release.yml

name: release

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to release (e.g. 0.1.0)"
        required: true

permissions:
  contents: write
  issues: read
  packages: write
  pull-requests: read

jobs:
  prepare:
    name: Prepare ${{ inputs.version }}
    runs-on: ubuntu-latest

    steps:
    - name: Restrict workflow to maintainers/admins
      uses: skjnldsv/check-actor-permission@v3.0
      with:
        require: admin

    - name: Cache Homebrew
      uses: actions/cache@v5
      with:
        path: /home/linuxbrew/.linuxbrew
        key: ${{ runner.os }}-homebrew

    - name: Install Homebrew
      run: |
        if ! command -v brew >/dev/null 2>&1; then
          NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
        fi

        eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
        brew --version

    - name: Install git-flow AVH
      run: |
        git clone https://github.com/petervanderdoes/gitflow-avh.git
        cd gitflow-avh
        sudo make install

    - name: Configure git credentials
      run: |
        git config --global user.name "github-actions[bot]"
        git config --global user.email "github-actions[bot]@users.noreply.github.com"
        git config --global credential.helper store
        echo "https://x-access-token:${{ secrets.GITFLOW_RELEASES_TOKEN }}@github.com" > ~/.git-credentials

    - name: Checkout sources on develop
      uses: actions/checkout@v6
      with:
        ref: develop
        fetch-depth: 0
        persist-credentials: false

    - name: Initialize GitFlow
      run: |
        eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
        git fetch origin main
        git branch main origin/main
        git flow init -df

    - name: Start GitFlow release
      run: |
        eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
        git flow release start ${{ inputs.version }}

    - name: Setup JDK
      uses: actions/setup-java@v5
      with:
        java-version: 25
        distribution: zulu

    - name: Update POM versions on release branch
      run: |
        ./mvnw versions:set -DgenerateBackupPoms=false -DnewVersion=${{ inputs.version }}

    - name: Generate CHANGELOG on release branch
      uses: janheinrichmerker/action-github-changelog-generator@v2.4
      with:
        token: ${{ secrets.GITHUB_TOKEN }}

    - name: Commit POM versions and CHANGELOG on release branch
      run: git commit -a -m "Prepare release ${{ inputs.version }}"

    - name: No-merge release branch into develop branch
      run: |
        git config merge.ours.driver true
        git fetch origin develop
        git checkout develop
        git merge -s ours release/${{ inputs.version }} \
            -m "No-merge release ${{ inputs.version }} into develop"

    - name: Push changes to develop and release branch
      run: |
        git push origin develop release/${{ inputs.version }}

  deploy:
    name: Deploy ${{ inputs.version }}
    runs-on: ubuntu-latest
    needs: prepare

    steps:
    - name: Checkout GitHub sources
      uses: actions/checkout@v6
      with:
        ref: release/${{ inputs.version }}
        fetch-depth: 0

    - name: Setup JDK
      uses: actions/setup-java@v5
      with:
        java-version: 25
        distribution: zulu
        server-id: github
        server-username: GITHUB_ACTOR
        server-password: GITHUB_TOKEN

    - name: Create Maven cache key input
      run: |
        find . -name pom.xml -print0 \
          | sort -z \
          | xargs -0 sed -E '0,/<version>[^<]+<\/version>/s//<version>IGNORED<\/version>/' \
          > .maven-cache-key

    - name: Cache Maven packages
      uses: actions/cache@v5
      with:
        path: ~/.m2
        key: ${{ runner.os }}-m2-${{ hashFiles('.maven-cache-key') }}
        restore-keys: ${{ runner.os }}-m2-

    - name: Log in to GitHub Container Registry
      uses: docker/login-action@v4
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Determine docker tag
      id: tag
      run: |
        VERSION="${{ github.event.inputs.version }}"
        if [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
          TAG="latest"
        else
          TAG=""
        fi
        echo "latest=$TAG" >> $GITHUB_OUTPUT

