release.yml

# ===================================
# API Monitor 完整发版流水线
# ===================================
# 触发条件：
# - 推送版本标签 (v*)
# - 手动触发并指定版本号
#
# 流水线顺序（严格依赖链，无竞态）：
# 1. create-release  → 创建 GitHub Release
# 2. build-agent     → 编译 5 平台 Rust Agent
# 3. upload-assets   → 上传 Agent 到 Release
# 4. build-docker    → 构建多架构 Docker 镜像
# 5. merge-docker    → 合并多架构 manifest
# 6. cleanup-docker  → 清理临时镜像
# 7. security-scan   → 安全扫描

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      version:
        description: "版本号 (如 1.0.0，不需要 v 前缀)"
        required: true
        type: string
      prerelease:
        description: "是否为预发布版本"
        required: false
        default: false
        type: boolean

permissions:
  contents: write
  packages: write
  security-events: write

env:
  GH_TOKEN: ${{ github.token }}
  IMAGE_NAME: api-monitor
  REGISTRY: ghcr.io
  DOCKERHUB_REPO: ${{ github.repository_owner }}/api-monitor

jobs:
  # ==========================================
  # Phase 1: 创建 GitHub Release
  # ==========================================
  create-release:
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.version.outputs.tag }}
      version: ${{ steps.version.outputs.version }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
        with:
          fetch-depth: 0

      - name: Determine version
        id: version
        env:
          EVENT_NAME: ${{ github.event_name }}
          INPUT_VERSION: ${{ github.event.inputs.version }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            VERSION="$INPUT_VERSION"
          else
            VERSION="$REF_NAME"
            VERSION="${VERSION#v}"
          fi
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          echo "tag=v${VERSION}" >> $GITHUB_OUTPUT
          echo "📦 Version: ${VERSION}, Tag: v${VERSION}"

      - name: Create tag (manual trigger only)
        if: github.event_name == 'workflow_dispatch'
        env:
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a "$TAG" -m "Release $TAG"
          git push origin "$TAG"

      - name: Generate changelog
        id: changelog
        env:
          CURRENT_TAG: ${{ steps.version.outputs.tag }}
          REPO_OWNER: ${{ github.repository_owner }}
        run: |
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")

          echo "## 🚀 $CURRENT_TAG 更新内容" > release_notes.md
          echo "" >> release_notes.md

          if [ -n "$PREV_TAG" ]; then
            echo "### 📝 提交记录" >> release_notes.md
            echo "" >> release_notes.md

            echo "#### ✨ 新功能 (feat)" >> release_notes.md
            git log ${PREV_TAG}..HEAD --pretty=format:"- %s (%h)" --grep="^feat" >> release_notes.md || true
            echo "" >> release_notes.md

            echo "#### 🐛 修复 (fix)" >> release_notes.md
            git log ${PREV_TAG}..HEAD --pretty=format:"- %s (%h)" --grep="^fix" >> release_notes.md || true
            echo "" >> release_notes.md

            echo "#### 🔧 其他" >> release_notes.md
            git log ${PREV_TAG}..HEAD --pretty=format:"- %s (%h)" --grep="^build\|^ci\|^chore\|^refactor\|^perf\|^style\|^test\|^docs" >> release_notes.md || true
            echo "" >> release_notes.md
          else
            echo "首次发布" >> release_notes.md
          fi

          echo "" >> release_notes.md
          echo "---" >> release_notes.md
          echo "" >> release_notes.md
          echo "### 📦 Docker 镜像" >> release_notes.md
          echo '```bash' >> release_notes.md
          echo "docker pull ghcr.io/$REPO_OWNER/api-monitor:${CURRENT_TAG#v}" >> release_notes.md
          echo "docker pull $REPO_OWNER/api-monitor:${CURRENT_TAG#v}" >> release_notes.md
          echo '```' >> release_notes.md

          echo "" >> release_notes.md
          echo "### 🖥️ Agent 下载" >> release_notes.md
          echo "| 平台 | 架构 | 文件 |" >> release_notes.md
          echo "|------|------|------|" >> release_notes.md
          echo "| Linux | amd64 | agent-linux-amd64 |" >> release_notes.md
          echo "| Linux | arm64 | agent-linux-arm64 |" >> release_notes.md
          echo "| Windows | amd64 | agent-windows-amd64.exe |" >> release_notes.md
          echo "| macOS | amd64 | agent-darwin-amd64 |" >> release_notes.md
          echo "| macOS | arm64 | agent-darwin-arm64 |" >> release_notes.md

          cat release_notes.md

      - name: Create GitHub Release
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.2.1
        with:
          tag_name: ${{ steps.version.outputs.tag }}
          name: "Release ${{ steps.version.outputs.tag }}"
          body_path: release_notes.md
          draft: false
          prerelease: ${{ github.event.inputs.prerelease == 'true' }}

