release.yml

name: Create Release
on:
  push:
    branches:
      - master
      - main

permissions:
  contents: read

jobs:
  semantic-release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write
    outputs:
      release-version: ${{ steps.semantic.outputs.release-version }}
      new-release-published: ${{ steps.semantic.outputs.new-release-published }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      # Mint a GitHub App installation token for the Flanksource App so
      # semantic-release can push the release tag and create the GitHub Release.
      # The default GITHUB_TOKEN is blocked from these writes by org policy.
      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.FLANKSOURCE_APP_ID }}
          private-key: ${{ secrets.FLANKSOURCE_APP_SECRET }}

      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
        with:
          token: ${{ steps.app-token.outputs.token }}
      - uses: codfish/semantic-release-action@b621d34fabe0940f031e89b6ebfea28322892a10 # v3.5.0
        id: semantic
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

  bump-clients:
    runs-on: ubuntu-latest
    needs: [semantic-release]
    if: needs.semantic-release.outputs.new-release-published == 'true'
    strategy:
      matrix:
        repos: ["duty"]
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
        with:
          repository: flanksource/${{ matrix.repos }}
          token: ${{ secrets.FLANKBOT }}
      - name: Setup Go
        uses: buildjet/setup-go@555ce355a95ff01018ffcf8fbbd9c44654db8374 # v5.0.2
        with:
          go-version: v1.25.x
      - uses: buildjet/cache@2bbce90d3097805dadebea12a89c47be69eb1b64 # v4.0.0
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
            .bin
          key: cache-${{ hashFiles('**/go.sum') }}-${{ hashFiles('.bin/*') }}
          restore-keys: |
            cache-
      - name: Create commits
        run: |
          # Sleep to let index refresh
          sleep 60
          go get github.com/flanksource/commons@v${{ needs.semantic-release.outputs.release-version }}
          go mod tidy
          if [ -d "hack/generate-schemas" ]; then
            cd hack/generate-schemas && go mod tidy
          fi

      - name: Create Pull Request
        id: cpr
        uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e # v6.0.5
        with:
          branch: "bump-duty-auto-pr"
          commit-message: "chore: bump duty to v${{ needs.semantic-release.outputs.release-version }}"
          title: "chore: bump duty to v${{ needs.semantic-release.outputs.release-version }}"
          token: ${{ secrets.FLANKBOT }}
          labels: dependencies

      - name: Enable Pull Request Automerge
        if: steps.cpr.outputs.pull-request-operation == 'created'
        uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0
        with:
          token: ${{ secrets.FLANKBOT }}
          pull-request-number: ${{ steps.cpr.outputs.pull-request-number }}
          merge-method: squash
          repository: flanksource/${{ matrix.repos }}

  hx-binaries:
    runs-on: ${{ matrix.os }}
    needs: [semantic-release]
    if: needs.semantic-release.outputs.new-release-published == 'true'
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            goos: linux
            goarch: amd64
          - os: ubuntu-24.04-arm
            goos: linux
            goarch: arm64
          - os: macos-latest
            goos: darwin
            goarch: arm64
          - os: macos-13
            goos: darwin
            goarch: amd64
          - os: windows-latest
            goos: windows
            goarch: amd64
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

      - name: Setup Go
        uses: buildjet/setup-go@555ce355a95ff01018ffcf8fbbd9c44654db8374 # v5.0.2
        with:
          go-version: v1.25.x

      - name: Build hx
        run: make -C cmd/hx build VERSION=${{ needs.semantic-release.outputs.release-version }}

      - name: Rename binary (unix)
        if: matrix.goos != 'windows'
        run: mv cmd/hx/.bin/hx cmd/hx/.bin/hx_${{ matrix.goos }}_${{ matrix.goarch }}

      - name: Rename binary (windows)
        if: matrix.goos == 'windows'
        run: mv cmd/hx/.bin/hx.exe cmd/hx/.bin/hx_${{ matrix.goos }}_${{ matrix.goarch }}.exe

      - name: Upload artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: hx-${{ matrix.goos }}-${{ matrix.goarch }}
          path: cmd/hx/.bin/hx_*

  hx-upload-release:
    runs-on: ubuntu-latest
    needs: [semantic-release, hx-binaries]
    permissions:
      contents: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Download all artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          pattern: hx-*
          merge-multiple: true
          path: dist

      - name: Upload to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
        run: gh release upload "v${{ needs.semantic-release.outputs.release-version }}" dist/hx_* --clobber