    - name: Deploy via Maven
      run: |
        ./mvnw -B -U -nsu -ntp clean deploy -Drelease -Ddocker.latest.tag=${{ steps.tag.outputs.latest }}
      env:
        GITHUB_ACTOR: ${{ github.actor }}
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Uncache Maven project release artifacts
      if: always()
      run: |
        GROUP_ID=`./mvnw help:evaluate -Dexpression=project.groupId -q -DforceStdout`
        rm -fr ~/.m2/repository/$(echo $GROUP_ID | tr . /)
      env:
        GITHUB_ACTOR: ${{ github.actor }}
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Setup buildx to publish multi-arch images
      run: docker buildx create --driver docker-container --name release --use

    - name: Extract docker build contexts
      run: |
        find cloud/docker-image/target/docker -name docker-build.tar -print0 | while IFS= read -r -d '' tar; do
          ctx="${tar%.tar}"
          rm -rf "$ctx" && mkdir -p "$ctx"
          tar -xf "$tar" -C "$ctx"
        done

    - name: Publish zilla image to GitHub Container Registry
      uses: docker/build-push-action@v6
      with:
        context: cloud/docker-image/target/docker/ghcr.io/aklivity/zilla/${{ inputs.version }}/tmp/docker-build
        platforms: linux/amd64,linux/arm64
        push: true
        provenance: false
        tags: |
          ghcr.io/aklivity/zilla:${{ inputs.version }}
          ${{ steps.tag.outputs.latest && format('ghcr.io/aklivity/zilla:{0}', steps.tag.outputs.latest) || '' }}

    - name: Publish zilla-alpine image to GitHub Container Registry
      uses: docker/build-push-action@v6
      with:
        context: cloud/docker-image/target/docker/ghcr.io/aklivity/zilla/${{ inputs.version }}-alpine/tmp/docker-build
        file: cloud/docker-image/target/docker/ghcr.io/aklivity/zilla/${{ inputs.version }}-alpine/tmp/docker-build/alpine.Dockerfile
        platforms: linux/amd64
        push: true
        provenance: false
        tags: |
          ghcr.io/aklivity/zilla:${{ inputs.version }}-alpine
          ${{ steps.tag.outputs.latest && 'ghcr.io/aklivity/zilla:alpine' || '' }}

    - name: Setup helm
      uses: azure/setup-helm@v4

    - name: Publish zilla chart to GitHub Container Registry
      run: |
        helm push cloud/helm-chart/target/helm/repo/zilla-${{ inputs.version }}.tgz oci://ghcr.io/aklivity/charts

  finalize:
    name: Finalize ${{ inputs.version }}
    runs-on: ubuntu-latest
    needs: deploy

    steps:
    - name: Cache Homebrew
      uses: actions/cache@v5
      with:
        path: /home/linuxbrew/.linuxbrew
        key: ${{ runner.os }}-homebrew

    - name: Install Homebrew
      run: |
        if ! command -v brew >/dev/null 2>&1; then
          NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
        fi

        eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
        brew --version

    - name: Install git-flow AVH
      run: |
        git clone https://github.com/petervanderdoes/gitflow-avh.git
        cd gitflow-avh
        sudo make install

    - name: Configure git credentials
      run: |
        git config --global user.name "github-actions[bot]"
        git config --global user.email "github-actions[bot]@users.noreply.github.com"
        git config --global credential.helper store
        echo "https://x-access-token:${{ secrets.GITFLOW_RELEASES_TOKEN }}@github.com" > ~/.git-credentials

    - name: Checkout GitHub sources on release branch
      uses: actions/checkout@v6
      with:
        ref: release/${{ inputs.version }}
        fetch-depth: 0
        persist-credentials: false

    - name: Initialize GitFlow
      run: |
        eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
        git fetch origin main
        git branch main origin/main
        git fetch origin develop
        git branch develop origin/develop
        git flow init -df

    - name: Finish release
      run: |
        eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
        git flow release finish -p ${{ inputs.version }} -m "${{ inputs.version }}"

    - name: Generate CHANGELOG on develop
      uses: janheinrichmerker/action-github-changelog-generator@v2.4
      with:
        token: ${{ secrets.GITHUB_TOKEN }}

    - name: Commit CHANGELOG on develop branch (if needed)
      run: git diff --quiet && git diff --cached --quiet || git commit -a -m "Update CHANGELOG.md"

    - name: Push CHANGELOG commit to develop
      run: git push origin develop