release.yml

name: release

on:
  push:
    tags:
      - "v[0-9]*.[0-9]*.[0-9]*"

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: astral-sh/setup-uv@v9.0.0
        with:
          python-version: "3.14"
          enable-cache: true
      - run: uv sync --locked
      - name: Verify release version
        run: |
          VERSION="$(uv run evdb --version)"
          test "v${VERSION#evdb }" = "${GITHUB_REF_NAME}"
      - run: make check

  build:
    needs: check
    strategy:
      fail-fast: true
      matrix:
        include:
          - runner: ubuntu-22.04
            arch: amd64
          - runner: ubuntu-22.04-arm
            arch: arm64
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: astral-sh/setup-uv@v9.0.0
        with:
          python-version: "3.14"
          enable-cache: true
      - run: uv sync --locked
      - run: make binary
      - name: Smoke test standalone executable
        run: |
          VERSION="$(dist/evdb --version)"
          test "v${VERSION#evdb }" = "${GITHUB_REF_NAME}"
          uv run pyi-archive_viewer -l dist/evdb > binary-members.txt
          grep -F "evdb/units/evdb-backup.service" binary-members.txt
          grep -F "evdb/units/evdb-backup.timer" binary-members.txt
      - name: Assemble release executable
        run: |
          ASSET="evdb_linux_${{ matrix.arch }}"
          install -d -m 0755 artifacts
          install -m 0755 dist/evdb "artifacts/${ASSET}"
          (cd artifacts && sha256sum "${ASSET}" > "${ASSET}.sha256")
          uv run python tools/check_release.py "artifacts/${ASSET}" "${GITHUB_REF_NAME}"
        working-directory: ${{ github.workspace }}
      - uses: actions/upload-artifact@v7
        with:
          name: release-${{ matrix.arch }}
          path: artifacts/*
          if-no-files-found: error
          retention-days: 1

  notes:
    needs: build
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      pull-requests: read
    outputs:
      available: ${{ steps.result.outputs.available }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Set up Node.js for release notes
        id: node
        continue-on-error: true
        timeout-minutes: 5
        uses: actions/setup-node@v7
        with:
          node-version: "24"
      - name: Install OpenCode for release notes
        id: opencode
        if: steps.node.outcome == 'success'
        continue-on-error: true
        timeout-minutes: 5
        run: npm install --global opencode-ai@1.18.6
      - name: Generate release notes
        id: generate
        continue-on-error: true
        timeout-minutes: 10
        env:
          RELEASE_LLM_URL: ${{ secrets.RELEASE_LLM_URL }}
          RELEASE_LLM_KEY: ${{ secrets.RELEASE_LLM_KEY }}
          GH_TOKEN: ${{ github.token }}
          OPENCODE_CONFIG_CONTENT: >-
            {"provider":{"openai":{"options":{"baseURL":"{env:RELEASE_LLM_URL}","apiKey":"{env:RELEASE_LLM_KEY}"},"models":{"gpt-5.6-sol":{"name":"gpt-5.6-sol","limit":{"context":353000,"output":128000},"variants":{"high":{"reasoningEffort":"high"}}}}}}}
        run: |
          test "${{ steps.node.outcome }}" = "success"
          test "${{ steps.opencode.outcome }}" = "success"
          test -n "${RELEASE_LLM_URL}"
          test -n "${RELEASE_LLM_KEY}"
          opencode run --pure --command changelog "${GITHUB_REF_NAME}"
          python3 tools/release_notes.py release-notes.md
      - name: Upload OpenCode release notes
        id: upload
        if: steps.generate.outcome == 'success'
        continue-on-error: true
        uses: actions/upload-artifact@v7
        with:
          name: opencode-release-notes
          path: release-notes.md
          if-no-files-found: error
          retention-days: 1
      - name: Record release note availability
        id: result
        if: always()
        env:
          GENERATED: ${{ steps.generate.outcome }}
          UPLOADED: ${{ steps.upload.outcome }}
        run: |
          if test "${GENERATED}" = "success" && test "${UPLOADED}" = "success"; then
            echo "available=true" >> "${GITHUB_OUTPUT}"
          else
            echo "available=false" >> "${GITHUB_OUTPUT}"
            echo "::notice::OpenCode release notes unavailable; GitHub automatic notes will be used"
          fi

  publish:
    needs: [build, notes]
    if: ${{ !cancelled() && needs.build.result == 'success' }}
    runs-on: ubuntu-22.04
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/download-artifact@v8
        with:
          pattern: release-*
          path: release
          merge-multiple: true
      - name: Add installer
        run: install -m 0755 install.sh release/install.sh
      - name: Attest release executables
        uses: actions/attest@v4
        with:
          subject-path: release/evdb_linux_*
      - name: Download OpenCode release notes
        id: notes-download
        if: needs.notes.outputs.available == 'true'
        continue-on-error: true
        uses: actions/download-artifact@v8
        with:
          name: opencode-release-notes
          path: .
      - name: Validate OpenCode release notes
        id: notes
        if: steps.notes-download.outcome == 'success'
        continue-on-error: true
        run: python3 tools/release_notes.py release-notes.md
      - name: Verify release tag is unchanged
        run: test "$(git rev-parse "refs/tags/${GITHUB_REF_NAME}^{commit}")" = "${GITHUB_SHA}"
      - name: Publish GitHub release with OpenCode notes
        if: steps.notes.outcome == 'success'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: >-
          gh release create "${GITHUB_REF_NAME}" release/*
          --verify-tag --notes-file release-notes.md --title "${GITHUB_REF_NAME}"
      - name: Publish GitHub release with automatic notes
        if: steps.notes.outcome != 'success'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "::notice::OpenCode release notes unavailable; using GitHub automatic notes"
          gh release create "${GITHUB_REF_NAME}" release/* \
            --verify-tag --generate-notes --title "${GITHUB_REF_NAME}"