  # ==========================================
  # Phase 2: 编译 Rust Agent（5 平台）
  # ==========================================
  build-agent:
    needs: create-release
    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            output_name: agent-linux-amd64
            use_cross: false
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
            output_name: agent-linux-arm64
            use_cross: true
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            output_name: agent-windows-amd64.exe
            use_cross: false
          - target: x86_64-apple-darwin
            os: macos-latest
            output_name: agent-darwin-amd64
            use_cross: false
          - target: aarch64-apple-darwin
            os: macos-latest
            output_name: agent-darwin-arm64
            use_cross: false

    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2

      - name: Set up Rust
        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.10.1
        with:
          target: ${{ matrix.target }}
          cache: true
          cache-workspaces: agent-rust

      - name: Install musl-tools (Linux amd64)
        if: matrix.target == 'x86_64-unknown-linux-musl'
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools

      - name: Install cross (ARM64 Linux)
        if: matrix.use_cross
        shell: bash
        run: |
          curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
          cargo binstall --no-confirm --force cross

      - name: Remove cargo mirror config in CI
        shell: bash
        run: rm -f agent-rust/.cargo/config.toml

      - name: Build Agent
        working-directory: agent-rust
        shell: bash
        run: |
          if [ "${{ matrix.use_cross }}" = "true" ]; then
            cross build --target ${{ matrix.target }} --release
          else
            cargo build --target ${{ matrix.target }} --release
          fi

      - name: Copy & Rename Binary
        shell: bash
        run: |
          mkdir -p dist
          if [[ "${{ matrix.target }}" == *"windows"* ]]; then
            cp agent-rust/target/${{ matrix.target }}/release/api-monitor-agent.exe dist/${{ matrix.output_name }}
          else
            cp agent-rust/target/${{ matrix.target }}/release/api-monitor-agent dist/${{ matrix.output_name }}
          fi
          ls -lh dist/

      - name: Upload artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
        with:
          name: ${{ matrix.output_name }}
          path: dist/${{ matrix.output_name }}
          retention-days: 7

  # ==========================================
  # Phase 3: 上传 Agent 到 Release
  # ==========================================
  upload-assets:
    needs: [create-release, build-agent]
    runs-on: ubuntu-latest

    steps:
      - name: Download all agent artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8
        with:
          path: artifacts
          pattern: agent-*
          merge-multiple: true

      - name: List artifacts
        run: ls -lh artifacts/

      - name: Upload assets to Release
        env:
          TAG: ${{ needs.create-release.outputs.tag }}
          REPO: ${{ github.repository }}
        run: |
          echo "📦 Uploading assets to release $TAG..."
          for file in artifacts/*; do
            FILENAME=$(basename "$file")
            echo "  ↗ Uploading $FILENAME..."
            gh release upload "$TAG" "$file" --repo "$REPO" --clobber
          done
          echo "✅ All assets uploaded."

  # ==========================================
  # Phase 4: 构建多架构 Docker 镜像
  # ==========================================
  build-docker:
    needs: upload-assets
    runs-on: ${{ matrix.runner }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
            suffix: amd64
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
            suffix: arm64

    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2

      - name: Download compiled agent binaries
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8
        with:
          path: agent-rust
          pattern: agent-*
          merge-multiple: true

      - name: List downloaded agents
        run: ls -lh agent-rust/

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.10.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Docker Hub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.3.0
        continue-on-error: true
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.6.1
        with:
          images: |
            ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
            ${{ env.DOCKERHUB_REPO }}
          tags: |
            type=raw,value=latest
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
          labels: |
            org.opencontainers.image.title=API Monitor
            org.opencontainers.image.description=API聚合监控面板
            org.opencontainers.image.vendor=iwvw
            maintainer=iwvw

