release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

# Least privilege by default; jobs that push the version bump or touch the
# GitHub release escalate to contents: write at the job level.
permissions:
  contents: read

# Never cancel a release mid-flight (a cancelled publish can leave a half-done
# release); serialise per-ref instead.
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  prepare-release:
    name: Bump version from tag
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      # The release version (tag minus its leading "v") and the SHA of the bump
      # commit. Every downstream job checks out `sha` so it builds/publishes the
      # bumped tree exactly, regardless of where main moves afterwards.
      version: ${{ steps.bump.outputs.version }}
      sha: ${{ steps.bump.outputs.sha }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: main

      - name: Write tag version into manifests and push to main
        id: bump
        run: |
          version="${GITHUB_REF_NAME#v}"

          # The tag is the single source of truth: stamp it into every package
          # manifest. `0,/re/` rewrites only the first match, which for each
          # Cargo.toml is its own `[package] version` (xtask is intentionally
          # left at 0.0.0 — it is publish = false).
          for m in native/suidhelper/Cargo.toml native/suidhelper/meta/Cargo.toml native/guest-agent/Cargo.toml; do
            sed -i -E "0,/^version = \"[^\"]*\"/s//version = \"${version}\"/" "$m"
          done
          sed -i -E "0,/version: \"[^\"]*\"/s//version: \"${version}\"/" mix.exs

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add native/suidhelper/Cargo.toml native/suidhelper/meta/Cargo.toml native/guest-agent/Cargo.toml mix.exs

          # Idempotent: a re-run after the bump already landed has nothing to commit.
          if git diff --cached --quiet; then
            echo "manifests already at ${version}; nothing to commit"
          else
            git commit -m "release: v${version}"
            git push origin HEAD:main
          fi

          echo "version=${version}" >> "$GITHUB_OUTPUT"
          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

  build-suidhelper:
    name: Build suidhelper (${{ matrix.target }})
    needs: prepare-release
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
        target:
          - x86_64-unknown-linux-musl
          - aarch64-unknown-linux-musl
    defaults:
      run:
        working-directory: native/suidhelper
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare-release.outputs.sha }}

      # rustup reads native/suidhelper/rust-toolchain.toml on the first cargo
      # call and installs the pinned nightly + both musl targets.
      - name: Show toolchain
        run: rustup show

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: native/suidhelper

      - name: Build release binary
        run: cargo build --release --target ${{ matrix.target }}

      - name: Stage renamed artifact
        run: |
          v="${{ needs.prepare-release.outputs.version }}"
          out="hyper-suidhelper-${v}-${{ matrix.target }}"
          mkdir -p dist
          cp "target/${{ matrix.target }}/release/hyper-suidhelper" "dist/${out}"

      - uses: actions/upload-artifact@v7
        with:
          name: suidhelper-${{ matrix.target }}
          path: native/suidhelper/dist/*
          if-no-files-found: error

  build-hex:
    name: Build Hex package
    needs: prepare-release
    runs-on: ubuntu-latest
    env:
      MIX_ENV: dev
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare-release.outputs.sha }}

      - uses: erlef/setup-beam@v1
        id: beam
        with:
          elixir-version: "1.20"
          otp-version: "28"

      - name: Cache deps and _build
        uses: actions/cache@v6
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-release-mix-${{ steps.beam.outputs.otp-version }}-${{ steps.beam.outputs.elixir-version }}-${{ hashFiles('mix.lock') }}
          restore-keys: |
            ${{ runner.os }}-release-mix-${{ steps.beam.outputs.otp-version }}-${{ steps.beam.outputs.elixir-version }}-

      - name: Install dependencies
        run: mix deps.get

      # The gitignored gRPC/guest-agent/suidhelper artifacts are regenerated by
      # Mix compilers on every compile; hex.build compiles, so the runner needs
      # their toolchain. Mirrors ci.yml.
      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      - name: Install protoc-gen-elixir
        run: mix escript.install hex protobuf 0.17.0 --force

      - name: Install musl target for the guest-agent build
        run: rustup target add x86_64-unknown-linux-musl

      - name: Build package tarball
        run: mix hex.build --output "hypervm-${{ needs.prepare-release.outputs.version }}.tar"

      - uses: actions/upload-artifact@v7
        with:
          name: hex-package
          path: hypervm-*.tar
          if-no-files-found: error

  github-release:
    name: Draft GitHub release
    needs: [build-suidhelper, build-hex]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download all build artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts

      - name: Collect assets and compute checksums
        run: |
          mkdir -p release
          find artifacts -type f \( -name 'hyper-suidhelper-*' -o -name 'hypervm-*.tar' \) \
            -exec cp {} release/ \;
          ( cd release && sha256sum hyper-suidhelper-* hypervm-*.tar > SHA256SUMS )
          ls -la release

      - name: Create draft release
        uses: softprops/action-gh-release@v3
        with:
          draft: true
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          generate_release_notes: true
          files: release/*

  publish-hex:
    name: Publish to Hex
    needs: [prepare-release, build-hex, github-release]
    runs-on: ubuntu-latest
    environment: release
    env:
      MIX_ENV: dev
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare-release.outputs.sha }}

      - uses: erlef/setup-beam@v1
        with:
          elixir-version: "1.20"
          otp-version: "28"

      - name: Install dependencies
        run: mix deps.get

      # The gitignored gRPC/guest-agent/suidhelper artifacts are regenerated by
      # Mix compilers on every compile; hex.build compiles, so the runner needs
      # their toolchain. Mirrors ci.yml.
      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      - name: Install protoc-gen-elixir
        run: mix escript.install hex protobuf 0.17.0 --force

      - name: Install musl target for the guest-agent build
        run: rustup target add x86_64-unknown-linux-musl

      # HEX_API_KEY authenticates non-interactively; --yes skips the prompt.
      # Publishes both the package and its docs.
      - name: hex publish
        env:
          HEX_API_KEY: ${{ secrets.HEX_API_KEY }}
        run: mix hex.publish --yes

  finalize-release:
    name: Publish GitHub release
    needs: [publish-hex]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      # Flip the draft (created earlier) to live only after both registries
      # have the new version. github.token has the contents:write granted above.
      # This job does no checkout, so `gh` cannot infer the repo from a git
      # remote -- pass it explicitly with --repo, or the edit dies with
      # "fatal: not a git repository".
      - name: Mark release as published
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release edit "${{ github.ref_name }}" --repo "${{ github.repository }}" --draft=false