ci-cd.yml

name: ice-release

on:
  push:
    branches: [ main ]
    tags: [ 'v*' ]
  workflow_dispatch:
    inputs:
      version:
        description: 'Version (without leading v) for manual release'
        required: false

env:
  GO_VERSION: '1.21'
  BINARY_NAME: ice

jobs:
  tag-on-message:
    # Auto-create a tag if the commit message on main looks like: release: vX.Y.Z
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      release_match: ${{ steps.detect.outputs.match }}
      release_version: ${{ steps.detect.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Detect release commit message
        id: detect
        run: |
          set -euo pipefail
          msg="${{ github.event.head_commit.message }}"
          echo "Full commit message:\n$msg"
          # Use only first line for pattern match
          first_line="${msg%%$'\n'*}"
          echo "First line: $first_line"
          if [[ "$first_line" =~ ^release:\ v([0-9]+\.[0-9]+\.[0-9]+)([[:space:]]|$) ]]; then
            ver="${BASH_REMATCH[1]}"
            echo "Matched version: $ver"
            echo "version=$ver" >> $GITHUB_OUTPUT
            echo "match=true" >> $GITHUB_OUTPUT
            {
              echo "### Detected release commit"
              echo "Version: v$ver"
            } >> $GITHUB_STEP_SUMMARY
          else
            echo "No release pattern match (expected: release: vX.Y.Z)"
            echo "match=false" >> $GITHUB_OUTPUT
            {
              echo "### No release tag created"
              echo "First line did not match ^release: vX.Y.Z"
            } >> $GITHUB_STEP_SUMMARY
          fi
      - name: Configure git for tagging
        if: steps.detect.outputs.match == 'true'
        run: |
          git config user.name "github-actions"
          git config user.email "github-actions@github.com"
      - name: Create and push tag
        if: steps.detect.outputs.match == 'true'
        run: |
          set -euo pipefail
          ver="${{ steps.detect.outputs.version }}"
          echo "Creating tag v$ver"
          if git rev-parse -q --verify "refs/tags/v$ver" >/dev/null; then
            echo "Tag v$ver already exists; skipping"
            exit 0
          fi
          git tag -a "v$ver" -m "Release v$ver"
          git push origin "v$ver"
          echo "Tag v$ver pushed. A new workflow run should start for that tag to build & release."

  build-matrix:
    needs: tag-on-message
    if: needs.tag-on-message.outputs.release_match == 'true' || startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
    name: build (${{ matrix.os }} ${{ matrix.goos }}-${{ matrix.goarch }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            goos: linux
            goarch: amd64
          - os: ubuntu-latest
            goos: linux
            goarch: arm64
          - os: macos-latest
            goos: darwin
            goarch: amd64
          - os: macos-latest
            goos: darwin
            goarch: arm64
          - os: windows-latest
            goos: windows
            goarch: amd64

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-go@v4
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Tidy modules
        run: go mod tidy

      - name: Build
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p dist
          EXT=$(GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} go env GOEXE)
          GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o dist/${{ env.BINARY_NAME }}-${{ matrix.goos }}-${{ matrix.goarch }}${EXT} ./cmd/ice

      - name: Compress artifacts (Unix)
        if: matrix.goos != 'windows'
        shell: bash
        run: |
          set -euo pipefail
          cd dist
          for f in *; do
            [ -f "$f" ] || continue
            tar -czf "$f.tar.gz" "$f"
          done

      - name: Compress artifacts (Windows)
        if: matrix.goos == 'windows'
        shell: pwsh
        run: |
          Set-StrictMode -Version Latest
          Set-Location dist
          Get-ChildItem -File | ForEach-Object {
            $name = $_.BaseName
            Compress-Archive -Path $_.Name -DestinationPath "$name.zip"
          }

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ice-${{ matrix.goos }}-${{ matrix.goarch }}
          path: dist/*
          if-no-files-found: error

  release:
    needs: [tag-on-message, build-matrix]
    if: needs.tag-on-message.outputs.release_match == 'true' || startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set release version
        id: ver
        run: |
          set -euo pipefail
          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            ver="${GITHUB_REF#refs/tags/v}"
          elif [[ "${{ needs.tag-on-message.outputs.release_match }}" == "true" ]]; then
            ver="${{ needs.tag-on-message.outputs.release_version }}"
          elif [[ -n "${{ github.event.inputs.version }}" ]]; then
            ver="${{ github.event.inputs.version }}"
          else
            ver=$(date +%Y.%m.%d)
          fi
          echo "version=$ver" >> $GITHUB_OUTPUT
          echo "Release version: $ver"

      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Prepare release directory
        run: |
          mkdir -p release
          find artifacts -type f -maxdepth 3 -print -exec cp {} release/ \;
          ls -lah release

      - name: Generate checksums
        run: |
          cd release
          sha256sum * > SHA256SUMS.txt || shasum -a 256 * > SHA256SUMS.txt

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v1
        with:
          tag_name: v${{ steps.ver.outputs.version }}
          name: "Ice v${{ steps.ver.outputs.version }}"
          generate_release_notes: true
          files: |
            release/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}