release.yml

name: Release

# Runs when a version tag is pushed:
#
#   git tag -a v0.2.0 -m "What changed, in a sentence or two"
#   git push origin v0.2.0
#
# Builds every package for every product that ships, signs one manifest that
# names them all by hash, and publishes it to the public releases repository,
# where Settings -> Updates on every install finds it. See docs/dev/releasing.md
# for the one-time setup this needs.

on:
  push:
    tags: ["v[0-9]+.[0-9]+.[0-9]+"]

permissions:
  contents: read

concurrency:
  group: release
  cancel-in-progress: false

env:
  NODE_VERSION: "24.21.0"
  # The pages customers download from are one per product, listed in
  # deploy/release/publish.sh. Built files only; no source code goes there.
  REGISTRY: ghcr.io/offsetsecurity

jobs:
  version:
    name: Read the version
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.v.outputs.version }}
    steps:
      - id: v
        run: |
          v="${GITHUB_REF_NAME#v}"
          [[ "$v" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "Tags must look like v1.2.3, not $GITHUB_REF_NAME"; exit 1; }
          echo "version=$v" >> "$GITHUB_OUTPUT"

  test:
    name: Tests
    runs-on: ubuntu-latest
    env:
      E2E_DATABASE_URL: file:./.ci/e2e.db
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: corepack enable
      - run: pnpm install --frozen-lockfile
      - run: pnpm typecheck
      - run: mkdir -p apps/api/.ci && pnpm --filter @offset/api test

  docker:
    name: Docker images (${{ matrix.product }})
    needs: [version, test]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: true
      matrix:
        product: [align]
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Application image
        id: app
        uses: docker/build-push-action@v6
        with:
          context: .
          file: deploy/docker/Dockerfile
          target: runtime
          build-args: |
            PRODUCT=${{ matrix.product }}
            APP_VERSION=${{ needs.version.outputs.version }}
          tags: |
            ${{ env.REGISTRY }}/offset-${{ matrix.product }}:${{ needs.version.outputs.version }}
            ${{ env.REGISTRY }}/offset-${{ matrix.product }}:latest
          push: true
          provenance: false

      - name: Updater image
        id: updater
        uses: docker/build-push-action@v6
        with:
          context: .
          file: deploy/docker/Dockerfile
          target: updater
          build-args: |
            PRODUCT=${{ matrix.product }}
            APP_VERSION=${{ needs.version.outputs.version }}
          tags: |
            ${{ env.REGISTRY }}/offset-${{ matrix.product }}-updater:${{ needs.version.outputs.version }}
            ${{ env.REGISTRY }}/offset-${{ matrix.product }}-updater:latest
          push: true
          provenance: false

      # The manifest names images by the digest the registry returned, so
      # nothing pushed later under the same tag can be installed in their place.
      - name: Record digests
        run: |
          mkdir -p out
          cat > "out/images-${{ matrix.product }}.json" <<JSON
          {"${{ matrix.product }}": {
            "image": "${{ env.REGISTRY }}/offset-${{ matrix.product }}",
            "digest": "${{ steps.app.outputs.digest }}",
            "updaterImage": "${{ env.REGISTRY }}/offset-${{ matrix.product }}-updater",
            "updaterDigest": "${{ steps.updater.outputs.digest }}"
          }}
          JSON
      - uses: actions/upload-artifact@v4
        with:
          name: images-${{ matrix.product }}
          path: out/images-${{ matrix.product }}.json

  linux:
    name: Linux (${{ matrix.product }})
    needs: [version, test]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
        product: [align]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: corepack enable
      - run: pnpm install --frozen-lockfile
      - run: bash deploy/linux/build.sh ${{ matrix.product }}
        env:
          APP_VERSION: ${{ needs.version.outputs.version }}
      - uses: actions/upload-artifact@v4
        with:
          name: linux-${{ matrix.product }}
          path: dist/linux/offset-${{ matrix.product }}-${{ needs.version.outputs.version }}-linux-x64.tar.gz*

  windows:
    name: Windows (${{ matrix.product }})
    needs: [version, test]
    runs-on: windows-latest
    strategy:
      fail-fast: true
      matrix:
        product: [align]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: corepack enable
      - run: pnpm install --frozen-lockfile
      - name: Inno Setup
        run: choco install innosetup --no-progress -y
      - name: Build
        shell: pwsh
        run: |
          powershell -NoProfile -ExecutionPolicy Bypass -File deploy\windows\build.ps1 `
            -Product ${{ matrix.product }} -Version ${{ needs.version.outputs.version }} -SkipZip
          if ($LASTEXITCODE -ne 0) { exit 1 }
          & "${env:ProgramFiles(x86)}\Inno Setup 6\ISCC.exe" /Q `
            /DProduct=${{ matrix.product }} /DAppVersion=${{ needs.version.outputs.version }} `
            deploy\windows\offset.iss
          if ($LASTEXITCODE -ne 0) { exit 1 }
      - uses: actions/upload-artifact@v4
        with:
          name: windows-${{ matrix.product }}
          path: dist/windows/*-${{ needs.version.outputs.version }}-setup.exe

  publish:
    name: Sign and publish
    needs: [version, docker, linux, windows]
    runs-on: ubuntu-latest
    # To write this repository's own releases. It used to need a token that
    # reached into another repository, which is a secret somebody has to
    # create, remember to rotate, and can leak.
    permissions:
      contents: write
    # Add required reviewers to this environment in the repository settings to
    # make every release wait for a human to approve it before it is signed.
    environment: release
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: corepack enable
      - run: pnpm install --frozen-lockfile
      - run: pnpm --filter @offset/api build

      - uses: actions/download-artifact@v4
        with:
          # Only the three kinds of file a release is made of. The Docker build
          # action also uploads a build record per image, named
          # "<owner>~<repo>~XXXXXX.dockerbuild", and fetching those failed the
          # whole job on the first release and again on the second: the twelve
          # real files came down, then a build record gave up after five
          # retries and took the job with it. Nothing here reads them.
          pattern: "{windows,linux,images}-*"
          path: dist/release
          merge-multiple: true

      - name: Release notes
        run: |
          git for-each-ref "refs/tags/${GITHUB_REF_NAME}" --format='%(contents)' > notes.md
          [ -s notes.md ] || echo "See CHANGELOG.md." > notes.md
          cat notes.md

      # Its own releases page, so "latest" means this product.
      # deploy/release/publish.sh builds the manifest, signs it, checks the
      # signature the way an install will, and creates the release.
      - name: Sign and publish the release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_SIGNING_KEY: ${{ secrets.RELEASE_SIGNING_KEY }}
        run: |
          # The digests the docker job recorded, one file per product,
          # gathered into the one file the manifest builder reads.
          node deploy/release/collect-images.mjs dist/release images.json
          bash deploy/release/publish.sh \
            "${{ needs.version.outputs.version }}" \
            "${GITHUB_REF_NAME}" \
            dist/release \
            notes.md