release.yml

name: Release

on:
  push:
    tags: ['v*']

env:
  CARGO_TERM_COLOR: always

jobs:
  # Validate that the tag matches the version in Cargo.toml
  validate-version:
    name: Validate Version
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Extract version from tag
        id: tag
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Extract version from Cargo.toml
        id: cargo
        run: |
          version=$(grep -m1 'version = "' Cargo.toml | sed 's/.*version = "\([^"]*\)".*/\1/')
          echo "version=$version" >> $GITHUB_OUTPUT

      - name: Check version match
        run: |
          if [ "${{ steps.tag.outputs.version }}" != "${{ steps.cargo.outputs.version }}" ]; then
            echo "::error::Tag version (${{ steps.tag.outputs.version }}) does not match Cargo.toml version (${{ steps.cargo.outputs.version }})"
            exit 1
          fi
          echo "Version validated: ${{ steps.tag.outputs.version }}"

  # Validate that CHANGELOG.md has an entry for this version
  validate-changelog:
    name: Validate Changelog
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Extract version from tag
        id: tag
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Check changelog entry
        run: |
          if ! grep -q "## \[${{ steps.tag.outputs.version }}\]" CHANGELOG.md; then
            echo "::error::CHANGELOG.md does not contain an entry for version ${{ steps.tag.outputs.version }}"
            echo "Expected to find: ## [${{ steps.tag.outputs.version }}]"
            exit 1
          fi
          echo "Changelog entry found for version ${{ steps.tag.outputs.version }}"

  # Build binaries for all supported platforms
  build-binaries:
    name: Build ${{ matrix.target }}
    needs: [validate-version, validate-changelog]
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux GNU targets
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            cross: false
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            cross: true
          # Linux musl targets (static linking, requires cross for aws-lc-rs)
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            cross: true
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
            cross: true
          # macOS targets
          - target: x86_64-apple-darwin
            os: macos-14
            cross: false
          - target: aarch64-apple-darwin
            os: macos-14
            cross: false
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install cross
        if: matrix.cross
        run: cargo install cross --git https://github.com/cross-rs/cross

      - name: Build data plane with cargo
        if: ${{ !matrix.cross }}
        run: cargo build --release --target ${{ matrix.target }} --package barbacane

      - name: Build control plane with cargo
        if: ${{ !matrix.cross }}
        run: cargo build --release --target ${{ matrix.target }} --package barbacane-control

      - name: Build data plane with cross
        if: matrix.cross
        run: cross build --release --target ${{ matrix.target }} --package barbacane

      - name: Build control plane with cross
        if: matrix.cross
        run: cross build --release --target ${{ matrix.target }} --package barbacane-control

      - name: Prepare artifacts
        run: |
          mkdir -p dist
          cp target/${{ matrix.target }}/release/barbacane dist/barbacane-${{ matrix.target }}
          cp target/${{ matrix.target }}/release/barbacane-control dist/barbacane-control-${{ matrix.target }}

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: binaries-${{ matrix.target }}
          path: dist/
          retention-days: 1

  # Build container images per architecture using native runners
  build-containers:
    name: Build Containers (${{ matrix.platform }})
    needs: [validate-version, validate-changelog]
    strategy:
      matrix:
        include:
          - platform: linux/amd64
            os: ubuntu-latest
            suffix: amd64
          - platform: linux/arm64
            os: ubuntu-24.04-arm  # Native ARM64 Linux runner
            suffix: arm64
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6

      - name: Extract version from tag
        id: tag
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push data plane
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Dockerfile
          push: true
          platforms: ${{ matrix.platform }}
          tags: |
            ghcr.io/${{ github.repository_owner }}/barbacane:${{ steps.tag.outputs.version }}-${{ matrix.suffix }}
            docker.io/barbacane/barbacane:${{ steps.tag.outputs.version }}-${{ matrix.suffix }}
          cache-from: type=gha,scope=barbacane-${{ matrix.suffix }}
          cache-to: type=gha,mode=max,scope=barbacane-${{ matrix.suffix }}

