release.yml

name: Release

on:
  push:
    tags: ["v*.*.*"]
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to release (e.g. v1.2.3)"
        required: true

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

jobs:
  validate:
    name: Validate tag
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          fetch-depth: 0

      - name: Determine tag
        env:
          EVENT_NAME: ${{ github.event_name }}
          REF_NAME: ${{ github.ref_name }}
          INPUT_TAG: ${{ github.event.inputs.tag }}
        run: |
          if [ "${EVENT_NAME}" = "workflow_dispatch" ]; then
            TAG_NAME="${INPUT_TAG}"
          else
            TAG_NAME="${REF_NAME}"
          fi
          echo "TAG_NAME=${TAG_NAME}" >> "${GITHUB_ENV}"

      - name: Extract canonical version from CMakeLists.txt
        run: |
          CMAKE_VERSION=$(grep -A5 'project(' CMakeLists.txt \
            | grep -oP '\d+\.\d+\.\d+' | head -1)
          if [ -z "${CMAKE_VERSION}" ]; then
            echo "ERROR: Could not parse VERSION from CMakeLists.txt"
            exit 1
          fi
          echo "CMAKE_VERSION=${CMAKE_VERSION}" >> "${GITHUB_ENV}"

      - name: Validate tag matches canonical version
        env:
          TAG_NAME: ${{ env.TAG_NAME }}
          CMAKE_VERSION: ${{ env.CMAKE_VERSION }}
        run: |
          EXPECTED="v${CMAKE_VERSION}"
          if [ "${TAG_NAME}" != "${EXPECTED}" ]; then
            echo "ERROR: tag '${TAG_NAME}' does not match canonical version '${EXPECTED}' from CMakeLists.txt"
            exit 1
          fi
          echo "Tag ${TAG_NAME} matches canonical version ${CMAKE_VERSION}"

      - name: Check milestone for open issues
        # Block release if a milestone matching the tag (e.g. v0.1.0) still
        # has open issues. See #176.
        env:
          TAG_NAME: ${{ env.TAG_NAME }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          MILESTONE="${TAG_NAME}"
          NUMBER=$(gh api "repos/${GITHUB_REPOSITORY}/milestones?state=open" \
            --jq ".[] | select(.title == env.MILESTONE) | .number" || true)
          if [ -z "${NUMBER}" ]; then
            echo "No open milestone titled '${MILESTONE}'; skipping milestone gate."
            exit 0
          fi
          OPEN=$(gh api "repos/${GITHUB_REPOSITORY}/issues?milestone=${NUMBER}&state=open&per_page=100" --jq 'length')
          if [ "${OPEN}" -gt 0 ]; then
            echo "ERROR: milestone '${MILESTONE}' still has ${OPEN} open issue(s); blocking release."
            exit 1
          fi
          echo "Milestone '${MILESTONE}' has no open issues; proceeding."

      - name: Find previous tag
        env:
          TAG_NAME: ${{ env.TAG_NAME }}
        run: |
          PREV_TAG=$(git tag --sort=-creatordate \
            | awk -v skip="${TAG_NAME}" '$0 != skip { print; exit }')
          if [ -z "${PREV_TAG}" ]; then
            PREV_TAG=$(git rev-list --max-parents=0 HEAD)
          fi
          echo "PREV_TAG=${PREV_TAG}" >> "${GITHUB_ENV}"

      - name: Generate changelog fragment
        env:
          PREV_TAG: ${{ env.PREV_TAG }}
          TAG_NAME: ${{ env.TAG_NAME }}
        run: |
          FRAGMENT=$(bash scripts/generate-changelog.sh "${PREV_TAG}" "${TAG_NAME}")
          {
            echo "CHANGELOG_FRAGMENT<<EOF"
            echo "${FRAGMENT}"
            echo "EOF"
          } >> "${GITHUB_ENV}"

  build-release-binary:
    name: Build release binary
    runs-on: ubuntu-24.04
    needs: validate
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y ninja-build python3-pip
          pip3 install --user conan
      - name: Configure Conan
        run: conan profile detect --force
      - name: Install Conan dependencies
        run: |
          conan install . \
            --output-folder=build/release \
            --build=missing \
            --lockfile=conan.lock \
            -s build_type=Release \
            -s compiler=gcc \
            -s compiler.version=14 \
            -s compiler.libcxx=libstdc++11 \
            -s compiler.cppstd=20
      - name: Configure
        run: cmake --preset release
      - name: Build
        run: cmake --build --preset release
      - name: Test
        run: ctest --preset release
      - name: Package binary
        run: |
          strip build/release/ProjectCharybdis_cli
          mkdir -p dist
          tar czf "dist/charybdis-linux-amd64.tar.gz" \
            -C build/release ProjectCharybdis_cli
      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist
          path: dist/

  build-container:
    name: Build and push container
    runs-on: ubuntu-24.04
    needs: build-release-binary
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
      - name: Set up QEMU
        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
      - name: Log in to GHCR
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build image for Trivy scan
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          load: true
          platforms: linux/amd64
          tags: ghcr.io/${{ github.repository }}:scan-target
      - name: Scan image with Trivy
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ghcr.io/${{ github.repository }}:scan-target
          exit-code: '1'
          ignore-unfixed: true
          severity: HIGH,CRITICAL
      - name: Build and push multi-arch image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ghcr.io/${{ github.repository }}:${{ github.ref_name }}
            ghcr.io/${{ github.repository }}:latest

  publish-release:
    name: Publish GitHub Release
    runs-on: ubuntu-24.04
    needs: [build-release-binary, build-container]
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
      - name: Download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist/
      - name: Create GitHub Release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
        with:
          files: dist/*
          generate_release_notes: true
          tag_name: ${{ github.ref_name }}