release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      publish_package_managers:
        description: "Also publish Homebrew, AUR, and APT from this run"
        required: false
        default: false
        type: boolean

jobs:
  package-linux:
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    outputs:
      cli_version: ${{ steps.context.outputs.cli_version }}
      icey_version: ${{ steps.context.outputs.icey_version }}
      publish_package_managers: ${{ steps.context.outputs.publish_package_managers }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Read release context
        id: context
        env:
          WORKFLOW_PUBLISH: ${{ github.event.inputs.publish_package_managers || 'false' }}
        run: |
          echo "cli_version=$(tr -d '[:space:]' < VERSION)" >> "$GITHUB_OUTPUT"
          echo "icey_version=$(tr -d '[:space:]' < ICEY_VERSION)" >> "$GITHUB_OUTPUT"
          if [[ "${GITHUB_REF_TYPE:-}" == "tag" || "$WORKFLOW_PUBLISH" == "true" ]]; then
            echo "publish_package_managers=true" >> "$GITHUB_OUTPUT"
          else
            echo "publish_package_managers=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout icey
        uses: actions/checkout@v6
        with:
          repository: nilstate/icey
          ref: ${{ steps.context.outputs.icey_version }}
          path: icey

      - name: Validate release metadata
        run: |
          if [[ "${GITHUB_REF_TYPE:-}" == "tag" ]]; then
            bash ./scripts/validate-release-metadata.sh "${GITHUB_REF_NAME}"
          else
            bash ./scripts/validate-release-metadata.sh
          fi

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            gcc-13 g++-13 \
            cmake \
            dpkg-dev \
            libssl-dev \
            libavcodec-dev libavformat-dev libavutil-dev libswscale-dev libswresample-dev \
            unzip zip

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: web/package-lock.json

      - name: Build release package
        env:
          CC: gcc-13
          CXX: g++-13
          ICEY_SOURCE_DIR: ${{ github.workspace }}/icey
          BUILD_DIR: ${{ github.workspace }}/build-release
        run: bash ./scripts/package-manager-check.sh

      - name: Check Docker Hub credentials
        if: startsWith(github.ref, 'refs/tags/')
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          test -n "$DOCKERHUB_USERNAME" || {
            echo "DOCKERHUB_USERNAME is required to publish the 0state/icey-server image" >&2
            exit 1
          }
          test -n "$DOCKERHUB_TOKEN" || {
            echo "DOCKERHUB_TOKEN is required to publish the 0state/icey-server image" >&2
            exit 1
          }

      - name: Derive image version
        if: startsWith(github.ref, 'refs/tags/')
        id: image_version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Set up Docker Buildx
        if: startsWith(github.ref, 'refs/tags/')
        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub
        if: startsWith(github.ref, 'refs/tags/')
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract image metadata
        if: startsWith(github.ref, 'refs/tags/')
        id: image_meta
        uses: docker/metadata-action@v5
        with:
          images: 0state/icey-server
          tags: |
            type=raw,value=${{ steps.image_version.outputs.version }}
            type=raw,value=latest

      - name: Build and push image
        if: startsWith(github.ref, 'refs/tags/')
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./docker/Dockerfile
          push: true
          build-args: |
            ICEY_SERVER_BINARY=build-release/src/server/icey-server
            ICEY_WEB_ROOT=web/dist
            ICEY_SAMPLE_MEDIA=icey/data/test.mp4
            ICEY_ENTRYPOINT=docker/entrypoint.sh
          tags: ${{ steps.image_meta.outputs.tags }}
          labels: ${{ steps.image_meta.outputs.labels }}

      - name: Upload release assets
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: |
            icey-cli-*-source.tar.gz
            icey-*-source.tar.gz
            icey-server-*-Linux-x86_64.tar.gz
            icey-server-*-Linux-x86_64.zip
            icey-server-Linux-x86_64.tar.gz
            icey-server-Linux-x86_64.zip
            icey-server_*.deb
            icey-server-apt-repo-*.tar.gz

      - name: Upload manifest bundle
        uses: actions/upload-artifact@v4
        with:
          name: package-managers-rendered
          path: .stage/package-managers/rendered

      - name: Upload APT bundle
        uses: actions/upload-artifact@v4
        with:
          name: apt-repo
          path: |
            .stage/apt-repo
            .stage/apt-public

  publish-homebrew:
    runs-on: ubuntu-24.04
    needs: package-linux
    if: needs.package-linux.outputs.publish_package_managers == 'true'
    steps:
      - name: Check Homebrew publish credentials
        id: gate
        env:
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          if [[ -n "${HOMEBREW_TAP_TOKEN:-}" ]]; then
            echo "publish=true" >> "$GITHUB_OUTPUT"
          else
            echo "publish=false" >> "$GITHUB_OUTPUT"
            echo "Skipping Homebrew publish: HOMEBREW_TAP_TOKEN is not configured."
          fi

      - uses: actions/checkout@v6
        if: steps.gate.outputs.publish == 'true'

      - uses: actions/download-artifact@v4
        if: steps.gate.outputs.publish == 'true'
        with:
          name: package-managers-rendered
          path: .stage/package-managers/rendered

      - name: Checkout tap repo
        if: steps.gate.outputs.publish == 'true'
        uses: actions/checkout@v6
        with:
          repository: nilstate/homebrew-icey
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: .stage/homebrew-icey

      - name: Publish formula
        if: steps.gate.outputs.publish == 'true'
        env:
          TAP_REPO_DIR: ${{ github.workspace }}/.stage/homebrew-icey
        run: bash ./scripts/publish-homebrew.sh

