release.yml

name: release

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to release (blank = use versions.json)"
        required: false
        default: ""
      upstream_ref:
        description: "Build from this upstream branch/commit/tag (e.g. 'dev', 'v1.18.31') instead of the versions.json tag. Without 'version': releases as <version>-dev.<sha>, always a prerelease. With 'version': rebuild ref but publish that exact version (hotfix re-ships)."
        required: false
        default: ""
      draft:
        description: "Create as draft release (safer default; publish manually)"
        type: boolean
        default: true
      prerelease:
        description: "Mark as prerelease (upstream watcher uses this)"
        type: boolean
        default: false
  workflow_call:
    inputs:
      version:
        type: string
        required: false
        default: ""
      upstream_ref:
        type: string
        required: false
        default: ""
      draft:
        type: boolean
        default: true
      prerelease:
        type: boolean
        default: false

jobs:
  release:
    runs-on: ubuntu-24.04-arm
    permissions:
      contents: write
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          # The container separately installs the pinned Bionic Bun
          # (bunTermux.version in versions.json).
          bun-version: latest

      - name: Resolve version
        id: version
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          INPUT_VERSION: ${{ inputs.version }}
          INPUT_UPSTREAM_REF: ${{ inputs.upstream_ref }}
          INPUT_PRERELEASE: ${{ inputs.prerelease }}
        run: |
          set -eu
          UPSTREAM=anomalyco/opencode
          REF="${INPUT_UPSTREAM_REF:-}"
          PRERELEASE="$INPUT_PRERELEASE"

          if [ -n "$REF" ]; then
            # Resolve the branch to the exact commit now, and build that
            # commit — `dev` would otherwise move between this step and the
            # clone, and the release notes would name a build we didn't make.
            SHA="$(gh api "repos/$UPSTREAM/commits/$REF" --jq .sha)"
            SHORT="$(printf '%s' "$SHA" | cut -c1-8)"
            VERSION="$(gh api "repos/$UPSTREAM/contents/packages/opencode/package.json?ref=$SHA" \
              --jq .content | base64 -d | jq -r .version)"
            if [ -n "$INPUT_VERSION" ]; then
              # Hotfix rebuild: an explicit version overrides the ref-derived
              # tag, e.g. upstream_ref=v1.18.31 + version=1.18.31.1 re-ships
              # the stable tree when only our toolchain (bun/opentui pins)
              # changed. Stability then follows the prerelease input.
              RELEASE="${INPUT_VERSION#v}"
            else
              RELEASE="${VERSION}-dev.${SHORT}"
              # A build off a moving branch is never "Latest": install.sh
              # follows /releases/latest, which skips prereleases.
              PRERELEASE=true
            fi
            echo "ref=$SHA" >> "$GITHUB_OUTPUT"
            echo "Building $UPSTREAM@$SHA (upstream says $VERSION), releasing as v$RELEASE"
          else
            if [ -n "$INPUT_VERSION" ]; then
              VERSION="${INPUT_VERSION#v}"
            else
              VERSION="$(bun termux/ci/versions.ts print | grep '^OPENCODE_VERSION=' | cut -d= -f2)"
            fi
            RELEASE="$VERSION"
            echo "ref=" >> "$GITHUB_OUTPUT"
            echo "Building upstream v$VERSION, releasing as v$RELEASE"
          fi

          if [ -z "$VERSION" ]; then
            echo "error: could not determine version" >&2
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
          echo "tag=v$RELEASE" >> "$GITHUB_OUTPUT"
          echo "prerelease=$PRERELEASE" >> "$GITHUB_OUTPUT"

      - name: Verify tag is unused
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          set -eu
          if gh release view "$TAG" >/dev/null 2>&1; then
            echo "error: release $TAG already exists. Bump versions.json or delete the release first." >&2
            exit 1
          fi

      - name: Apply pinned versions
        run: bun termux/ci/versions.ts apply

      - name: Confirm versions match
        run: bun termux/ci/versions.ts check

      - name: Build inside termux-docker
        env:
          # RELEASE, not VERSION: this is the string baked into the binary,
          # so `opencode --version` names the build you actually installed.
          # OPENCODE_UPSTREAM_REF decides what gets cloned when they differ.
          OPENCODE_VERSION: ${{ steps.version.outputs.release }}
          OPENCODE_UPSTREAM_REF: ${{ steps.version.outputs.ref }}
          OPENCODE_CHANNEL: stable
        run: bash termux/ci/build-on-runner.sh

