3m-ui/.github/workflows/release.yml

name: Release stable or release candidate
on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: Existing SemVer tag to build (v1.2.3 or v1.3.0-rc.1)
        required: true
        type: string
permissions:
  contents: read
concurrency:
  group: release-formal-${{ inputs.tag || github.ref_name }}
  cancel-in-progress: false
jobs:
  metadata:
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.meta.outputs.tag }}
      sha: ${{ steps.meta.outputs.sha }}
      prerelease: ${{ steps.meta.outputs.prerelease }}
      latest: ${{ steps.meta.outputs.latest }}
      image_tag: ${{ steps.meta.outputs.image_tag }}
    steps:
      # Manual runs must build the requested tag, not the branch selected in UI.
      - uses: actions/checkout@v4
        with:
          ref: refs/tags/${{ inputs.tag || github.ref_name }}
      - name: Resolve exact tag and channel
        id: meta
        env:
          TAG: ${{ inputs.tag || github.ref_name }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          python3 scripts/release-metadata.py "$TAG"
          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
          if gh release view "$TAG" >/dev/null 2>release-error; then
            echo "Release $TAG already exists. Published versions cannot be replaced." >&2
            exit 1
          fi
          if ! grep -qiE 'release not found|HTTP 404' release-error; then
            cat release-error >&2
            exit 1
          fi
  build:
    needs: metadata
    uses: ./.github/workflows/release-build.yml
    with:
      source_sha: ${{ needs.metadata.outputs.sha }}
      version: ${{ needs.metadata.outputs.tag }}
  release:
    needs: [metadata, build]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.metadata.outputs.sha }}
      - uses: actions/download-artifact@v4
        with:
          path: release-files
          merge-multiple: true
      - name: Collect scripts and checksum every public asset
        env:
          VERSION: ${{ needs.metadata.outputs.tag }}
          REPOSITORY: ${{ github.repository }}
        run: |
          cp scripts/{install.sh,update.sh,uninstall.sh,3m-ui.sh,3m-ui} release-files/
          cp docker-compose*.yml release-files/
          cp distribution/mihomo.env release-files/
          sed -i "s#ghcr.io/kazeyukiro/3m-ui#ghcr.io/${REPOSITORY,,}#g" release-files/docker-compose*.yml
          sed -i "s#kazeyukiro/3m-ui#${REPOSITORY}#g" release-files/install.sh
          printf '%s\n' "$VERSION" > release-files/VERSION
          printf '%s\n' "$REPOSITORY" > release-files/REPOSITORY
          cd release-files
          sha256sum * > SHA256SUMS
      - uses: sigstore/cosign-installer@v3
      - name: Sign checksums using this workflow identity
        working-directory: release-files
        run: |
          cosign sign-blob --yes --output-certificate SHA256SUMS.pem \
            --output-signature SHA256SUMS.sig SHA256SUMS
      - name: Publish once without overwriting assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ needs.metadata.outputs.tag }}
          PRERELEASE: ${{ needs.metadata.outputs.prerelease }}
          LATEST: ${{ needs.metadata.outputs.latest }}
        run: |
          cat > release-notes.md <<'NOTES'
          Complete Linux installation bundles are provided for amd64 and arm64.
          Each bundle includes the panel, its pinned Mihomo core and lifecycle scripts.
          Other architectures are standalone panel builds for advanced installations.
          Verify downloads against SHA256SUMS. SHA256SUMS.pem and SHA256SUMS.sig
          provide Sigstore keyless verification for this release workflow.
          Docker images are published to ghcr.io/<owner>/<repository>:<tag>.
          The latest image and default installer follow stable releases only.
          NOTES
          # Reserve a new release; no --clobber or action asset overwrite behavior.
          # A failed upload leaves a draft that maintainers must inspect explicitly.
          gh release create "$TAG" --verify-tag --draft --title "$TAG" \
            --notes-file release-notes.md --generate-notes
          gh release upload "$TAG" release-files/*
          gh release edit "$TAG" --draft=false --prerelease="$PRERELEASE" --latest="$LATEST"
  image:
    needs: [metadata, release]
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/release-image.yml
    with:
      source_sha: ${{ needs.metadata.outputs.sha }}
      version: ${{ needs.metadata.outputs.tag }}
      image_tag: ${{ needs.metadata.outputs.image_tag }}
      latest: ${{ needs.metadata.outputs.latest == 'true' }}