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.13.0
        with:
          context: .
          file: ./Dockerfile
          platforms: ${{ matrix.platform }}
          no-cache: true
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:build-${{ github.run_id }}-${{ matrix.suffix }}
            ${{ env.DOCKERHUB_REPO }}:build-${{ github.run_id }}-${{ matrix.suffix }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=${{ matrix.platform }}
          cache-to: type=gha,mode=max,scope=${{ matrix.platform }}
          build-args: |
            NODE_ENV=production

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          echo "${{ steps.build.outputs.digest }}" > /tmp/digests/${{ matrix.suffix }}

      - name: Upload digest
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
        with:
          name: digests-${{ matrix.suffix }}
          path: /tmp/digests/*
          retention-days: 1

  # ==========================================
  # Phase 5: 合并多架构 manifest
  # ==========================================
  merge-docker:
    needs: build-docker
    runs-on: ubuntu-latest

    steps:
      - name: Download digests
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.10.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Docker Hub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.3.0
        continue-on-error: true
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.6.1
        with:
          images: |
            ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
            ${{ env.DOCKERHUB_REPO }}
          tags: |
            type=raw,value=latest
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}

      - name: Create and push manifest
        env:
          TAGS: ${{ steps.meta.outputs.tags }}
          REPO_OWNER: ${{ github.repository_owner }}
        run: |
          AMD64_DIGEST=$(cat /tmp/digests/amd64)
          ARM64_DIGEST=$(cat /tmp/digests/arm64)

          echo "AMD64 Digest: $AMD64_DIGEST"
          echo "ARM64 Digest: $ARM64_DIGEST"

          echo "$TAGS" | while IFS= read -r TAG; do
            [ -z "$TAG" ] && continue

            # 确定 Registry 前缀，使用同源镜像合并（避免跨 Registry 400 错误）
            if [[ "$TAG" == "$REGISTRY"* ]]; then
               SRC_PREFIX="$REGISTRY/$REPO_OWNER/$IMAGE_NAME"
            else
               SRC_PREFIX="$DOCKERHUB_REPO"
            fi

            echo "🔗 Creating manifest: $TAG"

            for i in {1..3}; do
              docker buildx imagetools create -t "$TAG" \
                "${SRC_PREFIX}@${AMD64_DIGEST}" \
                "${SRC_PREFIX}@${ARM64_DIGEST}" && break || {
                if [ $i -lt 3 ]; then
                  echo "  ⚠ Retry in 10s ($i/3)..."
                  sleep 10
                else
                  echo "  ❌ Failed to create manifest for $TAG"
                  exit 1
                fi
              }
            done
          done

      - name: Summary
        env:
          TAGS: ${{ steps.meta.outputs.tags }}
          REPO_OWNER: ${{ github.repository_owner }}
        run: |
          echo "## 🎉 Release 完成" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Docker 镜像" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "$TAGS" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**架构**: linux/amd64, linux/arm64" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo '```bash' >> $GITHUB_STEP_SUMMARY
          echo "docker pull $REGISTRY/$REPO_OWNER/$IMAGE_NAME:latest" >> $GITHUB_STEP_SUMMARY
          echo "docker pull $DOCKERHUB_REPO:latest" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY

  # ==========================================
  # Phase 6: 清理临时镜像
  # ==========================================
  cleanup-docker:
    needs: merge-docker
    runs-on: ubuntu-latest
    if: always()
    continue-on-error: true

    steps:
      - name: Delete temporary build images
        uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0
        with:
          package-name: ${{ env.IMAGE_NAME }}
          package-type: container
          min-versions-to-keep: 0
          delete-only-untagged-versions: false
          ignore-versions: "^(?!build-${{ github.run_id }}).*$"
        continue-on-error: true

  # ==========================================
  # Phase 7: 安全扫描
  # ==========================================
  security-scan:
    needs: merge-docker
    runs-on: ubuntu-latest
    continue-on-error: true

    steps:
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:latest
          format: "sarif"
          output: "trivy-results.sarif"

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@d77b13a0df3134d64a457ea9003f600b09fa1c8a # v3.28.10
        with:
          sarif_file: "trivy-results.sarif"