release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  # 允许手动从 gh CLI 触发：gh workflow run release.yml --ref v0.1.0
  # 用于重跑失败的发布，或在快速 delete+repush 同一个 tag 时手工补发
  # （GitHub Actions 偶尔会跳过这种 push 事件）。
  # github.ref_name 由 --ref 参数提供，与 tag 推送的语义一致。
  workflow_dispatch:

permissions:
  contents: write
  packages: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: doudou-start/airgate-core

jobs:
  # ------------------------------------------------------------
  # Job 1: 构建前端（只跑一次，供后续 job 复用）
  # ------------------------------------------------------------
  build-frontend:
    name: Build Frontend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Clone airgate-sdk
        run: git clone --depth 1 https://github.com/DouDOU-start/airgate-sdk.git ../airgate-sdk

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: web/package-lock.json

      - name: Build @airgate/theme (sdk frontend dependency)
        run: cd ../airgate-sdk/frontend && npm ci && npm run build

      - name: Build core frontend
        run: cd web && npm ci && npm run build

      - name: Upload web/dist artifact
        uses: actions/upload-artifact@v4
        with:
          name: web-dist
          path: web/dist
          retention-days: 1

  # ------------------------------------------------------------
  # Job 2: 多架构 Docker 镜像（原生 runner 并行构建，无 QEMU）
  # ------------------------------------------------------------
  build-image:
    name: Build Image (${{ matrix.platform }})
    needs: build-frontend
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    steps:
      - name: Checkout airgate-core
        uses: actions/checkout@v4
        with:
          path: airgate-core

      - name: Clone airgate-sdk
        run: git clone --depth 1 https://github.com/DouDOU-start/airgate-sdk.git airgate-sdk

      - name: Download frontend artifact
        uses: actions/download-artifact@v4
        with:
          name: web-dist
          path: airgate-core/web/dist

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Build & push by digest
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: airgate-core/deploy/Dockerfile
          platforms: ${{ matrix.platform }}
          build-args: |
            VERSION=${{ github.ref_name }}
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=${{ matrix.platform }}
          cache-to: type=gha,scope=${{ matrix.platform }},mode=max
          provenance: false
          sbom: false

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  # ------------------------------------------------------------
  # Job 3: 合并多架构 manifest
  # ------------------------------------------------------------
  merge-manifests:
    name: Merge Multi-arch Manifest
    needs: build-image
    runs-on: ubuntu-latest
    steps:
      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable={{is_default_branch}}
            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-') }}

      - name: Create manifest list and push
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create \
            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}

  # ------------------------------------------------------------
  # Job 4: 跨平台原生二进制（linux/darwin × amd64/arm64）
  # 用于裸金属 install.sh 部署 —— 二进制完全自包含，前端 SPA + 翻译文件
  # 都已 //go:embed 进 binary，不需要附加资源。
  # ------------------------------------------------------------
  build-binaries:
    name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
    needs: build-frontend
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64
          - goos: darwin
            goarch: amd64
          - goos: darwin
            goarch: arm64
    steps:
      - uses: actions/checkout@v4

      - name: Clone airgate-sdk (go.work replace)
        run: git clone --depth 1 https://github.com/DouDOU-start/airgate-sdk.git ../airgate-sdk

      - name: Create go.work to use cloned airgate-sdk
        # 让 backend 的 Go 构建直接使用 sibling 的 airgate-sdk master，
        # 避免每次 SDK 新增字段都要手动 bump backend/go.mod。
        # 本地开发 go.work 在 gitignore，CI/release 临时生成一份。
        run: |
          cat > go.work <<'EOF'
          go 1.25.7

          use (
              ./backend
              ../airgate-sdk
          )
          EOF

      - name: Download frontend artifact
        uses: actions/download-artifact@v4
        with:
          name: web-dist
          path: web/dist

      - name: Embed web/dist into backend
        run: |
          rm -rf backend/internal/web/webdist
          mkdir -p backend/internal/web/webdist
          cp -r web/dist/. backend/internal/web/webdist/

      - uses: actions/setup-go@v5
        with:
          go-version-file: backend/go.mod
          cache-dependency-path: backend/go.sum

      - name: Build airgate-core binary
        env:
          GOTOOLCHAIN: local
          CGO_ENABLED: 0
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
        run: |
          VERSION="${GITHUB_REF_NAME}"
          echo "Injecting Version=${VERSION}"
          mkdir -p bin
          cd backend && go build -buildvcs=false -trimpath \
            -ldflags "-X 'github.com/DouDOU-start/airgate-core/internal/version.Version=${VERSION}' -s -w" \
            -o ../bin/airgate-core-${{ matrix.goos }}-${{ matrix.goarch }} ./cmd/server

