release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: Existing tag to release, for example v0.1.0
        required: true
        type: string

permissions:
  contents: write
  packages: write

concurrency:
  group: release-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
  cancel-in-progress: false

env:
  RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
  RELEASE_REF: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}

jobs:
  verify:
    name: Release verification
    runs-on: ubuntu-latest
    timeout-minutes: 40
    steps:
      - name: Check out repository
        uses: actions/checkout@v5
        with:
          ref: ${{ env.RELEASE_REF }}

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Install Helm 3
        shell: bash
        run: |
          set -euo pipefail
          HELM_VERSION="v3.17.3"
          curl -fsSLo /tmp/helm.tgz "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
          tar -C /tmp -xzf /tmp/helm.tgz
          sudo install -m 0755 /tmp/linux-amd64/helm /usr/local/bin/helm

      - name: Install verification dependencies
        shell: bash
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install -y ripgrep

      - name: Check formatting
        shell: bash
        run: |
          set -euo pipefail
          if [[ -n "$(gofmt -l .)" ]]; then
            echo "gofmt reported unformatted files" >&2
            gofmt -l .
            exit 1
          fi

      - name: Run Go test suite
        shell: bash
        run: go test ./... -p 1

      - name: Verify docs and CI examples
        shell: bash
        run: bash scripts/verify-docs-and-ci.sh

      - name: Verify Helm chart
        shell: bash
        run: bash scripts/verify-helm-chart.sh

      - name: Verify Docker Compose smoke flow
        shell: bash
        run: bash scripts/verify-compose-e2e.sh

  build-release-assets:
    name: Build release assets
    runs-on: ubuntu-latest
    needs: verify
    timeout-minutes: 20
    steps:
      - name: Check out repository
        uses: actions/checkout@v5
        with:
          ref: ${{ env.RELEASE_REF }}

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Build archives and checksums
        shell: bash
        run: |
          set -euo pipefail

          if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.]+)?$ ]]; then
            echo "RELEASE_TAG must look like vX.Y.Z or vX.Y.Z-suffix, got: ${RELEASE_TAG}" >&2
            exit 1
          fi

          version="${RELEASE_TAG#v}"
          mkdir -p dist/bin dist/release

          targets=(
            "linux amd64"
            "linux arm64"
            "darwin amd64"
            "darwin arm64"
            "windows amd64"
          )

          for target in "${targets[@]}"; do
            read -r goos goarch <<<"$target"
            outdir="dist/bin/${goos}-${goarch}"
            mkdir -p "$outdir"

            binary_name="testimony"
            archive_base="dist/release/testimony_${version}_${goos}_${goarch}"
            if [[ "$goos" == "windows" ]]; then
              binary_name="testimony.exe"
            fi

            GOOS="$goos" GOARCH="$goarch" CGO_ENABLED=0 \
              go build -trimpath -ldflags='-s -w' -o "$outdir/$binary_name" ./cmd/testimony

            if [[ "$goos" == "windows" ]]; then
              (cd "$outdir" && zip -q "$(pwd)/../../../${archive_base}.zip" "$binary_name")
            else
              tar -C "$outdir" -czf "${archive_base}.tar.gz" "$binary_name"
            fi
          done

          (
            cd dist/release
            sha256sum * > SHA256SUMS
          )

      - name: Upload release artifacts
        uses: actions/upload-artifact@v7
        with:
          name: release-assets-${{ env.RELEASE_TAG }}
          path: dist/release/*
          if-no-files-found: error

  publish-images:
    name: Publish GHCR images
    runs-on: ubuntu-latest
    needs: verify
    timeout-minutes: 30
    steps:
      - name: Check out repository
        uses: actions/checkout@v5
        with:
          ref: ${{ env.RELEASE_REF }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Compute image tags and labels
        id: meta
        shell: bash
        run: |
          set -euo pipefail