      - name: Build and push control plane
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Dockerfile.control
          push: true
          platforms: ${{ matrix.platform }}
          tags: |
            ghcr.io/${{ github.repository_owner }}/barbacane-control:${{ steps.tag.outputs.version }}-${{ matrix.suffix }}
            docker.io/barbacane/barbacane-control:${{ steps.tag.outputs.version }}-${{ matrix.suffix }}
          cache-from: type=gha,scope=barbacane-control-${{ matrix.suffix }}
          cache-to: type=gha,mode=max,scope=barbacane-control-${{ matrix.suffix }}

      - name: Build and push standalone
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Dockerfile.standalone
          push: true
          platforms: ${{ matrix.platform }}
          tags: |
            ghcr.io/${{ github.repository_owner }}/barbacane-standalone:${{ steps.tag.outputs.version }}-${{ matrix.suffix }}
            docker.io/barbacane/barbacane-standalone:${{ steps.tag.outputs.version }}-${{ matrix.suffix }}
          cache-from: type=gha,scope=barbacane-standalone-${{ matrix.suffix }}
          cache-to: type=gha,mode=max,scope=barbacane-standalone-${{ matrix.suffix }}

  # Create multi-arch manifests combining platform-specific images
  create-manifests:
    name: Create Multi-arch Manifests
    needs: [validate-version, build-containers]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Extract version from tag
        id: tag
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Extract version components
        id: version
        run: |
          VERSION=${{ steps.tag.outputs.version }}
          MAJOR=$(echo $VERSION | cut -d. -f1)
          MINOR=$(echo $VERSION | cut -d. -f1-2)
          echo "major=$MAJOR" >> $GITHUB_OUTPUT
          echo "minor=$MINOR" >> $GITHUB_OUTPUT

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Create GHCR data plane manifest
        run: |
          VERSION=${{ steps.tag.outputs.version }}
          docker buildx imagetools create -t ghcr.io/${{ github.repository_owner }}/barbacane:latest \
            -t ghcr.io/${{ github.repository_owner }}/barbacane:$VERSION \
            -t ghcr.io/${{ github.repository_owner }}/barbacane:${{ steps.version.outputs.minor }} \
            -t ghcr.io/${{ github.repository_owner }}/barbacane:${{ steps.version.outputs.major }} \
            ghcr.io/${{ github.repository_owner }}/barbacane:$VERSION-amd64 \
            ghcr.io/${{ github.repository_owner }}/barbacane:$VERSION-arm64

      - name: Create GHCR control plane manifest
        run: |
          VERSION=${{ steps.tag.outputs.version }}
          docker buildx imagetools create -t ghcr.io/${{ github.repository_owner }}/barbacane-control:latest \
            -t ghcr.io/${{ github.repository_owner }}/barbacane-control:$VERSION \
            -t ghcr.io/${{ github.repository_owner }}/barbacane-control:${{ steps.version.outputs.minor }} \
            -t ghcr.io/${{ github.repository_owner }}/barbacane-control:${{ steps.version.outputs.major }} \
            ghcr.io/${{ github.repository_owner }}/barbacane-control:$VERSION-amd64 \
            ghcr.io/${{ github.repository_owner }}/barbacane-control:$VERSION-arm64

      - name: Create Docker Hub data plane manifest
        run: |
          VERSION=${{ steps.tag.outputs.version }}
          docker buildx imagetools create -t docker.io/barbacane/barbacane:latest \
            -t docker.io/barbacane/barbacane:$VERSION \
            -t docker.io/barbacane/barbacane:${{ steps.version.outputs.minor }} \
            -t docker.io/barbacane/barbacane:${{ steps.version.outputs.major }} \
            docker.io/barbacane/barbacane:$VERSION-amd64 \
            docker.io/barbacane/barbacane:$VERSION-arm64

      - name: Create Docker Hub control plane manifest
        run: |
          VERSION=${{ steps.tag.outputs.version }}
          docker buildx imagetools create -t docker.io/barbacane/barbacane-control:latest \
            -t docker.io/barbacane/barbacane-control:$VERSION \
            -t docker.io/barbacane/barbacane-control:${{ steps.version.outputs.minor }} \
            -t docker.io/barbacane/barbacane-control:${{ steps.version.outputs.major }} \
            docker.io/barbacane/barbacane-control:$VERSION-amd64 \
            docker.io/barbacane/barbacane-control:$VERSION-arm64

