: txing.dev/cloud-mcu-lambda/internal/version
            asset_name: txing-cloud-rig-lambda-linux-aarch64.zip
          - function_name: txing-cloud-mcu-lambda
            working_directory: devices/cloud-mcu/lambda
            package_path: ./cmd/txing-cloud-mcu-lambda
            version_package: txing.dev/cloud-mcu-lambda/internal/version
            asset_name: txing-cloud-mcu-lambda-linux-aarch64.zip

    steps:
      - name: Check out repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Configure apt networking
        shell: bash
        run: |
          set -euo pipefail
          for source in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
            [ -e "$source" ] || continue
            sudo sed -i 's|http://ports.ubuntu.com/ubuntu-ports|https://ports.ubuntu.com/ubuntu-ports|g' "$source"
          done
          printf 'Acquire::ForceIPv4 "true";\nAcquire::Retries "5";\n' \
            | sudo tee /etc/apt/apt.conf.d/99txing-ci-network >/dev/null

      - name: Install system build dependencies
        shell: bash
        run: |
          set -euo pipefail
          sudo apt-get update

          go_package=""
          go_root=""
          for version in 1.26 1.25 1.24; do
            candidate="golang-${version}-go"
            if apt-cache show "$candidate" >/dev/null 2>&1; then
              go_package="$candidate"
              go_root="/usr/lib/go-${version}"
              break
            fi
          done
          if [ -z "$go_package" ]; then
            echo "Expected a Go 1.24+ compiler package in Ubuntu Noble apt repositories." >&2
            exit 1
          fi

          sudo apt-get install -y \
            ca-certificates file git "$go_package" unzip zip
          echo "$go_root/bin" >>"$GITHUB_PATH"
          "$go_root/bin/go" version

      - name: Restore Go cache
        uses: actions/cache@v5
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
          key: go-lambda-${{ matrix.function_name }}-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('witness/go.mod', 'witness/go.sum', 'devices/cloud-mcu/lambda/go.mod', 'devices/cloud-mcu/lambda/go.sum') }}
          restore-keys: |
            go-lambda-${{ matrix.function_name }}-${{ runner.os }}-${{ runner.arch }}-
            go-lambda-${{ runner.os }}-${{ runner.arch }}-

      - name: Test and build ${{ matrix.function_name }}
        shell: bash
        run: |
          set -euo pipefail
          cd "${{ matrix.working_directory }}"
          go version
          GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go test -tags lambda.norpc ./...
          GOOS=linux GOARCH=arm64 CGO_ENABLED=0 \
            go build -trimpath -tags lambda.norpc \
            -ldflags="-s -w -X ${{ matrix.version_package }}.Version=${{ needs.metadata.outputs.version }}" \
            -o "$RUNNER_TEMP/${{ matrix.function_name }}" \
            "${{ matrix.package_path }}"

      - name: Package ${{ matrix.asset_name }}
        shell: bash
        run: |
          set -euo pipefail
          source="$RUNNER_TEMP/${{ matrix.function_name }}"
          package_dir="$RUNNER_TEMP/package-${{ matrix.function_name }}"
          asset_path="$RUNNER_TEMP/${{ matrix.asset_name }}"
          test -x "$source"
          rm -rf "$package_dir"
          install -d "$package_dir"
          install -m 755 "$source" "$package_dir/bootstrap"
          bootstrap_file="$(file "$package_dir/bootstrap")"
          echo "$bootstrap_file"
          if ! grep -q 'ELF 64-bit LSB executable, ARM aarch64' <<<"$bootstrap_file"; then
            echo "Expected ${{ matrix.function_name }} bootstrap to be a Linux ARM64 executable, got:" >&2
            echo "$bootstrap_file" >&2
            exit 1
          fi
          ldd_output="$(ldd "$package_dir/bootstrap" 2>&1 || true)"
          if ! grep -Eq 'not a dynamic executable|statically linked' <<<"$ldd_output"; then
            echo "Expected ${{ matrix.function_name }} bootstrap to be statically linked, got:" >&2
            printf '%s\n' "$ldd_output" >&2
            exit 1
          fi
          (cd "$package_dir" && zip -q "$asset_path" bootstrap)
          archive_listing="$(unzip -Z1 "$asset_path")"
          if [ "$archive_listing" != "bootstrap" ]; then
            echo "Expected ${{ matrix.asset_name }} to contain only root-level bootstrap, got:" >&2
            printf '%s\n' "$archive_listing" >&2
            exit 1
          fi

      - name: Upload ${{ matrix.asset_name }}
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.asset_name }}
          path: ${{ runner.temp }}/${{ matrix.asset_name }}
          if-no-files-found: error

  publish:
    name: Publish release
    runs-on: ubuntu-24.04-arm
    needs:
      - metadata
      - build-lambda

    steps:
      - name: Download release assets
        uses: actions/download-artifact@v8
        with:
          path: ${{ runner.temp }}/release-assets
          merge-multiple: true

      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.metadata.outputs.tag }}
          VERSION: ${{ needs.metadata.outputs.version }}
          RELEASE_TARGET: ${{ needs.metadata.outputs.release_target }}
          RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets
        shell: bash
        run: |
          set -euo pipefail

          release_assets=(
            "$WITNESS_LAMBDA_ASSET"
            "$CLOUD_RIG_LAMBDA_ASSET"
            "$CLOUD_MCU_LAMBDA_ASSET"
          )

          release_asset_paths=()
          for asset in "${release_assets[@]}"; do
            asset_path="$RELEASE_ASSETS_DIR/$asset"
            if [ ! -s "$asset_path" ]; then
              echo "Missing release asset from build jobs: $asset_path" >&2
              find "$RELEASE_ASSETS_DIR" -maxdepth 2 -type f -print >&2 || true
              exit 1
            fi
            release_asset_paths+=("$asset_path")
          done

          notes_file="$(mktemp)"
          {
            echo "Txing $RELEASE_COMPONENT release."
            echo
            echo "- Component: $RELEASE_COMPONENT"
            echo "- Version: $VERSION"
            echo "- Tag: $TAG"
            echo "- Commit: $RELEASE_TARGET"
            echo "- Assets:"
            for asset in "${release_assets[@]}"; do
              echo "  - $asset"
            done
          } >"$notes_file"

          gh release create "$TAG" \
            "${release_asset_paths[@]}" \
            --repo "$GITHUB_REPOSITORY" \
            --target "$RELEASE_TARGET" \
            --title "$TAG" \
            --notes-file "$notes_file" \
            --latest=false