release.yml

name: Release

on:
  push:
    tags:
      - 'v[0-9]*-paseo'
  workflow_dispatch:

permissions: {}

jobs:
  set-image:
    permissions:
      contents: read
    uses: ./.github/workflows/set-image.yml

  validate-version:
    name: Validate provider-node version matches tag
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Check provider-node version matches tag
        run: |
          set -euo pipefail
          if ! [[ "${GITHUB_REF}" == refs/tags/* ]]; then
            echo "Not a tag push (ref=${GITHUB_REF}); skipping version validation."
            exit 0
          fi
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          TAG_VERSION="${TAG_VERSION%-paseo}"
          PKG_VERSION=$(awk -F'"' '/^version = / {print $2; exit}' provider-node/Cargo.toml)
          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
            echo "::error::Tag version ($TAG_VERSION) does not match provider-node/Cargo.toml version ($PKG_VERSION). Bump provider-node/Cargo.toml first, then re-tag."
            exit 1
          fi
          echo "OK: tag ${GITHUB_REF_NAME} matches provider-node version ${PKG_VERSION}"

  build-runtime:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      name: ${{ steps.config.outputs.name }}
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Runtime config
        id: config
        run: |
          {
            echo "name=web3-storage-paseo"
            echo "package=storage-paseo-runtime"
            echo "path=runtimes/web3-storage-paseo"
          } >> "$GITHUB_OUTPUT"

      - name: Build ${{ steps.config.outputs.name }} runtime
        id: srtool_build
        uses: chevdor/srtool-actions@48e9baed50ca414936dfac59d34d8b9bbe581abd # v0.9.2
        with:
          chain: ${{ steps.config.outputs.name }}
          package: ${{ steps.config.outputs.package }}
          runtime_dir: ${{ steps.config.outputs.path }}
          profile: production

      - name: Store srtool digest
        env:
          SRTOOL_JSON: ${{ steps.srtool_build.outputs.json }}
          NAME: ${{ steps.config.outputs.name }}
        run: |
          echo "$SRTOOL_JSON" | jq > "${NAME}_srtool_output.json"

      - name: Upload ${{ steps.config.outputs.name }} wasm
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ steps.config.outputs.name }}-runtime
          path: |
            ${{ steps.srtool_build.outputs.wasm_compressed }}
            ${{ steps.config.outputs.name }}_srtool_output.json

  build-provider-linux:
    runs-on: parity-large
    timeout-minutes: 60
    needs: [set-image, validate-version]
    permissions:
      contents: read
    container:
      image: ${{ needs.set-image.outputs.CI_IMAGE }}
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Rust cache
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          shared-key: release-provider-linux
          save-if: ${{ startsWith(github.ref, 'refs/tags/') }}

      - name: Build storage-provider-node (production)
        run: cargo build --profile production -p storage-provider-node --locked

      - name: Strip binary
        run: strip target/production/storage-provider-node

      - name: Assert no OpenSSL/libssl in NEEDED
        run: |
          set -euo pipefail
          NEEDED=$(objdump -p target/production/storage-provider-node | awk '/NEEDED/ {print $2}')
          echo "NEEDED libraries:"
          echo "${NEEDED}"
          if echo "${NEEDED}" | grep -qE '^(libssl|libcrypto)\.'; then
            echo "::error::storage-provider-node links against OpenSSL (${NEEDED}). The binary must not depend on libssl/libcrypto so it runs on hosts without OpenSSL 1.1 (Ubuntu 22.04+, Debian 12+). Check reqwest/native-tls features."
            exit 1
          fi

      - name: Stage and archive
        run: |
          set -euo pipefail
          TARGET=x86_64-unknown-linux-gnu
          TAG="${GITHUB_REF_NAME:-dispatch-${GITHUB_SHA:0:8}}"
          TAG="${TAG//\//-}"
          PKG="storage-provider-node-${TAG}-${TARGET}"
          mkdir -p "dist/${PKG}"
          cp target/production/storage-provider-node "dist/${PKG}/"
          cp README.md "dist/${PKG}/" 2>/dev/null || true
          tar -C dist -czf "dist/${PKG}.tar.gz" "${PKG}"
          ( cd dist && sha256sum "${PKG}.tar.gz" > "${PKG}.tar.gz.sha256" )
          ls -la dist/

      - name: Upload provider binary artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: provider-node-linux-amd64
          path: dist/storage-provider-node-*.tar.gz*

  build-provider-macos:
    runs-on: macos-14
    timeout-minutes: 60
    needs: [validate-version]
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Load common environment variables via env file
        run: cat .github/env >> "$GITHUB_ENV"