      - name: Create GHCR standalone manifest
        run: |
          VERSION=${{ steps.tag.outputs.version }}
          docker buildx imagetools create -t ghcr.io/${{ github.repository_owner }}/barbacane-standalone:latest \
            -t ghcr.io/${{ github.repository_owner }}/barbacane-standalone:$VERSION \
            -t ghcr.io/${{ github.repository_owner }}/barbacane-standalone:${{ steps.version.outputs.minor }} \
            -t ghcr.io/${{ github.repository_owner }}/barbacane-standalone:${{ steps.version.outputs.major }} \
            ghcr.io/${{ github.repository_owner }}/barbacane-standalone:$VERSION-amd64 \
            ghcr.io/${{ github.repository_owner }}/barbacane-standalone:$VERSION-arm64

      - name: Create Docker Hub standalone manifest
        run: |
          VERSION=${{ steps.tag.outputs.version }}
          docker buildx imagetools create -t docker.io/barbacane/barbacane-standalone:latest \
            -t docker.io/barbacane/barbacane-standalone:$VERSION \
            -t docker.io/barbacane/barbacane-standalone:${{ steps.version.outputs.minor }} \
            -t docker.io/barbacane/barbacane-standalone:${{ steps.version.outputs.major }} \
            docker.io/barbacane/barbacane-standalone:$VERSION-amd64 \
            docker.io/barbacane/barbacane-standalone:$VERSION-arm64

  # Security scan the multi-arch images
  scan-containers:
    name: Scan Containers
    needs: [validate-version, create-manifests]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
      security-events: write
    steps:
      - uses: actions/checkout@v6

      - name: Extract version from tag
        id: tag
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Security scan images
      - name: Scan data plane image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ghcr.io/${{ github.repository_owner }}/barbacane:${{ steps.tag.outputs.version }}
          format: 'sarif'
          output: 'trivy-data-plane.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Scan control plane image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ghcr.io/${{ github.repository_owner }}/barbacane-control:${{ steps.tag.outputs.version }}
          format: 'sarif'
          output: 'trivy-control-plane.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload data plane scan results
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: 'trivy-data-plane.sarif'
          category: 'trivy-data-plane'

      - name: Upload control plane scan results
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: 'trivy-control-plane.sarif'
          category: 'trivy-control-plane'

      - name: Scan standalone image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ghcr.io/${{ github.repository_owner }}/barbacane-standalone:${{ steps.tag.outputs.version }}
          format: 'sarif'
          output: 'trivy-standalone.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload standalone scan results
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: 'trivy-standalone.sarif'
          category: 'trivy-standalone'

  # Publish crates to crates.io
  publish-crates:
    name: Publish Crates
    needs: [validate-version, validate-changelog]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      # Publish in dependency order (leaves first, roots last)
      # Wait between publishes for crates.io index to update
      # Track failures to report at the end
      - name: Publish all crates
        id: publish
        run: |
          FAILED=""
          SKIPPED=""
          SUCCESS=""

          publish_crate() {
            local crate=$1
            echo "::group::Publishing $crate"

            # Capture output and exit code
            set +e
            OUTPUT=$(cargo publish -p "$crate" --token ${{ secrets.CARGO_REGISTRY_TOKEN }} 2>&1)
            EXIT_CODE=$?
            set -e

            echo "$OUTPUT"

            if [ $EXIT_CODE -eq 0 ]; then
              echo "✓ $crate published successfully"
              SUCCESS="$SUCCESS $crate"
            elif echo "$OUTPUT" | grep -qE "already uploaded|already exists"; then
              echo "⊘ $crate already published, skipping"
              SKIPPED="$SKIPPED $crate"
            else
              echo "✗ $crate failed to publish"
              FAILED="$FAILED $crate"
            fi

            echo "::endgroup::"

            # Wait for crates.io index to update and avoid rate limits
            # New crate names have stricter limits than version updates
            sleep 60
          }

          # Publish in dependency order
          publish_crate "barbacane-plugin-macros"
          publish_crate "barbacane-plugin-sdk"
          publish_crate "barbacane-telemetry"
          publish_crate "barbacane-wasm"
          publish_crate "barbacane-compiler"
          publish_crate "barbacane"
          publish_crate "barbacane-control"

          # Summary
          echo ""
          echo "=========================================="
          echo "Publish Summary"
          echo "=========================================="

          if [ -n "$SUCCESS" ]; then
            echo "✓ Published:$SUCCESS"
          fi

          if [ -n "$SKIPPED" ]; then
            echo "⊘ Already published:$SKIPPED"
          fi

          if [ -n "$FAILED" ]; then
            echo "✗ Failed:$FAILED"
            echo ""
            echo "::error::Some crates failed to publish:$FAILED"
            exit 1
          fi

          echo ""
          echo "All crates published successfully!"

