release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version (e.g., 2.41 or 2.41.1)'
        required: true
        type: string

permissions:
  contents: write
  packages: write

jobs:
  preflight:
    runs-on: ubuntu-24.04
    outputs:
      ci-image: ${{ steps.image.outputs.ci }}
      current-version: ${{ steps.current.outputs.version }}
    steps:
      - name: Validate version format
        run: |
          VERSION="${{ inputs.version }}"
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then
            echo "::error::Invalid version format '$VERSION'. Expected X.Y or X.Y.Z (e.g., 2.41 or 2.41.1)"
            exit 1
          fi

      - name: Check tag does not already exist
        run: |
          if git ls-remote --tags origin "refs/tags/v${{ inputs.version }}" | grep -q .; then
            echo "::error::Tag v${{ inputs.version }} already exists on the remote. Delete it first or choose a different version."
            exit 1
          fi

      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-tags: true

      - name: Extract current version and validate
        id: current
        run: |
          CURRENT=$(perl -ne "print \$1 if /\\bVERSION\\s*=\\s*'([^']+)'/" server/lib/NicToolServer.pm)
          if [ -z "$CURRENT" ]; then
            echo "::error::Could not extract version from server/lib/NicToolServer.pm"
            exit 1
          fi
          echo "version=$CURRENT" >> "$GITHUB_OUTPUT"

          NEW="${{ inputs.version }}"
          if [ "$CURRENT" = "$NEW" ]; then
            echo "::error::Version $NEW is already the current version"
            exit 1
          fi

          OLDEST=$(printf '%s\n%s\n' "$CURRENT" "$NEW" | sort -V | head -n1)
          if [ "$OLDEST" != "$CURRENT" ]; then
            echo "::error::Version $NEW is older than current version $CURRENT"
            exit 1
          fi

      - name: Compute CI image name
        id: image
        run: echo "ci=ghcr.io/${GITHUB_REPOSITORY,,}/build:latest" >> "$GITHUB_OUTPUT"

  test:
    needs: preflight
    runs-on: ubuntu-24.04
    container:
      image: ${{ needs.preflight.outputs.ci-image }}
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    services:
      mysql:
        image: mysql:8
        env:
          MYSQL_ROOT_PASSWORD: root
          MYSQL_DATABASE: nictool
        options: >-
          --health-cmd="mysqladmin ping -h 127.0.0.1"
          --health-interval=5s
          --health-timeout=3s
          --health-retries=10

    steps:
      - uses: actions/checkout@v6

      - name: Generate test credentials
        run: |
          DB_PW=$(openssl rand -base64 24)
          ROOT_PW=$(openssl rand -base64 24)
          echo "NICTOOL_DB_USER_PASSWORD=$DB_PW" >> "$GITHUB_ENV"
          echo "DB_ROOT_PASSWORD=root" >> "$GITHUB_ENV"
          echo "NICTOOL_DB_USER=nictool" >> "$GITHUB_ENV"
          echo "NICTOOL_DB_NAME=nictool" >> "$GITHUB_ENV"
          echo "DB_ENGINE=mysql" >> "$GITHUB_ENV"
          echo "DB_HOSTNAME=mysql" >> "$GITHUB_ENV"
          echo "ROOT_USER_EMAIL=ci@nictool.test" >> "$GITHUB_ENV"
          echo "ROOT_USER_PASSWORD=$ROOT_PW" >> "$GITHUB_ENV"
          echo "NICTOOL_CLIENT_DIR=$GITHUB_WORKSPACE/client" >> "$GITHUB_ENV"

      - name: Install NicTool client and server
        run: |
          cd "$GITHUB_WORKSPACE/client"
          perl Makefile.PL
          cpanm -n .

          cd "$GITHUB_WORKSPACE/server"
          perl Makefile.PL
          cpanm -n .

