release.yaml

name: Release
on:
  push:
    branches:
      - main
    tags:
      - "v*.*.*"

env:
  TMP_LOCAL_IMAGE: localhost:5000/exein-io/pulsar
  REGISTRY_IMAGE: ghcr.io/exein-io/pulsar
  REGISTRY_TAG: ${{ github.ref_type == 'tag' && github.ref_name || 'dev' }}

jobs:
  vendored_archive:
    name: Create vendored archive
    runs-on: ubuntu-latest
    steps:
      - name: Code checkout
        uses: actions/checkout@v4

      - name: Create release directory
        run: rsync -rv --exclude=.git . ../pulsar-${{ env.REGISTRY_TAG }}

      - name: Cargo vendor
        working-directory: ../pulsar-${{ env.REGISTRY_TAG }}
        run: |
          mkdir ../vendor-cargo-home
          export CARGO_HOME=$(realpath ../vendor-cargo-home)
          mkdir -p .cargo
          cargo vendor >> .cargo/config.toml

      - name: Create vendored source archive
        working-directory: ../
        id: create-archive
        run: |
          tar cJf pulsar-vendored-${{ env.REGISTRY_TAG }}.tar.xz pulsar-${{ env.REGISTRY_TAG }}
          echo "archive_file_name=$(realpath ./pulsar-vendored-${{ env.REGISTRY_TAG }}.tar.xz)" >> $GITHUB_OUTPUT

      # Note this artifact name is unique and does NOT conflict with build job artifact names
      - name: Upload vendored archive
        uses: actions/upload-artifact@v4
        with:
          name: vendored-archive-${{ env.REGISTRY_TAG }}
          path: ${{ steps.create-archive.outputs.archive_file_name }}
          if-no-files-found: error
          retention-days: 1

  build:
    name: Create binary
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        platform:
          - target: x86_64-unknown-linux-gnu
            args: "--features full --features openssl-vendored"
            docker:
              base-image: debian:bookworm
              platform: linux/amd64

          - target: x86_64-unknown-linux-musl
            args: "--no-default-features --features full --features all-vendored --features tls-rustls"

          - target: aarch64-unknown-linux-gnu
            args: "--features full --features openssl-vendored"
            docker:
              base-image: debian:bookworm
              platform: linux/arm64

          - target: aarch64-unknown-linux-musl
            args: "--no-default-features --features full --features all-vendored --features tls-rustls"

          - target: riscv64gc-unknown-linux-gnu
            args: "--features full --features openssl-vendored"
            docker:
              base-image: debian:sid
              platform: linux/riscv64

    steps:
      - name: Code checkout
        uses: actions/checkout@v4

      - name: Install Rust toolchain (stable)
        uses: dtolnay/rust-toolchain@stable
        with:
          target: ${{ matrix.platform.target }}

      - name: Install cross
        uses: ./.github/actions/install-cross

      - name: Build Release
        run: cross build --locked --target=${{ matrix.platform.target }} --bin pulsar-exec ${{ matrix.platform.args }} --release

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        if: ${{ matrix.platform.docker != null }}

      - name: Prepare Docker image directory
        if: ${{ matrix.platform.docker != null }}
        run: |
          mkdir -p /tmp/images
          platform=${{ matrix.platform.target }}
          echo "TARFILE=${platform//\//-}.tar" >> $GITHUB_ENV
          echo "TAG=${{ env.TMP_LOCAL_IMAGE }}:${platform//\//-}" >> $GITHUB_ENV

      - name: Create Docker image
        uses: docker/build-push-action@v5
        if: ${{ matrix.platform.docker != null }}
        with:
          context: "."
          file: .github/docker/Dockerfile
          build-args: |
            BASE_IMAGE=${{ matrix.platform.docker.base-image }}
            ARCH=${{ matrix.platform.target }}
          platforms: ${{ matrix.platform.docker.platform }}
          tags: ${{ env.TAG }}
          outputs: type=docker,dest=/tmp/images/${{ env.TARFILE }}

      # We include the target in the artifact name to avoid collisions in parallel
      - name: Upload Docker image
        if: ${{ matrix.platform.docker != null }}
        uses: actions/upload-artifact@v4
        with:
          name: images-${{ env.REGISTRY_TAG }}-${{ matrix.platform.target }}
          path: /tmp/images/${{ env.TARFILE }}
          if-no-files-found: error
          retention-days: 1

