create-release.yml

name: Release
on:
  push:
    tags: ['v*']

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  APP_DESCRIPTION: Dev Proxy is an API simulator that helps you effortlessly test your app beyond the happy path.
  APP_PUBLISHER: Dev Proxy
  APP_DESCRIPTION_URL: https://aka.ms/devproxy

jobs:
  publish_binaries:
    name: Publish binaries
    runs-on: [windows-latest]
    environment:
      name: gh_releases
    permissions:
      id-token: write
      contents: read
    strategy:
      matrix:
        architecture:
          - win-x64
          - win-x86
          - linux-x64
          - linux-arm64
          - osx-x64
    env:
      release: 'dev-proxy-${{ matrix.architecture }}-${{ github.ref_name }}'
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup .NET
        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          dotnet-version: 10.0.x
      - name: Rename executable for beta
        if: contains(github.ref_name, '-beta')
        run: |
          pushd
          cd ./DevProxy
          $content = Get-Content DevProxy.csproj
          $content -replace '<AssemblyName>devproxy</AssemblyName>', '<AssemblyName>devproxy-beta</AssemblyName>' | Set-Content DevProxy.csproj
          popd
      - name: Set newVersionNotification for beta
        if: contains(github.ref_name, '-beta')
        run: |
          pushd
          cd ./DevProxy
          $content = Get-Content devproxyrc.json
          $content -replace '"newVersionNotification": "stable"', '"newVersionNotification": "beta"' | Set-Content devproxyrc.json
          popd
      - name: Publish ${{ matrix.architecture }}
        run: dotnet publish ./DevProxy/DevProxy.csproj -c Release -p:PublishSingleFile=true -p:InformationalVersion=$("${{ github.ref_name }}".Substring(1)) -r ${{ matrix.architecture }} --self-contained -o ./${{ env.release }}
      - name: Build plugins
        run: dotnet build ./DevProxy.Plugins/DevProxy.Plugins.csproj -p:InformationalVersion=$("${{ github.ref_name }}".Substring(1)) -c Release -r ${{ matrix.architecture }} --no-self-contained
      - name: Build abstractions
        if: matrix.architecture == 'win-x64'
        run: dotnet build ./DevProxy.Abstractions/DevProxy.Abstractions.csproj -p:InformationalVersion=$("${{ github.ref_name }}".Substring(1)) -c Release --no-self-contained
      - name: Add plugins to output
        run: cp ./DevProxy/bin/Release/net10.0/${{ matrix.architecture }}/plugins ./${{ env.release }} -r
      - name: Remove unnecessary files
        run: |
          pushd
          cd ./${{ env.release }}
          Get-ChildItem -Filter *.pdb -Recurse | Remove-Item
          Get-ChildItem -Filter *.deps.json -Recurse | Remove-Item
          Get-ChildItem -Filter *.runtimeconfig.json -Recurse | Remove-Item
          Get-ChildItem -Filter *.staticwebassets.endpoints.json -Recurse | Remove-Item
          Get-ChildItem -Filter web.config -Recurse | Remove-Item
          popd
      - name: Install Sign CLI tool
        run: dotnet tool install --tool-path . sign --version 0.9.1-beta.25181.2
      - name: Azure CLI Login
        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
        with:
          client-id: ${{ secrets.DOTNET_APPLICATION_ID }}
          tenant-id: ${{ secrets.DOTNET_TENANT_ID }}
          allow-no-subscriptions: true
      - name: Sign binaries
        if: contains(matrix.architecture, 'win-')
        working-directory: ./${{ env.release }}
        shell: pwsh
        run: >
          ../sign code azure-key-vault
          **/DevProxy*
          --publisher-name "${{ env.APP_PUBLISHER }}"
          --description "${{ env.APP_DESCRIPTION }}"
          --description-url "${{ env.APP_DESCRIPTION_URL }}"
          --azure-key-vault-tenant-id "${{ secrets.DOTNET_TENANT_ID }}"
          --azure-key-vault-client-id "${{ secrets.DOTNET_APPLICATION_ID }}"
          --azure-key-vault-certificate "${{ secrets.DOTNET_CERTIFICATE_NAME }}"
          --azure-key-vault-url "${{ secrets.DOTNET_VAULT_URL }}"
          --timestamp-url http://timestamp.digicert.com
          --verbosity Debug
      - name: Archive release ${{ env.release }}
        uses: thedoctor0/zip-release@b57d897cb5d60cb78b51a507f63fa184cfe35554 # master
        with:
          filename: '../${{ env.release }}.zip'
          directory: './${{ env.release }}'
      - name: Release SHA256 hash
        run: |
          $(Get-FileHash ./${{ env.release }}.zip -Algorithm SHA256).Hash
      - name: Upload release
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: binaries-${{ env.release }}
          path: ./${{ env.release }}.zip
      - name: Sign abstractions
        if: matrix.architecture == 'win-x64'
        shell: pwsh
        run: >
          ./sign code azure-key-vault
          ./DevProxy.Abstractions/bin/Release/net10.0/DevProxy.Abstractions.dll
          --publisher-name "${{ env.APP_PUBLISHER }}"
          --description "${{ env.APP_DESCRIPTION }}"
          --description-url "${{ env.APP_DESCRIPTION_URL }}"
          --azure-key-vault-tenant-id "${{ secrets.DOTNET_TENANT_ID }}"
          --azure-key-vault-client-id "${{ secrets.DOTNET_APPLICATION_ID }}"
          --azure-key-vault-certificate "${{ secrets.DOTNET_CERTIFICATE_NAME }}"
          --azure-key-vault-url "${{ secrets.DOTNET_VAULT_URL }}"
          --timestamp-url http://timestamp.digicert.com
          --verbosity Debug
      - name: Archive abstractions
        if: matrix.architecture == 'win-x64'
        uses: thedoctor0/zip-release@b57d897cb5d60cb78b51a507f63fa184cfe35554 # master
        with:
          filename: '../../../../DevProxy.Abstractions-${{ github.ref_name }}.zip'
          directory: './DevProxy.Abstractions/bin/Release/net10.0'