      - name: Allow Apache to traverse workspace path
        run: |
          dir="$GITHUB_WORKSPACE"
          while [ "$dir" != "/" ]; do
            chmod o+x "$dir"
            dir="$(dirname "$dir")"
          done

      - name: Set up NicTool configs, Apache, and TLS
        run: dist/setup/install-nictool.sh --nt-dir="$GITHUB_WORKSPACE"

      - name: Start Apache
        run: apachectl start

      - name: Create NicTool test database
        run: |
          cd "$GITHUB_WORKSPACE/server/sql"
          echo "" | perl create_tables.pl --environment

      - name: Create test user and test.cfg
        run: perl dist/setup/setup-test-env.pl

      - name: Run client tests
        run: make -C "$GITHUB_WORKSPACE/client" test

      - name: Run server tests
        run: make -C "$GITHUB_WORKSPACE/server" test

      - name: Failure diagnostics
        if: failure()
        run: |
          mysql --version
          apache2 -version
          cat /var/log/apache2/error.log || true

  release:
    needs: [preflight, test]
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-tags: true

      - name: Setup Perl
        uses: shogo82148/actions-setup-perl@v1
        with:
          perl-version: '5.38'

      - name: Bump version
        run: |
          chmod +x .release/version-bump.sh
          .release/version-bump.sh "${{ needs.preflight.outputs.current-version }}" "${{ inputs.version }}"

      - name: Commit and tag
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add -u
          git commit -m "release v${{ inputs.version }}"
          git tag "v${{ inputs.version }}"
          git push origin HEAD --tags

      - name: Build distributions
        run: |
          cd "$GITHUB_WORKSPACE/server/api"
          perl Makefile.PL && make && make dist

          cd "$GITHUB_WORKSPACE"
          perl Makefile.PL && make bundle

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ inputs.version }}
          name: NicTool v${{ inputs.version }}
          generate_release_notes: true
          files: |
            NicTool.tar.gz
            client/NicToolClient-*.tar.gz
            server/NicToolServer-*.tar.gz
            server/api/NicTool-*.tar.gz

  docker-build:
    needs: release
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner:   ubuntu-24.04
          - platform: linux/arm64
            runner:   ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v6
        with:
          ref: v${{ inputs.version }}

      - name: Compute image name
        id: meta
        run: |
          echo "image=ghcr.io/$(echo ${GITHUB_REPOSITORY,,})/dist" >> "$GITHUB_OUTPUT"
          echo "platform_pair=$(echo ${{ matrix.platform }} | tr / -)" >> "$GITHUB_OUTPUT"

      - uses: docker/setup-buildx-action@v4

      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Build and push by digest only — the merge job tags both
      # :${version} and :latest from the resulting digests.
      - id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          file: dist/docker/Dockerfile
          platforms: ${{ matrix.platform }}
          tags: ${{ steps.meta.outputs.image }}
          outputs: type=image,push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=dist-${{ steps.meta.outputs.platform_pair }}
          cache-to:   type=gha,scope=dist-${{ steps.meta.outputs.platform_pair }},mode=max

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - uses: actions/upload-artifact@v4
        with:
          name: dist-digest-${{ steps.meta.outputs.platform_pair }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  docker-merge:
    needs: docker-build
    runs-on: ubuntu-24.04
    steps:
      - name: Compute image name
        id: meta
        run: echo "image=ghcr.io/$(echo ${GITHUB_REPOSITORY,,})/dist" >> "$GITHUB_OUTPUT"

      - uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: dist-digest-*
          merge-multiple: true

      - uses: docker/setup-buildx-action@v4

      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create multi-arch manifest
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create \
            -t ${{ steps.meta.outputs.image }}:${{ inputs.version }} \
            -t ${{ steps.meta.outputs.image }}:latest \
            $(printf '${{ steps.meta.outputs.image }}@sha256:%s ' *)

      - name: Inspect manifest
        run: docker buildx imagetools inspect ${{ steps.meta.outputs.image }}:${{ inputs.version }}