release.yaml

name: "Release"

on:
  release:
    types: [published]

env:
  formula: install-release.rb
  tap-owner: cssnr
  tap-repo: homebrew-tap

jobs:
  build:
    name: "Build"
    runs-on: ubuntu-latest
    timeout-minutes: 15

    permissions:
      contents: write

    steps:
      - name: "Checkout"
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: "Debug event.json"
        if: ${{ !github.event.act }}
        continue-on-error: true
        run: cat "${GITHUB_EVENT_PATH}"
      - name: "Debug CTX github"
        if: ${{ !github.event.act }}
        continue-on-error: true
        env:
          GITHUB_CTX: ${{ toJSON(github) }}
        run: echo "$GITHUB_CTX"
      - name: "Debug Environment"
        if: ${{ !github.event.act }}
        continue-on-error: true
        run: env

      # Note: app/workflow tokens can NOT write to packages with packages: write
      - name: "Docker Login"
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ vars.GHCR_USER }}
          password: ${{ secrets.GHCR_PASS }}

      - name: "Setup Buildx"
        uses: docker/setup-buildx-action@v3
        with:
          platforms: linux/amd64,linux/arm64

      - name: "Setup Go"
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: "GoReleaser"
        id: go
        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
        env:
          #GITHUB_TOKEN: ${{ steps.app.outputs.token }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean

      - name: "Debug GoReleaser"
        continue-on-error: true
        env:
          artifacts: ${{ steps.go.outputs.artifacts }}
          metadata: ${{ steps.go.outputs.metadata }}
        run: |
          echo "artifacts: ${artifacts}"
          echo "metadata: ${metadata}"

      - name: "Upload Artifact"
        uses: actions/upload-artifact@v6
        with:
          name: client
          path: dist/client

  windows:
    name: "Windows Installer"
    runs-on: windows-latest
    timeout-minutes: 15
    needs: [build]

    env:
      output: "out"

    permissions:
      contents: write

    steps:
      - name: "Checkout"
        uses: actions/checkout@v6

      - name: "Download Artifact"
        uses: actions/download-artifact@v7
        with:
          name: client
          path: dist/client

      - name: "Download PathMgr"
        uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12
        with:
          repository: Bill-Stewart/PathMgr
          fileName: PathMgr-2.0.0.zip
          out-file-path: dist/PathMgr
          extract: true
          tag: v2.0.0

      - name: "Debug Artifacts"
        run: |
          ls -Recurse dist

      - name: "Set Installer Version"
        if: ${{ github.event_name == 'release' }}
        continue-on-error: true
        run: |
          $string = "Install Release Installer"
          $file = "assets\pre-install.rtf"
          $content = Get-Content -Path $file -Raw
          $content = $content -replace $string, "$string v${{ github.ref_name }}"
          Set-Content -Path $file -Value $content -NoNewline
          Write-Output "::group::Content"
          Write-Output $content
          Write-Output "::endgroup::"

      - name: "Inno Setup"
        run: |
          echo "Building Version: ${{ github.ref_name }}"
          iscc.exe "/DMyAppVersion=${{ github.ref_name }}" installer.iss

      - name: "Debug Output"
        run: |
          ls -Recurse "${{ env.output }}"

      - name: "Upload Artifact"
        uses: actions/upload-artifact@v6
        with:
          name: installer
          path: ${{ env.output }}

      - name: "Upload Release"
        if: ${{ github.event_name == 'release' }}
        uses: cssnr/upload-release-action@v1
        with:
          globs: "${{ env.output }}/*"

  release:
    name: "Release"
    if: ${{ github.event_name == 'release' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs: [windows]

    permissions:
      contents: write

    steps:
      - name: "Download Artifact"
        if: ${{ !github.event.release.prerelease }}
        uses: actions/download-artifact@v7
        with:
          name: client
          path: dist/client

      - name: "Debug Artifacts"
        if: ${{ !github.event.release.prerelease }}
        continue-on-error: true
        run: |
          ls -lAhR dist

      - name: "Create App Token"
        if: ${{ !github.event.release.prerelease }}
        id: app
        uses: actions/create-github-app-token@v2
        with:
          app-id: 146360
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: ${{ env.tap-owner }}
          repositories: ${{ env.tap-repo }}

      - name: "Homebrew Action"
        if: ${{ !github.event.release.prerelease && env.formula != '' }}
        uses: cssnr/homebrew-action@master
        with:
          formula: ${{ env.formula }}
          message: Bump ${{ env.formula }} to ${{ github.ref_name }}
          file: dist/client/homebrew/Formula/${{ env.formula }}
          repo: ${{ env.tap-owner }}/${{ env.tap-repo }}
          token: ${{ steps.app.outputs.token }}

      #- name: "VirusTotal"
      #  uses: cssnr/virustotal-action@master
      #  continue-on-error: true
      #  with:
      #    vt_api_key: ${{ secrets.VT_API_KEY }}
      #    collapsed: true

  vt:
    name: "VirusTotal"
    runs-on: ubuntu-latest
    timeout-minutes: 15
    continue-on-error: true
    needs: [release]

    permissions:
      contents: write

    steps:
      - name: "VirusTotal"
        uses: cssnr/virustotal-action@master
        #continue-on-error: true
        with:
          vt_api_key: ${{ secrets.VT_API_KEY }}
          collapsed: true

  vhs:
    name: "VHS"
    uses: ./.github/workflows/vhs.yaml
    needs: [release]
    secrets: inherit
    with:
      publish: true

    permissions:
      contents: read

  check:
    name: "Check"
    if: ${{ always() }}
    runs-on: Ubuntu-latest
    timeout-minutes: 5
    needs: [build, windows, release, vt, vhs]

    permissions:
      contents: write

    steps:
      - name: "Alls Green"
        uses: re-actors/alls-green@release/v1
        with:
          jobs: ${{ toJSON(needs) }}
          allowed-skips: release
          allowed-failures: vt, vhs

      - name: "Cleanup Release"
        if: ${{ failure() }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo -e "\n## Cleanup Release\n\n" >> "$GITHUB_STEP_SUMMARY"
          echo -e "Deleting Release and Tag: \`${{ github.ref_name }}\`\n\n" >> "$GITHUB_STEP_SUMMARY"
          if gh release delete "${{ github.ref_name }}" --repo "${{ github.repository }}" --cleanup-tag;then
            echo -e "✅ Cleanup Success.\n" >> "$GITHUB_STEP_SUMMARY"
          else
            echo -e "⛔ Cleanup Failed!\n" >> "$GITHUB_STEP_SUMMARY"
          fi