          if [[ ! "${RELEASE_TAG}" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
            echo "Release image publication currently requires a stable semver tag like v1.2.3. Got: ${RELEASE_TAG}" >&2
            exit 1
          fi

          major="${BASH_REMATCH[1]}"
          minor="${BASH_REMATCH[2]}"
          patch="${BASH_REMATCH[3]}"
          repo="ghcr.io/${GITHUB_REPOSITORY,,}"
          version="v${major}.${minor}.${patch}"

          default_tags=$(cat <<EOF
          ${repo}:${version}
          ${repo}:v${major}.${minor}
          ${repo}:v${major}
          ${repo}:latest
          EOF
          )

          allure3_tags=$(cat <<EOF
          ${repo}:${version}-allure3
          ${repo}:v${major}.${minor}-allure3
          ${repo}:v${major}-allure3
          ${repo}:latest-allure3
          EOF
          )

          labels=$(cat <<EOF
          org.opencontainers.image.title=Testimony
          org.opencontainers.image.description=Single-binary service for publishing Allure reports without turning your CI runner into a report host.
          org.opencontainers.image.source=https://github.com/${GITHUB_REPOSITORY}
          org.opencontainers.image.url=https://github.com/${GITHUB_REPOSITORY}
          org.opencontainers.image.version=${version}
          org.opencontainers.image.revision=${GITHUB_SHA}
          EOF
          )

          {
            echo 'default_tags<<EOF'
            echo "$default_tags"
            echo 'EOF'
            echo 'allure3_tags<<EOF'
            echo "$allure3_tags"
            echo 'EOF'
            echo 'labels<<EOF'
            echo "$labels"
            echo 'EOF'
          } >> "$GITHUB_OUTPUT"

      - name: Build and push default image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Dockerfile
          push: true
          platforms: linux/amd64,linux/arm64
          provenance: false
          tags: ${{ steps.meta.outputs.default_tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Build and push Allure 3 image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Dockerfile.allure3
          push: true
          platforms: linux/amd64,linux/arm64
          provenance: false
          tags: ${{ steps.meta.outputs.allure3_tags }}
          labels: ${{ steps.meta.outputs.labels }}

  publish-release:
    name: Publish GitHub release
    runs-on: ubuntu-latest
    needs:
      - build-release-assets
      - publish-images
    timeout-minutes: 10
    steps:
      - name: Download release artifacts
        uses: actions/download-artifact@v4
        with:
          name: release-assets-${{ env.RELEASE_TAG }}
          path: dist/release

      - name: Create or update GitHub Release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          notes_file="$RUNNER_TEMP/release-notes.md"
          cat >"$notes_file" <<EOF
          ## Summary
          - Release ${RELEASE_TAG}

          ## What changed
          - Built release archives for Linux, macOS, and Windows.
          - Published multi-arch container images for the default runtime and the \`-allure3\` runtime variant.
          - Attached SHA256 checksums for the release assets.
          - Re-ran the repository verification gates in GitHub Actions before publication.

          ## Container images
          - \`ghcr.io/${GITHUB_REPOSITORY,,}:${RELEASE_TAG}\`
          - \`ghcr.io/${GITHUB_REPOSITORY,,}:${RELEASE_TAG}-allure3\`

          ## Verification
          - \`go test ./... -p 1\`
          - \`bash scripts/verify-docs-and-ci.sh\`
          - \`bash scripts/verify-helm-chart.sh\`
          - \`bash scripts/verify-compose-e2e.sh\`

          ## Breaking changes
          - None documented by the release workflow. Review the merged changes behind ${RELEASE_TAG} for upgrade notes.
          EOF

          if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            gh release upload "$RELEASE_TAG" dist/release/* --repo "$GITHUB_REPOSITORY" --clobber
            gh release edit "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --title "$RELEASE_TAG" --notes-file "$notes_file"
          else
            gh release create "$RELEASE_TAG" dist/release/* --repo "$GITHUB_REPOSITORY" --title "$RELEASE_TAG" --notes-file "$notes_file"
          fi