          exclusions: '*.json'
      - name: Upload abstractions
        if: matrix.architecture == 'win-x64'
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: binaries-dev-proxy-abstractions-${{ github.ref_name }}
          path: ./DevProxy.Abstractions-${{ github.ref_name }}.zip
      - name: Add installer icon
        if: contains(matrix.architecture, 'win-')
        run: |
          if ('${{ github.ref_name }}'.Contains('beta')) {
            cp ./media/icon-beta.ico ./${{ env.release }}
          } else {
            cp ./media/icon.ico ./${{ env.release }}
          }
      - name: Update version in beta installer
        if: contains(matrix.architecture, 'win-') && contains(github.ref_name, '-beta')
        run: |
          $content = Get-Content ./install-beta.iss
          $content -replace '#define MyAppVersion .*', "#define MyAppVersion `"$("${{ github.ref_name }}".Substring(1))`"" | Set-Content ./install-beta.iss
      - name: Set installer file name
        id: installer
        if: contains(matrix.architecture, 'win-')
        run: |
          if ('${{ github.ref_name }}'.Contains('beta')) {
              Write-Output "filename=install-beta.iss" >> $env:GITHUB_OUTPUT
          } else {
              Write-Output "filename=install.iss" >> $env:GITHUB_OUTPUT
          }
      - name: Add install file
        if: contains(matrix.architecture, 'win-')
        run: cp ./${{ steps.installer.outputs.filename }} ./${{ env.release }}
      - name: Build Installer
        if: contains(matrix.architecture, 'win-')
        run: |
          winget install --id JRSoftware.InnoSetup -e -s winget
          $env:path += ";$env:LOCALAPPDATA/Programs/Inno Setup 6"
          ISCC.exe ${{ steps.installer.outputs.filename }} /F"dev-proxy-installer-${{ matrix.architecture }}-${{ github.ref_name }}" 
        working-directory: ./${{ env.release }}
      - name: Sign installer
        if: contains(matrix.architecture, 'win-')
        working-directory: ./${{ env.release }}
        shell: pwsh
        run: >
          ../sign code azure-key-vault
          ./dev-proxy-installer-*.exe
          --publisher-name "${{ env.APP_PUBLISHER }}"
          --description "${{ env.APP_DESCRIPTION }}"
          --description-url "${{ env.APP_DESCRIPTION_URL }}"
          --azure-key-vault-tenant-id "${{ secrets.DOTNET_TENANT_ID }}"
          --azure-key-vault-client-id "${{ secrets.DOTNET_APPLICATION_ID }}"
          --azure-key-vault-certificate "${{ secrets.DOTNET_CERTIFICATE_NAME }}"
          --azure-key-vault-url "${{ secrets.DOTNET_VAULT_URL }}"
          --timestamp-url http://timestamp.digicert.com
          --verbosity Debug
      - name: Upload Installer
        if: contains(matrix.architecture, 'win-')
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: installer-dev-proxy-${{ github.ref_name }}-${{ matrix.architecture }}
          path: ./${{ env.release }}/dev-proxy-installer-${{ matrix.architecture }}-${{ github.ref_name }}.exe
      - name: Installer SHA256 hash
        if: contains(matrix.architecture, 'win-')
        run: |
          $(Get-FileHash ./${{ env.release }}/dev-proxy-installer-${{ matrix.architecture }}-${{ github.ref_name }}.exe -Algorithm SHA256).Hash
  create_release:
    name: Create Release
    needs: [publish_binaries]
    environment:
      name: gh_releases
    runs-on: [windows-latest]
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          path: output
      - name: Release
        uses: anton-yurchenko/git-release@ec9c5b5c36b27eaffc628785b9183eae54601200 # v6.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DRAFT_RELEASE: "false"
          PRE_RELEASE: "false"
          CHANGELOG_FILE: "CHANGELOG.md"
          ALLOW_EMPTY_CHANGELOG: "true"
        with:
          args: |
              output/binaries-*/*.zip
              output/installer-*/*.exe
  deploy_docker:
    name: Publish Docker image
    runs-on: ubuntu-latest
    needs: [create_release]
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      # Required for multi-platform images
      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      # Required for multi-platform images
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
        with:
          driver-opts: image=moby/buildkit:latest
      - name: Log in to the Container registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          flavor: |
            latest=false
          tags: |
            type=semver,pattern={{version}}
            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-beta') }}
            type=raw,value=beta,enable=${{ contains(github.ref_name, '-beta') }}
          labels: |
            org.opencontainers.image.description=${{ env.APP_DESCRIPTION }}
          annotations: |
            org.opencontainers.image.description=${{ env.APP_DESCRIPTION }}
      - name: Build and push Docker image
        if: "!contains(github.ref_name, '-beta')"
        id: push
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}
          platforms: linux/amd64,linux/arm64
          build-args: |
            DEVPROXY_VERSION=${{ steps.meta.outputs.version }}
      - name: Build and push beta Docker image
        if: contains(github.ref_name, '-beta')
        id: push_beta
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
        with:
          context: .
          file: ./Dockerfile_beta
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}
          platforms: linux/amd64,linux/arm64
          build-args: |
            DEVPROXY_VERSION=${{ steps.meta.outputs.version }}
      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.push.outputs.digest || steps.push_beta.outputs.digest }}
          push-to-registry: true