ARTEX/.github/workflows/release.yml

name: release
on:
  push:
    tags: ["v*"]
  # Dry run: builds, SBOM, attestations and workflow artifacts only. The GitHub
  # Release and the image push are gated on github.event_name == 'push'.
  workflow_dispatch:

permissions:
  contents: write # required to create the Release

jobs:
  # ① Frontend static export (once), reused by the cross-compiled platform builds
  frontend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: web/package-lock.json
      - run: npm ci
        working-directory: web
      - run: npm run build:static
        working-directory: web
      - uses: actions/upload-artifact@v4
        with:
          name: web-dist
          path: web/out

  # ② Cross-compile for five platforms (with embedded frontend) + zip packaging
  binaries:
    needs: frontend
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - { goos: linux, goarch: amd64 }
          - { goos: linux, goarch: arm64 }
          - { goos: darwin, goarch: amd64 }
          - { goos: darwin, goarch: arm64 }
          - { goos: windows, goarch: amd64 }
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: "1.26"
          cache: true
      - uses: actions/download-artifact@v4
        with:
          name: web-dist
          path: server/webui/dist
      - name: Build and package with build.sh
        env:
          ARTEX_TARGET_OS: ${{ matrix.goos }}
          ARTEX_TARGET_ARCH: ${{ matrix.goarch }}
          ARTEX_BUILD_VERSION: ${{ github.ref_name }}
          ARTEX_SKIP_FRONTEND: "1"
          ARTEX_SKIP_NPM_CI: "1"
          # UPX self-extracting ELF binaries crash on some Linux kernels, virtualization
          # setups, and security policies. Releases use Go linker trimming and zip
          # compression, prioritizing portability.
          ARTEX_COMPRESS: "0"
          ARTEX_PACKAGE: "1"
          ARTEX_PACKAGE_DIR: dist
        run: |
          ./build.sh --target "${ARTEX_TARGET_OS}/${ARTEX_TARGET_ARCH}"
      - name: Smoke test Linux amd64 binary
        if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
        run: dist/artex-linux-amd64/artex -h
      - uses: actions/upload-artifact@v4
        with:
          name: pkg-${{ matrix.goos }}-${{ matrix.goarch }}
          path: "dist/*.zip"
      # Upload raw Linux binaries separately for reuse by the docker job (avoids rebuilding the frontend + Go inside the image)
      - if: matrix.goos == 'linux'
        uses: actions/upload-artifact@v4
        with:
          name: bin-linux-${{ matrix.goarch }}
          path: dist/artex-linux-${{ matrix.goarch }}/artex

  # ③ Collect all zips → create the GitHub Release
  release:
    needs: binaries
    runs-on: ubuntu-latest
    permissions:
      contents: write # create the Release (softprops/action-gh-release)
      id-token: write # Sigstore signing of the provenance attestation
      attestations: write # store the attestation on the repository
    steps:
      - uses: actions/checkout@v4 # CHANGELOG.md and the extractor script
      - uses: actions/download-artifact@v4
        with:
          pattern: pkg-*
          merge-multiple: true
          path: dist
      - name: Generate checksums
        working-directory: dist
        run: sha256sum *.zip > SHA256SUMS
      # SBOM of what ships: the Go modules embedded in the linux/amd64 binary, plus
      # the frontend lockfile and the Go module files.
      - uses: actions/download-artifact@v4
        with:
          name: bin-linux-amd64
          path: ${{ runner.temp }}/sbom-src/bin
      - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
        id: syft
        with:
          syft-version: v1.54.0
      - name: Generate CycloneDX SBOM
        env:
          SYFT: ${{ steps.syft.outputs.cmd }}
          SRC: ${{ runner.temp }}/sbom-src
          TAG: ${{ github.ref_name }}
        run: |
          mkdir -p "$SRC/web"
          cp go.mod go.sum "$SRC/"
          cp web/package-lock.json "$SRC/web/"
          sbom="dist/artex-${TAG}.cdx.json"
          "$SYFT" scan "dir:$SRC" --source-name artex --source-version "$TAG" -o "cyclonedx-json=$sbom"
          grep -q '"pkg:golang/' "$sbom" || { echo "::error::SBOM has no pkg:golang entries"; exit 1; }
          grep -q '"pkg:npm/' "$sbom" || { echo "::error::SBOM has no pkg:npm entries"; exit 1; }
          echo "SBOM_PATH=$sbom" >> "$GITHUB_ENV"
      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: dist/*.zip
      - uses: actions/upload-artifact@v4
        with:
          name: release-metadata
          path: |
            dist/SHA256SUMS
            ${{ env.SBOM_PATH }}
      - name: Release body from CHANGELOG.md
        env:
          TAG: ${{ github.ref_name }}
        run: |
          version="${TAG#v}"
          if bash scripts/extract-changelog-section.sh "$version" CHANGELOG.md > "$RUNNER_TEMP/release-body.md"; then
            echo "Release body: CHANGELOG.md section [$version]"
          else
            echo "::warning::CHANGELOG.md has no section [$version]; using the generic release body"
            echo "Release $TAG. See CHANGELOG.md for the list of changes in this release." > "$RUNNER_TEMP/release-body.md"
          fi
      - uses: softprops/action-gh-release@v2
        if: github.event_name == 'push'
        with:
          files: |
            dist/*.zip
            dist/SHA256SUMS
            ${{ env.SBOM_PATH }}
          generate_release_notes: false
          body_path: ${{ runner.temp }}/release-body.md

  # ④ Multi-arch image → push to Docker Hub (reuses the Linux binaries built by the
  #    binaries job; the image only installs tools + ships the binary; arm64 only needs
  #    to emulate the apt layer, so builds are much faster)
  # Publishing the image needs Docker Hub credentials and a namespace we own, so the
  # job stays skipped unless the repository defines DOCKERHUB_ENABLED (set it to true
  # and provide DOCKERHUB_USERNAME / DOCKERHUB_TOKEN secrets plus DOCKERHUB_IMAGE).
  docker:
    needs: binaries
    if: ${{ vars.DOCKERHUB_ENABLED == 'true' && github.event_name == 'push' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4 # fetch the Dockerfile and skills/
      - uses: actions/download-artifact@v4
        with:
          name: bin-linux-amd64
          path: dist/amd64
      - uses: actions/download-artifact@v4
        with:
          name: bin-linux-arm64
          path: dist/arm64
      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: ${{ vars.DOCKERHUB_IMAGE }}
          tags: |
            type=ref,event=tag
            type=raw,value=latest
      - uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max