      - name: Rename binary
        shell: bash
        id: rename_binary
        run: |
          IFS='-' read -a arch <<< ${{ matrix.platform.target }}
          suffix=""
          if [[ "${{ matrix.platform.target }}" == *"musl"* ]]; then suffix="-static"; fi
          binary_name=./target/${{ matrix.platform.target }}/release/pulsar-exec-${arch}${suffix}
          mv ./target/${{ matrix.platform.target }}/release/pulsar-exec ${binary_name}
          echo "binary_name=${binary_name}" >> $GITHUB_OUTPUT

      # Again, ensure artifact names are unique per target
      - name: Upload binary
        uses: actions/upload-artifact@v4
        with:
          name: binaries-${{ env.REGISTRY_TAG }}-${{ matrix.platform.target }}
          path: ${{ steps.rename_binary.outputs.binary_name }}
          if-no-files-found: error
          retention-days: 1

  create-release:
    name: Create release
    runs-on: ubuntu-latest
    needs:
      - vendored_archive
      - build
    steps:
      # We ONLY want the binaries (all targets) and vendored archive, so we do:
      - name: Download binaries
        uses: actions/download-artifact@v3
        with:
          # This matches all binary artifacts from every matrix job
          name: "binaries-${{ env.REGISTRY_TAG }}-*"
          path: /tmp/binaries

      - name: Download vendored archive
        uses: actions/download-artifact@v3
        with:
          # Single vendored artifact name
          name: "vendored-archive-${{ env.REGISTRY_TAG }}"
          path: /tmp/vendored

      - name: Code checkout
        uses: actions/checkout@v4

      - name: Create installer
        run: |
          installer_blueprint=.github/release-assets/pulsar-install.sh
          sed "s/^PULSAR_VERSION=$/PULSAR_VERSION=${{ env.REGISTRY_TAG }}/" "$installer_blueprint" > /tmp/pulsar-install.sh

      - name: Check dev release and tag existence
        if: github.ref_type == 'branch'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          export GH_PAGER=
          git push origin :refs/tags/dev
          if gh release view dev > /dev/null 2>&1; then
            gh release delete dev -y
          fi

      - name: Dev release
        if: github.ref_type == 'branch'
        uses: ncipollo/release-action@v1
        with:
          name: ${{ env.REGISTRY_TAG }}
          tag: ${{ env.REGISTRY_TAG }}
          makeLatest: false
          prerelease: true
          artifacts: "/tmp/binaries/*,/tmp/vendored/*,/tmp/pulsar-install.sh"
          body: 'This is a nightly release based on main branch. Do not use for production'

      - name: Release
        if: github.ref_type == 'tag'
        uses: ncipollo/release-action@v1
        with:
          name: ${{ env.REGISTRY_TAG }}
          draft: true
          tag: ${{ env.REGISTRY_TAG }}
          artifacts: "/tmp/binaries/*,/tmp/vendored/*,/tmp/pulsar-install.sh"
          body: |
            <hr>
            Check out the [changelog](https://github.com/exein-io/pulsar/blob/main/CHANGELOG.md) 
            for details on all the changes and fixes.

  docker-push:
    name: Push Docker multi-arch image
    runs-on: ubuntu-latest
    needs:
      - build
    services:
      registry:
        image: registry:2
        ports:
          - 5000:5000
    steps:
      # We do NOT download the binaries or vendored archives here,
      # only Docker images. We use a wildcard for all platforms.
      - name: Download images
        uses: actions/download-artifact@v3
        with:
          name: "images-${{ env.REGISTRY_TAG }}-*"
          path: /tmp/images

      - name: Load images
        run: |
          for image in /tmp/images/*.tar; do
            docker load -i "$image"
          done

      - name: Push images to local registry
        run: |
          docker push -a ${{ env.TMP_LOCAL_IMAGE }}

      - name: Log in to the Container registry
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create manifest list and push
        run: |
          docker buildx imagetools create -t ${{ env.REGISTRY_IMAGE }}:${{ env.REGISTRY_TAG }} \
            $(docker image ls --format '{{.Repository}}:{{.Tag}}' "${{ env.TMP_LOCAL_IMAGE }}" | tr '\n' ' ')

      - name: Push to latest
        if: github.ref_type == 'tag'
        run: |
          docker buildx imagetools create -t ${{ env.REGISTRY_IMAGE }}:latest \
            $(docker image ls --format '{{.Repository}}:{{.Tag}}' "${{ env.TMP_LOCAL_IMAGE }}" | tr '\n' ' ')

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ env.REGISTRY_TAG }}