release.yml

name: Release

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  tests:
    name: Lint & Test
    runs-on: blacksmith-4vcpu-ubuntu-2404
    if: "!startsWith(github.event.head_commit.message, 'chore(release):')"
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          components: clippy, rustfmt

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Check format
        run: cargo fmt -- --check

      - name: Lint with Clippy
        run: cargo clippy -- -D warnings

      - name: Run Tests
        run: cargo test

  e2e-fpm:
    name: e2e tests - linux
    needs: tests
    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Install runtime deps
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends netcat-openbsd expect libfcgi-bin

      - name: Build pvm (release)
        run: cargo build --release

      - name: Run E2E suite
        env:
          PVM_BIN: ${{ github.workspace }}/target/release/pvm
          PVM_VERSION_MAJOR_MINOR: '8.5'
        run: bash tests/e2e/run.sh

      - name: Upload fpm logs on failure
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: fpm-logs
          path: |
            /tmp/fpm.stdout
            /tmp/fpm.stderr
          if-no-files-found: ignore

  release:
    name: Semantic Release
    needs: [tests, e2e-fpm]
    runs-on: blacksmith-4vcpu-ubuntu-2404
    if: github.ref == 'refs/heads/main'
    permissions:
      contents: write
      issues: write
      pull-requests: write
    outputs:
      new_release_published: ${{ steps.semantic.outputs.new_release_published }}
      new_release_version: ${{ steps.semantic.outputs.new_release_version }}
    steps:
      - name: Generate Token
        id: generate_token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          client-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          token: ${{ steps.generate_token.outputs.token }}

      - name: Semantic Release
        id: semantic
        uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
        with:
          tag_format: v${version}
          branches: |
            ['main']
          extra_plugins: |
            @semantic-release/commit-analyzer
            @semantic-release/release-notes-generator
            @semantic-release/github
            @semantic-release/changelog
            @semantic-release/git
            @semantic-release/exec
            conventional-changelog-conventionalcommits
        env:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  build:
    name: Build / ${{ matrix.os }}
    needs: release
    runs-on: ${{ matrix.os }}
    if: needs.release.outputs.new_release_published == 'true'
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            target: blacksmith-4vcpu-ubuntu-2404
            artifact_name: pvm
            asset_name: pvm-linux-x86_64
          - os: macos-latest
            target: aarch64-apple-darwin
            artifact_name: pvm
            asset_name: pvm-macos-aarch64
          - os: macos-latest
            target: x86_64-apple-darwin
            artifact_name: pvm
            asset_name: pvm-macos-x86_64

    steps:
      - name: Generate Token
        id: generate_token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          client-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: v${{ needs.release.outputs.new_release_version }}
          token: ${{ steps.generate_token.outputs.token }}

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: "1.95.0"
          components: clippy, rustfmt
          targets: ${{ matrix.target }}

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          key: ${{ matrix.target }}

      - name: Build release binary
        run: cargo build --release --target ${{ matrix.target }}

      - name: Create tar.gz archive
        shell: bash
        run: tar -C target/${{ matrix.target }}/release -czf ${{ matrix.asset_name }}.tar.gz ${{ matrix.artifact_name }}

      - name: Generate SHA-256 checksum
        shell: bash
        env:
          ASSET_NAME: ${{ matrix.asset_name }}
        run: |
          if command -v sha256sum >/dev/null 2>&1; then
            sha256sum "${ASSET_NAME}.tar.gz" > "${ASSET_NAME}.tar.gz.sha256"
          else
            shasum -a 256 "${ASSET_NAME}.tar.gz" > "${ASSET_NAME}.tar.gz.sha256"
          fi
          cat "${ASSET_NAME}.tar.gz.sha256"

      - name: Upload to Release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
        with:
          tag_name: v${{ needs.release.outputs.new_release_version }}
          files: |
            ${{ matrix.asset_name }}.tar.gz
            ${{ matrix.asset_name }}.tar.gz.sha256
          token: ${{ steps.generate_token.outputs.token }}