  # Build WASM plugins and collect artifacts for release
  build-plugins:
    name: Build Plugins
    needs: [validate-version, validate-changelog]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown

      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-cargo-plugins-${{ hashFiles('plugins/**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-plugins-

      - name: Build all plugins
        run: |
          mkdir -p dist/plugins
          for plugin_dir in plugins/*/; do
            if [ -f "$plugin_dir/Cargo.toml" ]; then
              name=$(basename "$plugin_dir")
              echo "::group::Building $name"
              (cd "$plugin_dir" && cargo build --release --target wasm32-unknown-unknown)

              # Find the .wasm output (exclude deps)
              wasm_file=$(ls "$plugin_dir/target/wasm32-unknown-unknown/release/"*.wasm 2>/dev/null | grep -v deps | head -1)
              if [ -n "$wasm_file" ]; then
                cp "$wasm_file" "dist/plugins/$name.wasm"
                echo "  -> $name.wasm ($(du -h "dist/plugins/$name.wasm" | cut -f1))"
              else
                echo "::warning::No .wasm output found for $name"
              fi

              # Copy plugin.toml if present
              if [ -f "$plugin_dir/plugin.toml" ]; then
                cp "$plugin_dir/plugin.toml" "dist/plugins/$name.plugin.toml"
              fi

              echo "::endgroup::"
            fi
          done

      - name: Generate plugin checksums
        run: |
          cd dist/plugins
          sha256sum *.wasm > plugin-checksums.txt
          cat plugin-checksums.txt

      - name: Upload plugin artifacts
        uses: actions/upload-artifact@v7
        with:
          name: plugins
          path: dist/plugins/
          retention-days: 1

  # Create GitHub Release with all artifacts
  create-release:
    name: Create Release
    needs: [build-binaries, build-plugins, create-manifests, scan-containers, publish-crates]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6

      - name: Extract version from tag
        id: tag
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Download binary artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts/binaries
          pattern: binaries-*
          merge-multiple: true

      - name: Download plugin artifacts
        uses: actions/download-artifact@v8
        with:
          name: plugins
          path: artifacts/plugins

      - name: Prepare release artifacts
        run: |
          mkdir -p artifacts/release

          # Binaries
          cp artifacts/binaries/* artifacts/release/

          # Plugins (.wasm and .plugin.toml files)
          cp artifacts/plugins/*.wasm artifacts/release/
          cp artifacts/plugins/*.plugin.toml artifacts/release/
          cp artifacts/plugins/plugin-checksums.txt artifacts/release/

      - name: Generate checksums
        run: |
          cd artifacts/release
          # Checksums for binaries (plugins have their own file)
          binaries=$(ls barbacane-* barbacane-control-* 2>/dev/null || true)
          if [ -n "$binaries" ]; then
            sha256sum $binaries > checksums.txt
            cat checksums.txt
          else
            echo "::warning::No binary files found for checksums"
          fi

      - name: Extract release notes from changelog
        id: changelog
        run: |
          # Extract the section for this version from CHANGELOG.md
          VERSION=${{ steps.tag.outputs.version }}
          awk "/^## \[$VERSION\]/,/^## \[/{if(/^## \[/ && !/^## \[$VERSION\]/)exit; print}" CHANGELOG.md > release-notes.md
          # Remove the header line
          tail -n +2 release-notes.md > release-notes-trimmed.md
          mv release-notes-trimmed.md release-notes.md
          echo "Release notes:"
          cat release-notes.md

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          name: Barbacane v${{ steps.tag.outputs.version }}
          body_path: release-notes.md
          files: |
            artifacts/release/*
          draft: false
          prerelease: ${{ contains(steps.tag.outputs.version, '-') }}