release.yml

name: Build and Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      create_release:
        description: "Create GitHub Release"
        required: false
        default: "false"
        type: boolean
  pull_request:
    types: [closed]
    branches: [main]

jobs:
  # ──────────────────────────────────────────────────────────────────────
  # Single source of truth for "what should this run do?". Every other job
  # keys off these two outputs instead of repeating the trigger matrix.
  #
  #   should_build   - produce the platform artifacts (DMG, Linux, .deb, Chrome)
  #   should_release - tag, publish the GitHub Release, and update the tap
  #
  # The distinction matters for manual runs: a plain `workflow_dispatch` builds
  # artifacts for testing but does NOT release unless create_release=true.
  # ──────────────────────────────────────────────────────────────────────
  gate:
    name: Resolve trigger
    runs-on: ubuntu-latest
    outputs:
      should_build: ${{ steps.decide.outputs.build }}
      should_release: ${{ steps.decide.outputs.release }}
    steps:
      - id: decide
        env:
          IS_TAG: ${{ startsWith(github.ref, 'refs/tags/v') }}
          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
          CREATE_RELEASE_INPUT: ${{ github.event.inputs.create_release }}
          IS_RELEASE_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release') }}
        run: |
          build=false
          release=false
          # Build on tag pushes, any manual dispatch, or a merged release-labelled PR.
          if [ "$IS_TAG" = "true" ] || [ "$IS_DISPATCH" = "true" ] || [ "$IS_RELEASE_PR" = "true" ]; then
            build=true
          fi
          # Release on tag pushes, an opt-in dispatch, or a merged release-labelled PR.
          if [ "$IS_TAG" = "true" ] || [ "$CREATE_RELEASE_INPUT" = "true" ] || [ "$IS_RELEASE_PR" = "true" ]; then
            release=true
          fi
          echo "build=$build" >> "$GITHUB_OUTPUT"
          echo "release=$release" >> "$GITHUB_OUTPUT"
          echo "should_build=$build  should_release=$release"

  # ──────────────────────────────────────────────────────────────────────
  # Platform builds (reusable workflows). Each fans out independently and
  # uploads its artifacts for create-release to collect.
  # ──────────────────────────────────────────────────────────────────────
  build-dmg:
    name: Build DMG
    needs: gate
    if: needs.gate.outputs.should_build == 'true'
    uses: ./.github/workflows/_build-dmg.yml
    secrets: inherit

  build-linux:
    name: Build Linux Binary
    needs: gate
    if: needs.gate.outputs.should_build == 'true'
    uses: ./.github/workflows/_build-linux.yml

  package-linux-deb:
    name: Package Linux .deb
    needs: [gate, build-linux]
    if: needs.gate.outputs.should_build == 'true'
    uses: ./.github/workflows/_package-deb.yml

  build-chrome:
    name: Package Chrome Extension
    needs: gate
    if: needs.gate.outputs.should_build == 'true'
    uses: ./.github/workflows/_build-chrome.yml

  # ──────────────────────────────────────────────────────────────────────
  # Create a single GitHub Release with all assets
  # ──────────────────────────────────────────────────────────────────────
  create-release:
    name: Create GitHub Release
    needs: [gate, build-dmg, build-linux, package-linux-deb, build-chrome]
    if: needs.gate.outputs.should_release == 'true'

    runs-on: ubuntu-latest

    permissions:
      contents: write

    steps:
      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ github.event.pull_request.merge_commit_sha || github.ref }}

      - name: Extract Version
        id: version
        uses: ./.github/actions/extract-version

      - name: Download all build artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: release-assets

      - name: List downloaded artifacts
        run: find release-assets -type f | sort

      - name: Create Release Notes
        run: |
          cat > release_notes.md << 'NOTES_EOF'
          ## Kiji Privacy Proxy v${{ steps.version.outputs.version }}

          ### Downloads
          - **macOS**: DMG installer (Apple Silicon and Intel) - Desktop app with UI
          - **Linux**: Standalone binary archive (amd64) - API server only (no UI)
          - **Linux (.deb)**: Debian/Ubuntu package (amd64) with systemd unit
          - **Chrome Extension**: Browser extension for PII detection in web forms

          ### macOS Installation

          **Homebrew (recommended):**
          ```bash
          brew install --cask dataiku/tap/kiji-privacy-proxy
          ```

          **Or download manually:**
          1. Download `Kiji-Privacy-Proxy-${{ steps.version.outputs.version }}.dmg`
          2. Open the DMG and drag to Applications
          3. Launch "Kiji Privacy Proxy"

          **HTTPS Support - Install CA Certificate:**

          For HTTPS interception to work, you must trust the proxy's CA certificate:

          ```bash
          # System-wide trust (recommended)
          sudo security add-trusted-cert \
            -d \
            -r trustRoot \
            -k /Library/Keychains/System.keychain \
            ~/.kiji-proxy/certs/ca.crt
          ```