      - name: Install Rust ${{ env.RUST_STABLE_VERSION }}
        run: |
          rustup toolchain install "${RUST_STABLE_VERSION}" --profile minimal --target aarch64-apple-darwin
          rustup default "${RUST_STABLE_VERSION}"
          rustc --version

      - name: Rust cache
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          shared-key: release-provider-macos
          save-if: ${{ startsWith(github.ref, 'refs/tags/') }}

      - name: Build storage-provider-node (production, aarch64-apple-darwin)
        run: cargo build --profile production -p storage-provider-node --locked --target aarch64-apple-darwin

      - name: Strip binary
        run: strip -x target/aarch64-apple-darwin/production/storage-provider-node

      - name: Stage and archive
        run: |
          set -euo pipefail
          TARGET=aarch64-apple-darwin
          TAG="${GITHUB_REF_NAME:-dispatch-${GITHUB_SHA:0:8}}"
          TAG="${TAG//\//-}"
          PKG="storage-provider-node-${TAG}-${TARGET}"
          mkdir -p "dist/${PKG}"
          cp "target/${TARGET}/production/storage-provider-node" "dist/${PKG}/"
          cp README.md "dist/${PKG}/" 2>/dev/null || true
          tar -C dist -czf "dist/${PKG}.tar.gz" "${PKG}"
          ( cd dist && shasum -a 256 "${PKG}.tar.gz" > "${PKG}.tar.gz.sha256" )
          ls -la dist/

      - name: Upload provider binary artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: provider-node-macos-arm64
          path: dist/storage-provider-node-*.tar.gz*

  publish-release:
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    permissions:
      contents: write
    needs: [build-runtime, build-provider-linux, build-provider-macos]
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Download all artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: artifacts

      - name: Prepare release assets
        run: |
          mkdir -p release-assets
          find artifacts -name "*.wasm" -exec cp {} release-assets/ \;
          find artifacts -name "storage-provider-node-*.tar.gz*" -exec cp {} release-assets/ \;
          ls -la release-assets/

      - name: Add runtime info to changelog
        run: |
          CONTEXT=$(find . -name '*_srtool_output.json')
          SRTOOL() { <$(<<<$CONTEXT head -n1) jq -r .$1; }
          WASM() { <${JSON} jq -r ".runtimes.compressed.subwasm.$1"; }

          tee RELEASE_NOTES.md <<-EOF
          # Runtime info
          *These runtimes were built with **$(SRTOOL rustc)** using **[$(SRTOOL gen)](https://github.com/paritytech/srtool)***
          EOF

          for JSON in $(<<<$CONTEXT sort -sr)
          do
          RUNTIME_NAME=$(basename ${JSON} _srtool_output.json)
          tee -a RELEASE_NOTES.md <<-EOF

          ## ${RUNTIME_NAME}
          ~~~
          🏋️ Runtime Size:           $(numfmt --to iec-i --format "%.2f" $(WASM size)) ($(WASM size) bytes)
          🗜 Compressed:             $(WASM 'compression | if .compressed then "Yes: \(1 - .size_compressed / .size_decompressed | . * 10000 | round / 100)%" else "No" end')
          🔥 Core Version:           $(WASM 'core_version | "\(.specName)-\(.specVersion) \(.implName)-\(.implVersion).tx\(.transactionVersion).au\(.authoringVersion)"')
          🎁 Metadata version:       V$(WASM metadata_version)
          🗳️ Blake2-256 hash:        $(WASM blake2_256)
          📦 IPFS:                   $(WASM ipfs_hash)
          ~~~
          EOF
          done

          {
            echo
            echo "## Provider node binaries"
            echo
            echo "| Target | sha256 |"
            echo "|---|---|"
            for SUM in release-assets/storage-provider-node-*.tar.gz.sha256; do
              [ -f "$SUM" ] || continue
              ARCHIVE=$(basename "$SUM" .sha256)
              HASH=$(awk '{print $1}' "$SUM")
              echo "| \`${ARCHIVE}\` | \`${HASH}\` |"
            done
          } >> RELEASE_NOTES.md

          cat RELEASE_NOTES.md

      # Use the runner's preinstalled gh CLI rather than a third-party action;
      # the job already holds contents: write. Tag defaults to github.ref_name.
      - name: Create release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
          RELEASE_NAME: ${{ needs.build-runtime.outputs.name }} ${{ github.ref_name }}
        run: |
          gh release create "$TAG" \
            --title "$RELEASE_NAME" \
            --notes-file RELEASE_NOTES.md \
            release-assets/*.wasm \
            release-assets/storage-provider-node-*.tar.gz \
            release-assets/storage-provider-node-*.tar.gz.sha256