release.yml

# Copyright (c) 2024 Hemi Labs, Inc.
# Use of this source code is governed by the MIT License,
# which can be found in the LICENSE file.

# GitHub Actions workflow to create releases.
# Releases are published from tags matching "v*.*.*".
name: "Release"
on:
  push:
    tags: [ "v*.*.*" ]

concurrency:
  group: "release-${{ github.ref }}"
  cancel-in-progress: true

env:
  GO_VERSION: "1.23.x"
  PNPM_VERSION: "9.4.x"
  GO_LDFLAGS: >-
    -X 'github.com/hemilabs/heminetwork/version.Brand=Hemi Labs'
    -X github.com/hemilabs/heminetwork/version.PreRelease=

jobs:
  # Build and test
  test-go:
    name: "Test (Go)"
    uses: ./.github/workflows/go.yml

  # Prepare to release
  prepare:
    name: "Prepare"
    runs-on: "ubuntu-latest"
    permissions:
      contents: read
    outputs:
      version: "${{ steps.version.outputs.version }}"
      tag: "${{ steps.version.outputs.tag }}"
      version_type: "${{ steps.version.outputs.type }}"
    steps:
      - name: "Determine version type"
        id: version
        env:
          RAW_VERSION: "${{ github.ref_name }}"
        # This script determines the version type (stability), e.g.
        #  1.0.0 = stable, 1.1.0-rc.1 = unstable, 0.1.0 = unstable
        run: |
          VERSION=$(echo "$RAW_VERSION" | sed -e 's/^v//')
          TAG=$(echo "$RAW_VERSION" | sed -E 's/^([^v])/v\1/g')
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"

          TYPE=unstable
          if echo "$VERSION" | grep -Eq '^[1-9][0-9]*\.[0-9]+\.[0-9]+$'; then
            TYPE=stable
          fi
          echo "Detected that $TAG is $TYPE"
          echo "type=$TYPE" >> "$GITHUB_OUTPUT"

  # Publish NPM packages
  npm:
    name: "npm"
    runs-on: "ubuntu-latest"
    needs: [ "prepare" ]
    permissions:
      contents: read
    steps:
      - name: "Checkout repository"
        uses: actions/checkout@v4

      - name: "Setup Go ${{ env.GO_VERSION }}"
        uses: actions/setup-go@v5
        with:
          go-version: "${{ env.GO_VERSION }}"
          cache: true
          check-latest: true

      - name: "Setup pnpm ${{ env.PNPM_VERSION }}"
        uses: pnpm/action-setup@v4
        with:
          version: "${{ env.PNPM_VERSION }}"

      - name: "Setup Node"
        uses: actions/setup-node@v4
        with:
          node-version-file: "web/.nvmrc"
          check-latest: true
          cache: "pnpm"
          cache-dependency-path: "web/**/pnpm-lock.yaml"
          registry-url: "https://registry.npmjs.org"

      - name: "Install dependencies"
        working-directory: "web/"
        run: pnpm install --frozen-lockfile

      - name: "Install Go dependencies"
        working-directory: "web/"
        run: make deps

      - name: "Set package.json versions"
        working-directory: "web/"
        env:
          VERSION: "${{ needs.prepare.outputs.version }}"
        run: |
          # Prints all package.json files
          PACKAGE_FILES=$(find . -path '**/node_modules' -prune -o -name 'package.json' -print)
          for file in $PACKAGE_FILES; do
            # Set "version" in package.json file to $VERSION.
            TMP_FILE="$(mktemp)"
            jq --arg v "$VERSION" '.version = $v' "$file" > "$TMP_FILE"
            mv "$TMP_FILE" "$file"
          done

        # TODO(joshuasing): Install and use binaryen
      - name: "Build @hemilabs/pop-miner WebAssembly binary"
        working-directory: "web/"
        run: make wasm

      - name: "Build @hemilabs/pop-miner package"
        working-directory: "web/"
        run: pnpm build:pop-miner

      - name: "Publish @hemilabs/pop-miner package"
        working-directory: "web/"
        run: pnpm publish packages/pop-miner --access public --no-git-checks
        env:
          NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}"

  # Create GitHub Release
  release:
    name: "Release"
    runs-on: "ubuntu-latest"
    needs: [ "test-go", "npm" ]
    permissions:
      # Required to create GitHub releases.
      contents: write
      # Required for Sigstore cosign authentication.
      id-token: write
      # Required to publish to GitHub Container Registry.
      packages: write
    steps:
      - name: "Checkout repository"
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: "Setup Go ${{ env.GO_VERSION }}"
        uses: actions/setup-go@v5
        with:
          go-version: "${{ env.GO_VERSION }}"
          cache: true
          check-latest: true

      - name: "Install cosign"
        uses: sigstore/cosign-installer@v3.6.0

      - name: "Install Syft"
        uses: anchore/sbom-action/download-syft@v0.17.0

      - name: "Setup QEMU"
        uses: docker/setup-qemu-action@v3

      - name: "Setup Docker Buildx"
        uses: docker/setup-buildx-action@v3

      - name: "Login to DockerHub"
        uses: docker/login-action@v3
        with:
          username: "${{ secrets.DOCKERHUB_USERNAME }}"
          password: "${{ secrets.DOCKERHUB_TOKEN }}"

      - name: "Login to GitHub Container Registry"
        uses: docker/login-action@v3
        with:
          registry: "ghcr.io"
          username: "${{ github.repository_owner }}"
          password: "${{ secrets.GITHUB_TOKEN }}"

      - name: "Release"
        uses: goreleaser/goreleaser-action@v6
        with:
          distribution: "goreleaser"
          version: "~> v2"
          args: "release --clean"
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"