convertis/.github/workflows/release.yml

name: Release

on:
  push:
    branches: ["main"]

jobs:
  check-release:
    runs-on: ubuntu-latest
    outputs:
      match: ${{ steps.check.outputs.match }}
      version: ${{ steps.check.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Check for a new stable engine version
        id: check
        env:
          BEFORE: ${{ gitea.event.before }}
        run: |
          version=$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n1)
          previous=""
          if [[ -n "$BEFORE" ]] && git cat-file -e "$BEFORE:Cargo.toml" 2>/dev/null; then
            previous=$(git show "$BEFORE:Cargo.toml" | sed -n 's/^version = "\([^"]*\)"/\1/p' | head -n1)
          fi
          if [[ -n "$version" && "$version" != *-dev* && "$version" != "$previous" ]]; then
            echo "match=true" >> "$GITHUB_OUTPUT"
            echo "version=$version" >> "$GITHUB_OUTPUT"
          else
            echo "match=false" >> "$GITHUB_OUTPUT"
          fi

  build:
    needs: check-release
    if: needs.check-release.outputs.match == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-gnu
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --package convertis --locked
      - run: cargo build --release --package convertis --locked --target x86_64-unknown-linux-gnu
      - uses: actions/upload-artifact@v3
        with:
          name: build-linux
          if-no-files-found: error
          path: |
            target/x86_64-unknown-linux-gnu/release/convertis
            target/man/convertis.1

  package:
    needs: [check-release, build]
    strategy:
      matrix:
        type: [deb, rpm]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: stable
      - name: Install nFPM
        run: go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.47.0
      - uses: actions/download-artifact@v3
        with:
          name: build-linux
          path: target/
      - name: Build packages
        run: |
          export PATH="$HOME/go/bin:$PATH"
          bash packaging/build-packages.sh "${{ matrix.type }}" "${{ needs.check-release.outputs.version }}" target/x86_64-unknown-linux-gnu/release dist
      - name: Import GPG key
        if: matrix.type == 'rpm'
        id: import-gpg
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}
      - name: Sign and verify RPMs
        if: matrix.type == 'rpm'
        env:
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: |
          sudo apt-get update
          sudo apt-get install -y rpm
          passphrase_file=$(mktemp)
          public_key_file=$(mktemp)
          trap 'rm -f "$passphrase_file" "$public_key_file"' EXIT
          printf '%s' "$GPG_PASSPHRASE" > "$passphrase_file"
          chmod 600 "$passphrase_file"
          echo "%_signature gpg" > ~/.rpmmacros
          echo "%_gpg_name ${{ steps.import-gpg.outputs.keyid }}" >> ~/.rpmmacros
          echo "%_gpg_path $HOME/.gnupg" >> ~/.rpmmacros
          echo "%_gpg_passphrase_file $passphrase_file" >> ~/.rpmmacros
          echo '%__gpg_sign_cmd /usr/bin/gpg --batch --yes --pinentry-mode loopback --passphrase-file %{_gpg_passphrase_file} --no-verbose --no-armor --no-secmem-warning -u %{_gpg_name} -sbo %{__signature_filename} -- %{__plaintext_filename}' >> ~/.rpmmacros
          rpm --addsign dist/*.rpm
          gpg --armor --export "${{ steps.import-gpg.outputs.keyid }}" > "$public_key_file"
          sudo rpm --import "$public_key_file"
          signature_check=$(rpm --checksig --verbose dist/*.rpm)
          echo "$signature_check"
          signed_count=$(echo "$signature_check" | grep -Ec '[Ss]ignature.*: OK')
          package_count=$(find dist -maxdepth 1 -name '*.rpm' | wc -l)
          test "$signed_count" -ge "$package_count"
      - uses: actions/upload-artifact@v3
        with:
          name: packages-${{ matrix.type }}
          if-no-files-found: error
          path: dist/*

  publish:
    needs: [check-release, build, package]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/download-artifact@v3
        with:
          path: all-artifacts
          merge-multiple: false
      - name: Prepare release assets
        run: |
          mkdir -p release-assets
          binary=$(find all-artifacts/build-linux -type f -name convertis | head -n1)
          cp "$binary" release-assets/convertis-x86_64-unknown-linux-gnu
      - name: Generate changelog
        run: |
          last_tag=$(git describe --tags --abbrev=0 2>/dev/null || git rev-list --max-parents=0 HEAD)
          git log "${last_tag}..HEAD" --pretty=format:'- %s (%an)' > changelog.md
      - name: Create Gitea release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.check-release.outputs.version }}
          name: Release v${{ needs.check-release.outputs.version }}
          body_path: changelog.md
          files: |
            release-assets/convertis-x86_64-unknown-linux-gnu
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Publish packages to Gitea registries
        env:
          GITEA_URL: ${{ github.server_url }}
          GITEA_OWNER: ${{ github.repository_owner }}
          TOKEN: ${{ secrets.PACKAGE_PAT }}
        run: |
          find all-artifacts/packages-rpm -type f -name '*.rpm' | while read -r package; do
            code=$(curl -sS -w '%{http_code}' -o /dev/null -u "${{ github.actor }}:$TOKEN" --upload-file "$package" "$GITEA_URL/api/packages/$GITEA_OWNER/rpm/upload")
            test "$code" = 201 || test "$code" = 409
          done
          find all-artifacts/packages-deb -type f -name '*.deb' | while read -r package; do
            code=$(curl -sS -w '%{http_code}' -o /dev/null -u "${{ github.actor }}:$TOKEN" --upload-file "$package" "$GITEA_URL/api/packages/$GITEA_OWNER/debian/pool/debian/main/upload")
            test "$code" = 201 || test "$code" = 409
          done