          Or use **Keychain Access**:
          1. Open Keychain Access app
          2. File → Import Items → `~/.kiji-proxy/certs/ca.crt`
          3. Double-click "Kiji Privacy Proxy CA" certificate
          4. Expand **Trust** → Set to **Always Trust**

          ### Linux Installation

          **Note:** Linux build is API-only (no desktop UI). Access via HTTP endpoints.

          **Quick Start:**
          ```bash
          # Extract
          tar -xzf kiji-privacy-proxy-${{ steps.version.outputs.version }}-linux-amd64.tar.gz
          cd kiji-privacy-proxy-${{ steps.version.outputs.version }}-linux-amd64

          # Run
          ./run.sh
          ```

          **HTTPS Support - Install CA Certificate:**
          ```bash
          # Ubuntu/Debian
          sudo cp ~/.kiji-proxy/certs/ca.crt /usr/local/share/ca-certificates/kiji-proxy-ca.crt
          sudo update-ca-certificates

          # RHEL/CentOS/Fedora
          sudo cp ~/.kiji-proxy/certs/ca.crt /etc/pki/ca-trust/source/anchors/kiji-proxy-ca.crt
          sudo update-ca-trust
          ```

          **Configuration:**
          ```bash
          # Set API key
          export OPENAI_API_KEY="your-key-here"

          # Check health
          curl http://localhost:8080/health

          # Test proxy
          curl -x http://localhost:8080 https://api.openai.com/v1/models
          ```

          See included `README.txt` for systemd service setup and advanced configuration.

          ### Debian / Ubuntu (.deb)

          ```bash
          sudo dpkg -i kiji-privacy-proxy_${{ steps.version.outputs.version }}_amd64.deb
          # The systemd unit is installed but not enabled by default.
          # Configure /etc/default or env vars first, then:
          sudo systemctl enable --now kiji-privacy-proxy
          ```

          Files land under `/opt/kiji-privacy-proxy/` and a `kiji-proxy`
          wrapper is placed on `PATH` at `/usr/bin/kiji-proxy`.

          ### Chrome Extension

          **Install from zip:**
          1. Download `kiji-privacy-proxy-extension-${{ steps.version.outputs.version }}.zip`
          2. Unzip to a folder
          3. Open `chrome://extensions/`
          4. Enable **Developer mode**
          5. Click **Load unpacked** and select the unzipped folder

          ### Documentation

          - [Getting Started Guide](https://github.com/dataiku/kiji-proxy/blob/main/docs/01-getting-started.md)
          - [Development Guide](https://github.com/dataiku/kiji-proxy/blob/main/docs/02-development-guide.md)
          - [Release Management](https://github.com/dataiku/kiji-proxy/blob/main/docs/04-release-management.md)

          ### What's New
          See the changelog below for details.
          NOTES_EOF

      - name: Create and push tag
        if: github.event_name == 'pull_request'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="v${{ steps.version.outputs.version }}"
          if git rev-parse "$TAG" >/dev/null 2>&1; then
            echo "Tag $TAG already exists, skipping creation"
            exit 0
          fi
          git config user.name  "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag -a "$TAG" -m "Release $TAG"
          git push origin "$TAG"
          echo "Created and pushed $TAG"

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="v${{ steps.version.outputs.version }}"

          # Determine if prerelease (based on the resolved version, not the ref —
          # the ref is the PR merge ref on the pull_request path, not the tag).
          IS_PRERELEASE=""
          if [[ "$TAG" == *"-beta"* ]] || [[ "$TAG" == *"-alpha"* ]] || [[ "$TAG" == *"-rc"* ]]; then
            IS_PRERELEASE="--prerelease"
          fi

          # Collect all release assets into a flat directory
          mkdir -p assets
          cp release-assets/dmg-assets/*.dmg assets/ 2>/dev/null || true
          cp release-assets/dmg-assets/*.dmg.sha256 assets/ 2>/dev/null || true
          cp release-assets/dmg-assets/*.zip assets/ 2>/dev/null || true
          cp release-assets/dmg-assets/latest-mac.yml assets/ 2>/dev/null || true
          cp release-assets/linux-assets/*.tar.gz assets/ 2>/dev/null || true
          cp release-assets/linux-assets/*.tar.gz.sha256 assets/ 2>/dev/null || true
          cp release-assets/linux-deb/*.deb assets/ 2>/dev/null || true
          cp release-assets/linux-deb/*.deb.sha256 assets/ 2>/dev/null || true
          cp release-assets/chrome-assets/*.zip assets/ 2>/dev/null || true
          cp release-assets/chrome-assets/*.zip.sha256 assets/ 2>/dev/null || true

          echo "Release assets:"
          ls -lh assets/

          # Create the release with all assets in one atomic operation
          gh release create "$TAG" \
            assets/* \
            --title "Kiji Privacy Proxy $TAG" \
            --notes-file release_notes.md \
            --generate-notes \
            --latest \
            $IS_PRERELEASE

