NodeFlare/.github/workflows/release.yml

name: Build tagged release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      version:
        description: Tag version with a v prefix, for example v0.0.1
        required: true
        default: v0.0.1

permissions:
  contents: read

jobs:
  metadata:
    name: Validate tag
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - id: version
        name: Validate three-part tag
        shell: bash
        env:
          RAW_VERSION: ${{ github.event_name == 'workflow_dispatch' && inputs.version || github.ref_name }}
        run: |
          if [[ ! "$RAW_VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Tag must use the v-prefixed format v1.2.3" >&2
            exit 1
          fi

          version="${RAW_VERSION#v}"
          echo "version=$version" >> "$GITHUB_OUTPUT"

  agent:
    name: Agent (${{ matrix.platform }})
    needs: metadata
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    permissions:
      attestations: write
      contents: read
      id-token: write
    env:
      CARGO_TARGET_DIR: target/agent
      NODEFLARE_AGENT_VERSION: ${{ needs.metadata.outputs.version }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: Linux x86_64
            runner: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            asset: agent-linux-x86_64
            extension: ""
            cross: true
          - platform: Linux ARM64
            runner: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            asset: agent-linux-aarch64
            extension: ""
            cross: true
          - platform: Windows x86_64
            runner: windows-latest
            target: x86_64-pc-windows-msvc
            asset: agent-windows-x86_64.exe
            extension: .exe
            cross: false
          - platform: macOS ARM64
            runner: macos-14
            target: aarch64-apple-darwin
            asset: agent-macos-aarch64
            extension: ""
            cross: false
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          targets: ${{ matrix.target }}
      - name: Install Linux cross compiler
        if: matrix.cross
        run: cargo install cross --version 0.2.5 --locked
      - name: Build Rust Agent with cross
        if: matrix.cross
        run: cross build --manifest-path agent/Cargo.toml --release --locked --target ${{ matrix.target }}
      - name: Build Rust Agent with Cargo
        if: matrix.cross == false
        run: cargo build --manifest-path agent/Cargo.toml --release --locked --target ${{ matrix.target }}
      - name: Stage Agent binary
        shell: bash
        run: |
          mkdir -p release
          cp "target/agent/${{ matrix.target }}/release/nodeflare-agent${{ matrix.extension }}" "release/${{ matrix.asset }}"
      - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
        with:
          subject-path: release/${{ matrix.asset }}
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ matrix.asset }}
          path: release/${{ matrix.asset }}
          if-no-files-found: error

  frontend:
    name: Frontend
    needs: metadata
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      attestations: write
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14
      - name: Install dependencies
        run: bun install --frozen-lockfile
      - name: Build public frontend
        run: bun run --cwd frontend build:public
      - name: Package frontend
        run: tar -czf "nodeflare-frontend-${{ needs.metadata.outputs.version }}.tar.gz" -C frontend/dist .
      - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
        with:
          subject-path: nodeflare-frontend-${{ needs.metadata.outputs.version }}.tar.gz
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: frontend
          path: nodeflare-frontend-${{ needs.metadata.outputs.version }}.tar.gz
          if-no-files-found: error

  release:
    name: Publish GitHub Release
    if: github.event_name == 'push'
    needs: [metadata, agent, frontend]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      actions: read
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Build changelog from commits
        shell: bash
        run: |
          previous_tag=$(git describe --tags --abbrev=0 "${GITHUB_SHA}^" 2>/dev/null || true)
          if [ -n "$previous_tag" ]; then
            commit_range="${previous_tag}..${GITHUB_SHA}"
          else
            commit_range="${GITHUB_SHA}"
          fi

          git log "$commit_range" --no-merges --pretty=format:'- %s' > CHANGELOG.md
          if [ ! -s CHANGELOG.md ]; then
            git log -1 --pretty=format:'- %s' "$GITHUB_SHA" > CHANGELOG.md
          fi
          printf '\n' >> CHANGELOG.md
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: release-assets
          merge-multiple: true
      - uses: softprops/action-gh-release@fe965f7af51af5f2602596916f38a38df2e33de0 # v3.0.2
        with:
          body_path: CHANGELOG.md
          files: release-assets/*
          fail_on_unmatched_files: true