3m-ui/.github/workflows/release.yml

name: Release · Ant Design
# Pure-Go static binaries (CGO_ENABLED=0 + modernc sqlite) for maximum Linux portability:
# works on glibc and musl (Alpine), old and new distros, without system libsqlite3.
on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: Release tag (e.g. v0.1.0). Required for manual runs on a branch.
        required: false
        type: string
permissions:
  contents: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          # x86_64 — GOAMD64=v1 for broadest CPU compatibility (pre-AVX hosts)
          - goarch: amd64
            goamd64: v1
            artifact: linux-amd64
          - goarch: arm64
            artifact: linux-arm64
          - goarch: arm
            goarm: '7'
            artifact: linux-armv7
          - goarch: arm
            goarm: '6'
            artifact: linux-armv6
          - goarch: '386'
            artifact: linux-386
          - goarch: riscv64
            artifact: linux-riscv64
          - goarch: loong64
            artifact: linux-loong64
          - goarch: ppc64le
            artifact: linux-ppc64le
          - goarch: s390x
            artifact: linux-s390x
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: frontend/package.json
      - uses: actions/setup-go@v5
        with:
          go-version: '1.25.x'
      - name: Build Ant Design frontend
        working-directory: frontend
        run: npm install && npm run build
      - name: Embed frontend
        run: |
          rm -rf backend/cmd/server/web/dist
          cp -r frontend/dist backend/cmd/server/web/dist
      - name: Build static backend (${{ matrix.artifact }})
        working-directory: backend
        env:
          CGO_ENABLED: '0'
          GOOS: linux
          GOARCH: ${{ matrix.goarch }}
          GOARM: ${{ matrix.goarm }}
          GOAMD64: ${{ matrix.goamd64 }}
        run: |
          go build -tags sqlite_modernc -trimpath -ldflags='-s -w' \
            -o "../3m-ui-${{ matrix.artifact }}" ./cmd/server
          file "../3m-ui-${{ matrix.artifact }}" || true
          if command -v ldd >/dev/null 2>&1; then
            if ldd "../3m-ui-${{ matrix.artifact }}" 2>&1 | grep -qiE 'not a dynamic|statically linked'; then
              echo "OK: static binary"
            else
              echo "WARN: binary may be dynamically linked:"
              ldd "../3m-ui-${{ matrix.artifact }}" || true
            fi
          fi
      - name: Archive
        run: tar -czf "3m-ui-${{ matrix.artifact }}.tar.gz" "3m-ui-${{ matrix.artifact }}"
      - uses: actions/upload-artifact@v4
        with:
          name: archive-${{ matrix.artifact }}
          path: |
            3m-ui-${{ matrix.artifact }}
            3m-ui-${{ matrix.artifact }}.tar.gz

  release:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true
      - name: Flatten artifacts & generate SHA256SUMS
        run: |
          set -euo pipefail
          mkdir -p release-files
          # download-artifact may nest by job; collect every binary/tarball
          find artifacts -type f \( -name '3m-ui-linux-*' -o -name 'SHA256SUMS' \) -print0 |
            while IFS= read -r -d '' f; do
              cp -a "$f" "release-files/$(basename "$f")"
            done
          # Ship management scripts with the release (install.sh falls back to main if missing)
          if [ -d scripts ]; then
            for s in install.sh update.sh uninstall.sh 3m-ui.sh 3m-ui; do
              [ -f "scripts/$s" ] && cp -a "scripts/$s" "release-files/$s"
            done
          fi
          cd release-files
          # Hash with bare filenames (no ./ prefix) so installers can match assets
          : > SHA256SUMS
          for f in $(ls -1 | sort); do
            [ -f "$f" ] || continue
            [ "$f" = SHA256SUMS ] && continue
            sha256sum "$f" >> SHA256SUMS
          done
          echo "=== SHA256SUMS ==="
          cat SHA256SUMS
          ls -la
      - name: Resolve tag
        id: meta
        run: |
          if [ -n "${{ inputs.tag }}" ]; then
            echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
          elif [ "${{ github.ref_type }}" = "tag" ]; then
            echo "tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
          else
            echo "tag is required for workflow_dispatch on a branch" >&2
            exit 1
          fi
      - uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.meta.outputs.tag }}
          name: ${{ steps.meta.outputs.tag }}
          generate_release_notes: true
          body: |
            ## Packages

            Official frontend: **Ant Design**.

            All binaries are **pure-Go static** (`CGO_ENABLED=0` + `modernc` SQLite):
            run on glibc *and* musl (Alpine), without system `libsqlite3`.

            Integrity: download `SHA256SUMS` and verify with `sha256sum -c SHA256SUMS`.

            | Artifact | Architecture |
            |---|---|
            | `3m-ui-linux-amd64` | x86_64 (GOAMD64=v1) |
            | `3m-ui-linux-arm64` | aarch64 |
            | `3m-ui-linux-armv7` | ARMv7 |
            | `3m-ui-linux-armv6` | ARMv6 (e.g. older Pi) |
            | `3m-ui-linux-386` | i386 / i686 |
            | `3m-ui-linux-riscv64` | RISC-V 64 |
            | `3m-ui-linux-loong64` | LoongArch64 |
            | `3m-ui-linux-ppc64le` | POWER little-endian |
            | `3m-ui-linux-s390x` | IBM Z |

            Each arch is also published as `.tar.gz`.
          files: |
            release-files/*