  # ──────────────────────────────────────────────────────────────────────
  # Publish Homebrew Cask to dataiku/homebrew-tap
  # ──────────────────────────────────────────────────────────────────────
  publish-homebrew-tap:
    name: Publish Homebrew Tap
    needs: [gate, create-release]
    if: needs.gate.outputs.should_release == 'true'

    runs-on: ubuntu-latest

    environment: "Homebrew Release"

    permissions:
      contents: read

    steps:
      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ github.event.pull_request.merge_commit_sha || github.ref }}

      - name: Extract Version
        id: version
        uses: ./.github/actions/extract-version

      - name: Determine prerelease
        id: prerelease
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          # Tap only ships stable releases; skip alpha/beta/rc.
          if [[ "$VERSION" == *"-alpha"* ]] || [[ "$VERSION" == *"-beta"* ]] || [[ "$VERSION" == *"-rc"* ]]; then
            echo "is_prerelease=true" >> $GITHUB_OUTPUT
            echo "::notice::Skipping Homebrew tap publish for prerelease $VERSION"
          else
            echo "is_prerelease=false" >> $GITHUB_OUTPUT
          fi

      - name: Download DMG artifacts
        if: steps.prerelease.outputs.is_prerelease == 'false'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: dmg-assets
          path: dmg-assets

      - name: Compute DMG SHA256
        id: cask
        if: steps.prerelease.outputs.is_prerelease == 'false'
        run: |
          set -euo pipefail
          VERSION="${{ steps.version.outputs.version }}"
          DMG="dmg-assets/Kiji-Privacy-Proxy-${VERSION}.dmg"
          if [ ! -f "$DMG" ]; then
            echo "::error::Expected DMG not found at $DMG"
            ls -la dmg-assets/
            exit 1
          fi
          if [ ! -f "${DMG}.sha256" ]; then
            echo "::error::Checksum file not found at ${DMG}.sha256"
            exit 1
          fi
          SHA=$(awk '{print $1}' "${DMG}.sha256")
          if [ -z "$SHA" ]; then
            echo "::error::Empty SHA256 parsed from ${DMG}.sha256"
            exit 1
          fi
          echo "sha256=$SHA" >> $GITHUB_OUTPUT
          echo "DMG SHA256: $SHA"

      - name: Generate GitHub App token for homebrew-tap
        if: steps.prerelease.outputs.is_prerelease == 'false'
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          app-id: ${{ vars.HOMEBREW_TAP_APP_CLIENT_ID }}
          private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }}
          owner: dataiku
          repositories: homebrew-tap

      - name: Checkout homebrew-tap
        if: steps.prerelease.outputs.is_prerelease == 'false'
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          repository: dataiku/homebrew-tap
          token: ${{ steps.app-token.outputs.token }}
          path: homebrew-tap

      - name: Render cask and push
        if: steps.prerelease.outputs.is_prerelease == 'false'
        env:
          VERSION: ${{ steps.version.outputs.version }}
          SHA256: ${{ steps.cask.outputs.sha256 }}
          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
        run: |
          set -euo pipefail
          SRC=packaging/homebrew/Casks/kiji-privacy-proxy.rb
          DST=homebrew-tap/Casks/kiji-privacy-proxy.rb
          mkdir -p homebrew-tap/Casks

          # Guard against template drift: refuse to render if the placeholders
          # we depend on are no longer present.
          if ! grep -q '^  version "0\.0\.0"$' "$SRC"; then
            echo "::error::Template $SRC no longer contains placeholder: version \"0.0.0\""
            exit 1
          fi
          if ! grep -qE '^  sha256 "0{64}"$' "$SRC"; then
            echo "::error::Template $SRC no longer contains placeholder sha256"
            exit 1
          fi

          sed \
            -e "s|^  version \"0\\.0\\.0\"$|  version \"${VERSION}\"|" \
            -e "s|^  sha256 \"0\\{64\\}\"$|  sha256 \"${SHA256}\"|" \
            "$SRC" > "$DST"

          echo "Rendered cask:"
          cat "$DST"

          cd homebrew-tap
          git config user.name  "${APP_SLUG}[bot]"
          git config user.email "${APP_SLUG}[bot]@users.noreply.github.com"

          # Stage first, then compare the index against HEAD. `git diff --quiet
          # -- <path>` ignores untracked files, so on the first publish (when
          # the cask does not yet exist in the tap) it would wrongly report
          # "nothing to commit" and never push. `git diff --cached --quiet`
          # detects both brand-new and modified files.
          git add Casks/kiji-privacy-proxy.rb
          if git diff --cached --quiet; then
            echo "::notice::Cask already at ${VERSION}, nothing to commit."
            exit 0
          fi

          git commit -m "kiji-privacy-proxy ${VERSION}"
          git push origin HEAD:main