release.yaml

name: Release

on:
  push:
    tags:
      - 'v*'
  # Dispatched by tag-release.yaml because tags pushed with GITHUB_TOKEN do not
  # trigger another workflow.
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

permissions:
  contents: write
  packages: write

jobs:
  validate:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          lfs: true

      - name: Validate tag and changelog
        shell: bash
        run: |
          set -euo pipefail

          VERSION="$(tr -d '[:space:]' < VERSION)"
          if [[ "$GITHUB_REF_NAME" != "v${VERSION}" ]]; then
            echo "Tag $GITHUB_REF_NAME does not match VERSION v${VERSION}" >&2
            exit 1
          fi

          if ! grep -q "^## \\[$VERSION\\]" CHANGELOG.md; then
            echo "CHANGELOG.md has no section for $VERSION" >&2
            exit 1
          fi

  build:
    name: Build release image (${{ matrix.arch }})
    needs: validate
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            platform: linux/amd64
            runner: ubuntu-24.04
          - arch: arm64
            platform: linux/arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          lfs: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push image by digest
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: ${{ matrix.platform }}
          push: true
          outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
          labels: |
            org.opencontainers.image.title=Buzznode
            org.opencontainers.image.description=One persistent browser-accessible computer for one Buzz agent
          cache-from: type=gha,scope=buzznode-${{ matrix.arch }}
          cache-to: type=gha,mode=max,scope=buzznode-${{ matrix.arch }}
          provenance: mode=max
          sbom: true

      - name: Export image digest
        shell: bash
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          mkdir -p /tmp/digests
          touch "/tmp/digests/${DIGEST#sha256:}"

      - name: Upload image digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ matrix.arch }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  publish:
    name: Publish multi-architecture release
    needs:
      - validate
      - build
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          lfs: true

      - name: Download image digests
        uses: actions/download-artifact@v5
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract image metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          flavor: |
            latest=false
          tags: |
            type=raw,value=${{ github.ref_name }}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}

      - name: Create multi-architecture image
        id: manifest
        shell: bash
        env:
          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        run: |
          set -euo pipefail

          docker buildx imagetools create \
            $(jq -cr '.tags | map("-t " + .) | join(" ")' \
              <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf "${IMAGE}@sha256:%s " /tmp/digests/* | \
              sed 's|/tmp/digests/||g')

          digest="$(
            docker buildx imagetools inspect \
              "${IMAGE}:${GITHUB_REF_NAME}" |
              sed -n 's/^Digest:[[:space:]]*//p' |
              head -1
          )"
          test -n "$digest"
          echo "digest=$digest" >> "$GITHUB_OUTPUT"

      - name: Set up ORAS
        uses: oras-project/setup-oras@v2
        with:
          version: 1.3.3

      - name: Publish Launcher application
        shell: bash
        env:
          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          DIGEST: ${{ steps.manifest.outputs.digest }}
        run: |
          set -euo pipefail

          version="${GITHUB_REF_NAME#v}"
          archive_directory="$(mktemp -d)"
          archive_name=launcher-application.zip
          archive="${archive_directory}/${archive_name}"
          (
            cd launcher
            find . -maxdepth 1 -type f -printf '%P\n' |
              LC_ALL=C sort |
              zip -X -q "$archive" -@
          )
          attachment="$(
            cd "$archive_directory"
            oras attach \
              --artifact-type \
                application/vnd.pdparchitect.launcher.application.v1 \
              --annotation \
                "org.opencontainers.image.title=Buzznode Launcher application" \
              --format json \
              "${IMAGE}@${DIGEST}" \
              "${archive_name}:application/vnd.pdparchitect.launcher.application.bundle.v1+zip"
          )"
          application_digest="$(jq -er '.digest' <<<"$attachment")"
          tags=("launcher-${version}")
          if [[ "$GITHUB_REF_NAME" != *-* ]]; then
            tags+=("launcher-stable")
          fi
          oras tag "${IMAGE}@${application_digest}" "${tags[@]}"

      - name: Generate release notes
        id: notes
        shell: bash
        env:
          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          DIGEST: ${{ steps.manifest.outputs.digest }}
        run: |
          set -euo pipefail

          VERSION="${GITHUB_REF_NAME#v}"
          {
            echo "content<<RELEASE_EOF"
            echo "Container image: \`${IMAGE}:${GITHUB_REF_NAME}\`"
            echo
            echo "Digest: \`${DIGEST}\`"
            echo
            awk -v version="$VERSION" '
              $0 ~ "^## \\[" version "\\]" {
                found = 1
                next
              }
              found && /^## \[/ {
                exit
              }
              found {
                print
              }
            ' CHANGELOG.md
            echo "RELEASE_EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          body: ${{ steps.notes.outputs.content }}
          prerelease: ${{ contains(github.ref_name, '-') }}