      - name: Commit formula update
        if: steps.gate.outputs.publish == 'true'
        run: |
          git -C .stage/homebrew-icey config user.name "github-actions[bot]"
          git -C .stage/homebrew-icey config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git -C .stage/homebrew-icey add Formula/icey-server.rb
          if git -C .stage/homebrew-icey diff --cached --quiet; then
            exit 0
          fi
          git -C .stage/homebrew-icey commit -m "icey-server ${{ needs.package-linux.outputs.cli_version }}"
          git -C .stage/homebrew-icey push

  publish-apt-repo:
    runs-on: ubuntu-24.04
    needs: package-linux
    if: needs.package-linux.outputs.publish_package_managers == 'true'
    steps:
      - name: Check package repo credentials
        id: gate
        env:
          PACKAGES_REPO_TOKEN: ${{ secrets.PACKAGES_REPO_TOKEN }}
        run: |
          if [[ -n "${PACKAGES_REPO_TOKEN:-}" ]]; then
            echo "publish=true" >> "$GITHUB_OUTPUT"
          else
            echo "publish=false" >> "$GITHUB_OUTPUT"
            echo "Skipping APT publish: PACKAGES_REPO_TOKEN is not configured."
          fi

      - uses: actions/checkout@v6
        if: steps.gate.outputs.publish == 'true'

      - uses: actions/download-artifact@v4
        if: steps.gate.outputs.publish == 'true'
        with:
          name: apt-repo
          path: .stage/apt-repo

      - uses: actions/download-artifact@v4
        if: steps.gate.outputs.publish == 'true'
        with:
          name: package-managers-rendered
          path: .stage/package-managers/rendered

      - name: Checkout package repo
        if: steps.gate.outputs.publish == 'true'
        uses: actions/checkout@v6
        with:
          repository: nilstate/0state-packages
          token: ${{ secrets.PACKAGES_REPO_TOKEN }}
          path: .stage/0state-packages

      - name: Publish APT repository
        if: steps.gate.outputs.publish == 'true'
        env:
          PACKAGES_REPO_DIR: ${{ github.workspace }}/.stage/0state-packages
          APT_REPO_ROOT: ${{ github.workspace }}/.stage/apt-repo/apt-repo
          APT_PUBLIC_DIR: ${{ github.workspace }}/.stage/apt-repo/apt-public
          APT_LIST_SOURCE: ${{ github.workspace }}/.stage/package-managers/rendered/apt/icey-server.list
          APT_REPO_PATH: icey
          APT_BASE_URL: https://apt.0state.com/icey
        run: bash ./scripts/publish-apt-repo.sh

      - name: Commit package repo update
        if: steps.gate.outputs.publish == 'true'
        run: |
          git -C .stage/0state-packages config user.name "github-actions[bot]"
          git -C .stage/0state-packages config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git -C .stage/0state-packages add .nojekyll index.html icey
          if git -C .stage/0state-packages diff --cached --quiet; then
            exit 0
          fi
          git -C .stage/0state-packages commit -m "icey-server ${{ needs.package-linux.outputs.cli_version }}"
          git -C .stage/0state-packages push

  publish-aur:
    runs-on: ubuntu-24.04
    needs: package-linux
    if: needs.package-linux.outputs.publish_package_managers == 'true'
    steps:
      - name: Check AUR publish credentials
        id: gate
        env:
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
          AUR_PUBLISH_ENABLED: ${{ vars.AUR_PUBLISH_ENABLED }}
        run: |
          if [[ "${AUR_PUBLISH_ENABLED:-false}" != "true" ]]; then
            echo "publish=false" >> "$GITHUB_OUTPUT"
            echo "Skipping AUR publish: AUR_PUBLISH_ENABLED is not enabled. Use make publish-aur AUR_REPO_DIR=/path/to/aur-icey-server for the local fallback."
          elif [[ -n "${AUR_SSH_PRIVATE_KEY:-}" ]]; then
            echo "publish=true" >> "$GITHUB_OUTPUT"
          else
            echo "publish=false" >> "$GITHUB_OUTPUT"
            echo "Skipping AUR publish: AUR_SSH_PRIVATE_KEY is not configured."
          fi

      - uses: actions/checkout@v6
        if: steps.gate.outputs.publish == 'true'

      - uses: actions/download-artifact@v4
        if: steps.gate.outputs.publish == 'true'
        with:
          name: package-managers-rendered
          path: .stage/package-managers/rendered

      - name: Configure SSH
        if: steps.gate.outputs.publish == 'true'
        env:
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
        run: |
          install -m 700 -d ~/.ssh
          printf '%s\n' "${AUR_SSH_PRIVATE_KEY}" | tr -d '\r' > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts

      - name: Checkout AUR package
        if: steps.gate.outputs.publish == 'true'
        env:
          GIT_SSH_COMMAND: ssh -i ~/.ssh/aur -o IdentitiesOnly=yes
        run: git clone ssh://aur@aur.archlinux.org/icey-server.git .stage/aur-repo

      - name: Publish AUR package
        if: steps.gate.outputs.publish == 'true'
        env:
          AUR_REPO_DIR: ${{ github.workspace }}/.stage/aur-repo
        run: bash ./scripts/publish-aur.sh

      - name: Commit AUR update
        if: steps.gate.outputs.publish == 'true'
        env:
          GIT_SSH_COMMAND: ssh -i ~/.ssh/aur -o IdentitiesOnly=yes
        run: |
          git -C .stage/aur-repo config user.name "github-actions[bot]"
          git -C .stage/aur-repo config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git -C .stage/aur-repo add PKGBUILD .SRCINFO
          if git -C .stage/aur-repo diff --cached --quiet; then
            exit 0
          fi
          git -C .stage/aur-repo commit -m "icey-server ${{ needs.package-linux.outputs.cli_version }}"
          git -C .stage/aur-repo push