      - name: Generate SHA256
        run: |
          cd bin && sha256sum airgate-core-${{ matrix.goos }}-${{ matrix.goarch }} \
            > airgate-core-${{ matrix.goos }}-${{ matrix.goarch }}.sha256

      - name: Upload binary artifacts
        uses: actions/upload-artifact@v4
        with:
          name: airgate-core-${{ matrix.goos }}-${{ matrix.goarch }}
          path: |
            bin/airgate-core-${{ matrix.goos }}-${{ matrix.goarch }}
            bin/airgate-core-${{ matrix.goos }}-${{ matrix.goarch }}.sha256
          retention-days: 1

  # ------------------------------------------------------------
  # Job 5: 创建 GitHub Release，把 docker tag 与原生二进制聚合发布
  # ------------------------------------------------------------
  release-notes:
    name: Create GitHub Release
    needs:
      - merge-manifests
      - build-binaries
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Download all binary artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist
          # 必须显式 filter，否则 docker/build-push-action@v6 自动产生的
          # *.dockerbuild 缓存元数据也会被列入，且下载会失败 5 次重试。
          pattern: airgate-core-*-*
          merge-multiple: true

      - name: List collected artifacts
        run: ls -la dist/

      - name: Generate release body
        env:
          CURRENT_TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          git fetch --force --tags

          prev_tag="$(git describe --tags --abbrev=0 "${CURRENT_TAG}^" 2>/dev/null || true)"
          if [ -n "$prev_tag" ]; then
            range="${prev_tag}..${CURRENT_TAG}"
          else
            range="${CURRENT_TAG}"
          fi

          tmp_dir="$(mktemp -d)"
          trap 'rm -rf "$tmp_dir"' EXIT
          touch \
            "$tmp_dir/feat.txt" \
            "$tmp_dir/fix.txt" \
            "$tmp_dir/refactor.txt" \
            "$tmp_dir/perf.txt" \
            "$tmp_dir/docs.txt" \
            "$tmp_dir/other.txt"

          while IFS= read -r subject; do
            [ -n "$subject" ] || continue

            bucket="other"
            item="$subject"

            if [[ "$subject" =~ ^([[:alpha:]]+)(\(([[:alnum:]_.\/-]+)\))?(!)?:[[:space:]]*(.+)$ ]]; then
              type="${BASH_REMATCH[1],,}"
              scope="${BASH_REMATCH[3]}"
              message="${BASH_REMATCH[5]}"
              item="$message"

              if [ -n "$scope" ]; then
                item="$scope: $message"
              fi

              case "$type" in
                feat|fix|refactor|perf|docs)
                  bucket="$type"
                  ;;
              esac
            fi

            printf '%s\n' "$item" >> "$tmp_dir/$bucket.txt"
          done < <(git log --no-merges --pretty=format:%s "$range")

          append_section() {
            local title="$1"
            local file="$2"

            if [ -s "$file" ]; then
              printf '### %s\n\n' "$title" >> release_body.md
              while IFS= read -r line; do
                printf -- '- %s\n' "$line" >> release_body.md
              done < "$file"
              printf '\n' >> release_body.md
            fi
          }

          printf '## 本版本变更\n\n' > release_body.md
          if [ -n "$prev_tag" ]; then
            printf '> 变更范围：`%s..%s`\n\n' "$prev_tag" "$CURRENT_TAG" >> release_body.md
          else
            printf '> 变更范围：初始发布\n\n' >> release_body.md
          fi

          append_section '新增' "$tmp_dir/feat.txt"
          append_section '修复' "$tmp_dir/fix.txt"
          append_section '重构' "$tmp_dir/refactor.txt"
          append_section '性能优化' "$tmp_dir/perf.txt"
          append_section '文档' "$tmp_dir/docs.txt"
          append_section '其他调整' "$tmp_dir/other.txt"

          if [ ! -s "$tmp_dir/feat.txt" ] && [ ! -s "$tmp_dir/fix.txt" ] && [ ! -s "$tmp_dir/refactor.txt" ] && [ ! -s "$tmp_dir/perf.txt" ] && [ ! -s "$tmp_dir/docs.txt" ] && [ ! -s "$tmp_dir/other.txt" ]; then
            printf -- '- 本版本没有检测到可汇总的提交记录。\n\n' >> release_body.md
          fi

      - name: Create release with generated changelog
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          body_path: release_body.md
          files: |
            dist/airgate-core-*