name: release on: push: tags: ["v*"] # Dry run: builds, SBOM, attestations and workflow artifacts only. The GitHub # Release and the image push are gated on github.event_name == 'push'. workflow_dispatch: permissions: contents: write # required to create the Release jobs: # ① Frontend static export (once), reused by the cross-compiled platform builds frontend: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: "22" cache: npm cache-dependency-path: web/package-lock.json - run: npm ci working-directory: web - run: npm run build:static working-directory: web - uses: actions/upload-artifact@v4 with: name: web-dist path: web/out # ② Cross-compile for five platforms (with embedded frontend) + zip packaging binaries: needs: frontend runs-on: ubuntu-latest strategy: matrix: include: - { goos: linux, goarch: amd64 } - { goos: linux, goarch: arm64 } - { goos: darwin, goarch: amd64 } - { goos: darwin, goarch: arm64 } - { goos: windows, goarch: amd64 } steps: - uses: actions/checkout@v4 - uses: actions/setup-go@v5 with: go-version: "1.26" cache: true - uses: actions/download-artifact@v4 with: name: web-dist path: server/webui/dist - name: Build and package with build.sh env: ARTEX_TARGET_OS: ${{ matrix.goos }} ARTEX_TARGET_ARCH: ${{ matrix.goarch }} ARTEX_BUILD_VERSION: ${{ github.ref_name }} ARTEX_SKIP_FRONTEND: "1" ARTEX_SKIP_NPM_CI: "1" # UPX self-extracting ELF binaries crash on some Linux kernels, virtualization # setups, and security policies. Releases use Go linker trimming and zip # compression, prioritizing portability. ARTEX_COMPRESS: "0" ARTEX_PACKAGE: "1" ARTEX_PACKAGE_DIR: dist run: | ./build.sh --target "${ARTEX_TARGET_OS}/${ARTEX_TARGET_ARCH}" - name: Smoke test Linux amd64 binary if: matrix.goos == 'linux' && matrix.goarch == 'amd64' run: dist/artex-linux-amd64/artex -h - uses: actions/upload-artifact@v4 with: name: pkg-${{ matrix.goos }}-${{ matrix.goarch }} path: "dist/*.zip" # Upload raw Linux binaries separately for reuse by the docker job (avoids rebuilding the frontend + Go inside the image) - if: matrix.goos == 'linux' uses: actions/upload-artifact@v4 with: name: bin-linux-${{ matrix.goarch }} path: dist/artex-linux-${{ matrix.goarch }}/artex # ③ Collect all zips → create the GitHub Release release: needs: binaries runs-on: ubuntu-latest permissions: contents: write # create the Release (softprops/action-gh-release) id-token: write # Sigstore signing of the provenance attestation attestations: write # store the attestation on the repository steps: - uses: actions/checkout@v4 # CHANGELOG.md and the extractor script - uses: actions/download-artifact@v4 with: pattern: pkg-* merge-multiple: true path: dist - name: Generate checksums working-directory: dist run: sha256sum *.zip > SHA256SUMS # SBOM of what ships: the Go modules embedded in the linux/amd64 binary, plus # the frontend lockfile and the Go module files. - uses: actions/download-artifact@v4 with: name: bin-linux-amd64 path: ${{ runner.temp }}/sbom-src/bin - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 id: syft with: syft-version: v1.54.0 - name: Generate CycloneDX SBOM env: SYFT: ${{ steps.syft.outputs.cmd }} SRC: ${{ runner.temp }}/sbom-src TAG: ${{ github.ref_name }} run: | mkdir -p "$SRC/web" cp go.mod go.sum "$SRC/" cp web/package-lock.json "$SRC/web/" sbom="dist/artex-${TAG}.cdx.json" "$SYFT" scan "dir:$SRC" --source-name artex --source-version "$TAG" -o "cyclonedx-json=$sbom" grep -q '"pkg:golang/' "$sbom" || { echo "::error::SBOM has no pkg:golang entries"; exit 1; } grep -q '"pkg:npm/' "$sbom" || { echo "::error::SBOM has no pkg:npm entries"; exit 1; } echo "SBOM_PATH=$sbom" >> "$GITHUB_ENV" - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: dist/*.zip - uses: actions/upload-artifact@v4 with: name: release-metadata path: | dist/SHA256SUMS ${{ env.SBOM_PATH }} - name: Release body from CHANGELOG.md env: TAG: ${{ github.ref_name }} run: | version="${TAG#v}" if bash scripts/extract-changelog-section.sh "$version" CHANGELOG.md > "$RUNNER_TEMP/release-body.md"; then echo "Release body: CHANGELOG.md section [$version]" else echo "::warning::CHANGELOG.md has no section [$version]; using the generic release body" echo "Release $TAG. See CHANGELOG.md for the list of changes in this release." > "$RUNNER_TEMP/release-body.md" fi - uses: softprops/action-gh-release@v2 if: github.event_name == 'push' with: files: | dist/*.zip dist/SHA256SUMS ${{ env.SBOM_PATH }} generate_release_notes: false body_path: ${{ runner.temp }}/release-body.md # ④ Multi-arch image → push to Docker Hub (reuses the Linux binaries built by the # binaries job; the image only installs tools + ships the binary; arm64 only needs # to emulate the apt layer, so builds are much faster) # Publishing the image needs Docker Hub credentials and a namespace we own, so the # job stays skipped unless the repository defines DOCKERHUB_ENABLED (set it to true # and provide DOCKERHUB_USERNAME / DOCKERHUB_TOKEN secrets plus DOCKERHUB_IMAGE). docker: needs: binaries if: ${{ vars.DOCKERHUB_ENABLED == 'true' && github.event_name == 'push' }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 # fetch the Dockerfile and skills/ - uses: actions/download-artifact@v4 with: name: bin-linux-amd64 path: dist/amd64 - uses: actions/download-artifact@v4 with: name: bin-linux-arm64 path: dist/arm64 - uses: docker/setup-qemu-action@v3 - uses: docker/setup-buildx-action@v3 - uses: docker/login-action@v3 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - uses: docker/metadata-action@v5 id: meta with: images: ${{ vars.DOCKERHUB_IMAGE }} tags: | type=ref,event=tag type=raw,value=latest - uses: docker/build-push-action@v6 with: context: . platforms: linux/amd64,linux/arm64 push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max