release.yml

name: "Release KMIR"

on:
  push:
    branches:
      - release

jobs:
  draft-release:
    name: 'Draft Release'
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.make-release.outputs.version }}
    steps:
      - name: 'Check out code'
        uses: actions/checkout@v4
      - name: 'Make release'
        id: 'make-release'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -x
          VERSION=v$(cat package/version)
          gh release create "${VERSION}"                \
            --repo runtimeverification/mir-semantics    \
            --draft                                     \
            --title ${VERSION}                          \
            --target ${{ github.sha }}
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"

  release-docker:
    runs-on: [self-hosted, linux, normal]
    needs: draft-release
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: recursive
      - name: 'Setup Docker Buildx'
        uses: docker/setup-buildx-action@v3.10.0

      - name: 'Login to Docker Hub'
        uses: docker/login-action@v3.4.0
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Set Image Name
        id: set-image-name
        run: |
          echo "image-name=runtimeverificationinc/kmir" >> $GITHUB_OUTPUT
          echo "k-version=$(cat deps/k_release)" >> $GITHUB_OUTPUT
          echo "kmir-version=$(cat package/version)" >> $GITHUB_OUTPUT
          echo "short-sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Build Kmir Container
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile.kmir
          platforms: linux/amd64
          push: true
          build-args: |
            K_VERSION=${{ steps.set-image-name.outputs.k-version }}
          tags: ${{ steps.set-image-name.outputs.image-name }}:ubuntu-jammy-${{ steps.set-image-name.outputs.kmir-version }}

      - name: 'On failure, delete drafted release'
        if: failure()
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -x
          VERSION=v$(cat package/version)
          gh release delete ${VERSION}               \
            --repo runtimeverification/mir-semantics \
            --yes                                    \
            --cleanup-tag

  tag-release:
    runs-on: [ self-hosted, linux ]
    needs: [ release-docker, nix-cache, nix-binary-cache ]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: recursive
      - name: 'Configure GitHub user'
        run: |
          git config user.name devops
          git config user.email devops@runtimeverification.com
      - name: Tag Release Branch
        run: |
          git tag "v$(cat package/version)" origin/release
          git push origin "v$(cat package/version)"
      - name: 'Finalize Release'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -x
          VERSION=v$(cat package/version)
          gh release edit ${VERSION}                 \
            --repo runtimeverification/mir-semantics \
            --draft=false
      - name: 'Update dependents'
        run: |
          set -x
          VERSION=$(cat package/version)
          curl --fail                                                          \
            -X POST                                                            \
            -H "Accept: application/vnd.github+json"                           \
            -H "Authorization: Bearer ${{ secrets.JENKINS_GITHUB_PAT }}"       \
            -H "X-GitHub-Api-Version: 2022-11-28"                              \
            https://api.github.com/repos/runtimeverification/devops/dispatches \
            -d '{"event_type":"on-demand-test","client_payload":{"repo":"runtimeverification/mir-semantics","version":"'${VERSION}'"}}'

  nix-cache:
    name: 'Populate Nix Cache'
    strategy:
      matrix:
        runner: [normal, ARM64]
    runs-on: ${{ matrix.runner }}
    needs: draft-release
    steps:
      - name: 'Check out code'
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.push.head.sha }}
          fetch-depth: 0

      - name: 'Build and cache kmir'
        uses: workflow/nix-shell-action@v3
        env:
          GC_DONT_GC: 1
          CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_PUBLIC_TOKEN }}
        with:
          packages: jq
          script: |
            KMIR=$(nix build --extra-experimental-features 'nix-command flakes' .#kmir --json | jq -r '.[].outputs | to_entries[].value')
            DRV=$(nix-store --query --deriver ${KMIR})
            nix-store --query --requisites --include-outputs ${DRV} | cachix push k-framework

      - name: 'On failure, delete drafted release'
        if: failure()
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -x
          VERSION=v$(cat package/version)
          gh release delete ${VERSION}               \
            --repo runtimeverification/mir-semantics \
            --yes                                    \
            --cleanup-tag

  nix-binary-cache:
    name: 'Populate Nix Binary Cache'
    strategy:
      matrix:
        runner: [normal, ARM64]
    runs-on: ${{ matrix.runner }}
    needs: draft-release
    steps:
      - name: 'Check out code'
        uses: actions/checkout@v4

      - name: 'Publish kmir to k-framework-binary cache'
        uses: workflow/nix-shell-action@v3
        env:
          CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PRIVATE_KFB_TOKEN }}'
          GC_DONT_GC: '1'
          OWNER_REPO: '${{ github.repository }}'
          REV: '${{ github.sha }}'
        with:
          packages: jq
          script: |
            export PATH="$(nix build github:runtimeverification/kup --no-link --json | jq -r '.[].outputs | to_entries[].value')/bin:$PATH"
            kup publish k-framework-binary .#kmir --keep-days 180 || true
            kup publish k-framework-binary .#kmir.rust --keep-days 180 || true
            
            # Cachix has not been responding to 'cachix pin' requests made under the hood by kup. So we need to manually verify the push and pin.
            .github/scripts/check-cachix-pin.sh

      - name: 'On failure, delete drafted release'
        if: failure()
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -x
          VERSION=v$(cat package/version)
          gh release delete ${VERSION}               \
            --repo runtimeverification/mir-semantics \
            --yes                                    \
            --cleanup-tag