release.yml

name: Release

on:
  push:
    branches:
      - main
    tags:
      - "v*.*.*"

jobs:
  bumpr:
    runs-on: ubuntu-latest
    outputs:
      skip: ${{ steps.bumpr.outputs.skip }}
      next_version: ${{ steps.bumpr.outputs.next_version }}
    steps:
    - name: Checkout
      uses: actions/checkout@v3

    # Bump version on merging Pull Requests with specific labels.
    # (bump:major,bump:minor,bump:patch)
    - name: Bump version on merging PR
      id: bumpr
      uses: haya14busa/action-bumpr@v1

  build-linux:
    name: Build Linux Binaries
    runs-on: ubuntu-latest
    needs: [ bumpr ]
    if: "!needs.bumpr.outputs.skip"
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Get Tags
        run: git fetch --prune --unshallow --tags

      - name: Build Release Artifacts for Linux
        id: build
        run: |
          ./build.sh --debug --id linux-amd64 --id linux-arm64

      - name: Upload Linux artifacts
        uses: actions/upload-artifact@v3
        with:
          name: cloudgrep_linux
          path: ./bin/*.zip

  build-windows:
    name: Build Windows Binaries
    runs-on: ubuntu-latest
    needs: [ bumpr ]
    if: "!needs.bumpr.outputs.skip"
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Get Tags
        run: git fetch --prune --unshallow --tags

      - name: Build Release Artifacts for Windows
        id: build
        run: |
          ./build.sh --debug --id windows-amd64 --id windows-386

      - name: Upload Windows artifacts
        uses: actions/upload-artifact@v3
        with:
          name: cloudgrep_windows
          path: ./bin/*.zip

  build-macos:
    name: Build Darwin Binaries
    runs-on: ubuntu-latest
    needs: [ bumpr ]
    if: "!needs.bumpr.outputs.skip"
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Get Tags
        run: git fetch --prune --unshallow --tags

      - name: Build Release Artifacts for Darwin
        id: build
        run: |
          ./build.sh --debug --id darwin-amd64 --id darwin-arm64

      - name: Upload Darwin artifacts
        uses: actions/upload-artifact@v3
        with:
          name: cloudgrep_darwin
          path: ./bin/*.zip

  release:
    name: Create release
    needs: [bumpr,build-macos,build-linux,build-windows]
    if: "!needs.bumpr.outputs.skip"
    runs-on: macos-latest
    outputs:
      upload_url: ${{ steps.create_release.outputs.url }}

    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Get tag name
        id: tag
        uses: haya14busa/action-cond@v1
        with:
          cond: "${{ startsWith(github.ref, 'refs/tags/') }}"
          if_true: ${{ github.ref }}
          if_false: ${{ needs.bumpr.outputs.next_version }}

      - name: Get Tags
        run: git fetch --prune --unshallow --tags

      # retrieve the darwin binaries built in the linux job
      - uses: actions/download-artifact@v2
        with:
          name: cloudgrep_linux

        # retrieve the darwin binaries built in the windows job
      - uses: actions/download-artifact@v2
        with:
          name: cloudgrep_windows

      # retrieve the darwin binaries built in the linux job
      - uses: actions/download-artifact@v2
        with:
          name: cloudgrep_darwin

      - run: |
          mkdir ./bin/
          ls -lh ./bin/
          mkdir -p ./bin/darwin_amd64
          mkdir -p ./bin/darwin_arm64
          mkdir -p ./bin/linux_amd64
          mkdir -p ./bin/linux_arm64
          mkdir -p ./bin/windows_amd64
          mkdir -p ./bin/windows_386
          ls -lh ./bin/
          unzip ./darwin_amd64.zip -d ./bin/darwin_amd64
          unzip ./darwin_arm64.zip -d ./bin/darwin_arm64
          unzip ./linux_amd64.zip -d ./bin/linux_amd64
          unzip ./linux_arm64.zip -d ./bin/linux_arm64
          unzip ./windows_amd64.zip -d ./bin/windows_amd64
          unzip ./windows_386.zip -d ./bin/windows_386
          rm -f ./*.zip
          ls -lh ./bin/

      - name: Import Code-Signing Certificates
        uses: Apple-Actions/import-codesign-certs@v1
        with:
          # The certificates in a PKCS12 file encoded as a base64 string
          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
          # The password used to import the PKCS12 file.
          p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}

      - name: Install gon via HomeBrew for code signing and app notarization
        run: |
          brew tap mitchellh/gon
          brew install mitchellh/gon/gon

      - name: Run gon to notarize apps
        run: |
          mkdir -p ./dist
          gon gon_amd64.hcl
          gon gon_arm64.hcl
        env:
          AC_USERNAME: ${{ secrets.AC_USERNAME }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}

      - name: Install GoReleaser
        uses: goreleaser/goreleaser-action@v3
        with:
          install-only: true
          distribution: goreleaser-pro
          version: latest

      - name: Create Release
        run: |
          ls -lh ./bin
          goreleaser release -f .goreleaser-release.yaml --rm-dist --debug
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}