      - name: Package .deb
        id: pkg
        env:
          VERSION: ${{ steps.version.outputs.release }}
        run: |
          set -eux
          OUT_HOST="$(cd "$GITHUB_WORKSPACE/../out" && pwd)"
          mkdir -p "$GITHUB_WORKSPACE/dist"
          DEB="$(bash termux/ci/package-deb.sh "$OUT_HOST/opencode" "$VERSION" "$GITHUB_WORKSPACE/dist")"
          cp "$OUT_HOST/opencode" "$GITHUB_WORKSPACE/dist/opencode"
          ( cd "$GITHUB_WORKSPACE/dist" && sha256sum opencode "opencode_${VERSION}_aarch64.deb" > SHA256SUMS )
          ls -la "$GITHUB_WORKSPACE/dist/"
          echo "deb=$DEB" >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ steps.version.outputs.tag }}
          VERSION: ${{ steps.version.outputs.version }}
          RELEASE: ${{ steps.version.outputs.release }}
          REF: ${{ steps.version.outputs.ref }}
          DRAFT: ${{ inputs.draft }}
          PRERELEASE: ${{ steps.version.outputs.prerelease }}
        run: |
          set -eu
          FLAGS=""
          if [ "$DRAFT" = "true" ]; then FLAGS="$FLAGS --draft"; fi
          if [ "$PRERELEASE" = "true" ]; then FLAGS="$FLAGS --prerelease"; fi
          NOTES_FILE="$RUNNER_TEMP/release-notes.md"
          # RELEASE includes the commit suffix for dev builds.
          if [ -n "$REF" ]; then
            SOURCE="Built from [\`$(printf '%s' "$REF" | cut -c1-8)\`](https://github.com/anomalyco/opencode/commit/$REF) — upstream reports itself as v$VERSION at that commit."
            UPSTREAM_DESCRIPTION="$(gh api "repos/anomalyco/opencode/commits/$REF" --jq '.commit.message // empty' 2>/dev/null || true)"
            UPSTREAM_DESCRIPTION_TITLE="Upstream commit"
          else
            SOURCE="Built from upstream tag [\`v$VERSION\`](https://github.com/anomalyco/opencode/releases/tag/v$VERSION)."
            UPSTREAM_DESCRIPTION="$(gh api "repos/anomalyco/opencode/releases/tags/v$VERSION" --jq '.body // empty' 2>/dev/null || true)"
            UPSTREAM_DESCRIPTION_TITLE="Upstream release notes"
          fi
          if [ "$PRERELEASE" = "true" ]; then
            INSTALL_ENV="OPENCODE_VERSION=$RELEASE "
          else
            INSTALL_ENV=""
          fi
          cat > "$NOTES_FILE" <<EOF
          opencode v$RELEASE — Termux/Bionic aarch64 build.

          $SOURCE
          EOF
          if [ -n "$UPSTREAM_DESCRIPTION" ]; then
            printf '\n## %s\n\n%s\n' "$UPSTREAM_DESCRIPTION_TITLE" "$UPSTREAM_DESCRIPTION" >> "$NOTES_FILE"
          fi
          cat >> "$NOTES_FILE" <<EOF

          Install:

          \`\`\`
          curl -fsSL https://raw.githubusercontent.com/${{ github.repository }}/main/install.sh | ${INSTALL_ENV}bash
          \`\`\`

          Or manually:

          \`\`\`
          curl -LO https://github.com/${{ github.repository }}/releases/download/$TAG/opencode_${RELEASE}_aarch64.deb
          dpkg -i opencode_${RELEASE}_aarch64.deb
          \`\`\`

          Files:
          - \`opencode_${RELEASE}_aarch64.deb\` — Termux package
          - \`opencode\` — raw aarch64 ELF binary (for advanced use)
          - \`SHA256SUMS\` — checksums

          Bundled versions:
          - opencode: v$VERSION
          - @opentui/*: $(bun termux/ci/versions.ts print | grep OPENTUI_CORE= | cut -d= -f2)
          EOF
          # $FLAGS is intentionally word-split (--draft / --prerelease).
          # shellcheck disable=SC2086
          gh release create "$TAG" $FLAGS \
            --title "v$RELEASE" \
            --notes-file "$NOTES_FILE" \
            dist/opencode_${RELEASE}_aarch64.deb \
            dist/opencode \
            dist/SHA256SUMS