release.yml

name: Release

on:
  push:
    tags:
      - "v[0-9]*.[0-9]*.[0-9]*"

permissions:
  contents: read

jobs:
  validate:
    name: Validate release tag
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    outputs:
      tag_name: ${{ steps.version.outputs.tag_name }}
      version: ${{ steps.version.outputs.version }}
      is_prerelease: ${{ steps.version.outputs.is_prerelease }}
      tag_commit: ${{ steps.verify.outputs.tag_commit }}

    steps:
      - name: Validate release tag
        id: version
        shell: bash
        run: |
          set -euo pipefail

          tag="$GITHUB_REF_NAME"

          if [[ -z "$tag" ]]; then
            echo "::error::Missing tag name. Expected a tag such as v1.0.1 or v1.0.1-rc.1." >&2
            exit 1
          fi

          semver_tag_regex='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-(alpha|beta|rc)\.(0|[1-9][0-9]*))?$'

          if [[ ! "$tag" =~ $semver_tag_regex ]]; then
            echo "::error::Invalid release tag '$tag'." >&2
            echo "Expected vMAJOR.MINOR.PATCH or vMAJOR.MINOR.PATCH-rc.N, -beta.N, or -alpha.N." >&2
            echo "Examples: v1.0.1, v1.1.0, v2.0.0, v1.0.1-rc.1" >&2
            exit 1
          fi

          version="${tag#v}"
          is_prerelease="false"
          if [[ "$version" == *-* ]]; then
            is_prerelease="true"
          fi

          {
            echo "tag_name=$tag"
            echo "version=$version"
            echo "is_prerelease=$is_prerelease"
          } >> "$GITHUB_OUTPUT"

          echo "Validated release tag $tag (version $version, prerelease $is_prerelease)."

      - name: Check out release tag
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: refs/tags/${{ steps.version.outputs.tag_name }}

      - name: Verify checkout matches release tag
        id: verify
        shell: bash
        env:
          TAG_NAME: ${{ steps.version.outputs.tag_name }}
        run: |
          set -euo pipefail

          tag_commit="$(git rev-list -n 1 "refs/tags/$TAG_NAME")"
          head_commit="$(git rev-parse HEAD)"

          if [[ "$head_commit" != "$tag_commit" ]]; then
            echo "::error::Checked-out commit $head_commit does not match $TAG_NAME commit $tag_commit." >&2
            exit 1
          fi

          echo "tag_commit=$tag_commit" >> "$GITHUB_OUTPUT"
          echo "Verified $TAG_NAME resolves to checked-out commit $head_commit."

  test:
    name: Test release candidate
    needs: validate
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    services:
      redis:
        image: redis:7
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - name: Check out tag
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: refs/tags/${{ needs.validate.outputs.tag_name }}

      - name: Verify checkout matches validated tag commit
        shell: bash
        env:
          TAG_NAME: ${{ needs.validate.outputs.tag_name }}
          VALIDATED_TAG_COMMIT: ${{ needs.validate.outputs.tag_commit }}
        run: |
          set -euo pipefail

          tag_commit="$(git rev-list -n 1 "refs/tags/$TAG_NAME")"
          head_commit="$(git rev-parse HEAD)"

          if [[ "$tag_commit" != "$VALIDATED_TAG_COMMIT" ]]; then
            echo "::error::Tag $TAG_NAME resolved to $tag_commit, expected validated commit $VALIDATED_TAG_COMMIT." >&2
            exit 1
          fi

          if [[ "$head_commit" != "$VALIDATED_TAG_COMMIT" ]]; then
            echo "::error::Checked-out commit $head_commit does not match validated $TAG_NAME commit $VALIDATED_TAG_COMMIT." >&2
            exit 1
          fi

          echo "Verified $TAG_NAME is checked out at validated commit $head_commit."

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Set up Elixir
        uses: erlef/setup-beam@v1
        with:
          elixir-version: "1.16"
          otp-version: "26"

      - name: Install dependencies
        run: mix deps.get

      - name: Check formatting
        run: mix format --check-formatted

      - name: Run tests
        env:
          MN_GRPC_PORT: "55051"
          MN_API_PORT: "54000"
          MN_REDIS_URL: "redis://localhost:6379/0"
        run: mix test

      - name: Compile with warnings as errors
        env:
          MIX_PROJECT_VERSION: ${{ needs.validate.outputs.version }}
        run: mix compile --warnings-as-errors

      - name: Check shell scripts
        shell: bash
        run: |
          set -euo pipefail
          while IFS= read -r -d '' script; do
            bash -n "$script"
          done < <(find scripts -name '*.sh' -print0)

  build-otp:
    name: Build OTP release (${{ matrix.platform }})
    needs:
      - validate
      - test
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: darwin-arm64
            runner: macos-15
          - platform: linux-x64
            runner: ubuntu-24.04
          - platform: linux-arm64
            runner: ubuntu-24.04-arm

    steps:
      - name: Check out tag
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: refs/tags/${{ needs.validate.outputs.tag_name }}

      - name: Verify checkout matches validated tag commit
        shell: bash
        env:
          TAG_NAME: ${{ needs.validate.outputs.tag_name }}
          VALIDATED_TAG_COMMIT: ${{ needs.validate.outputs.tag_commit }}
        run: |
          set -euo pipefail

          tag_commit="$(git rev-list -n 1 "refs/tags/$TAG_NAME")"
          head_commit="$(git rev-parse HEAD)"

          if [[ "$tag_commit" != "$VALIDATED_TAG_COMMIT" ]]; then
            echo "::error::Tag $TAG_NAME resolved to $tag_commit, expected validated commit $VALIDATED_TAG_COMMIT." >&2
            exit 1
          fi

          if [[ "$head_commit" != "$VALIDATED_TAG_COMMIT" ]]; then
            echo "::error::Checked-out commit $head_commit does not match validated $TAG_NAME commit $VALIDATED_TAG_COMMIT." >&2
            exit 1
          fi

          echo "Verified $TAG_NAME is checked out at validated commit $head_commit."

      - name: Normalize ARM runner image label
        if: matrix.platform == 'linux-arm64'
        shell: bash
        run: echo "ImageOS=ubuntu24" >> "$GITHUB_ENV"

      - name: Set up Elixir
        uses: erlef/setup-beam@v1
        with:
          elixir-version: "1.16"
          otp-version: "26"

      - name: Install dependencies
        run: mix deps.get

      - name: Compile with warnings as errors
        env:
          MIX_PROJECT_VERSION: ${{ needs.validate.outputs.version }}
        run: mix compile --warnings-as-errors

      - name: Build OTP release tarball
        shell: bash
        env:
          MIX_ENV: prod
          MIX_PROJECT_VERSION: ${{ needs.validate.outputs.version }}
          TAG_NAME: ${{ needs.validate.outputs.tag_name }}
          PLATFORM: ${{ matrix.platform }}
        run: |
          set -euo pipefail

          mix deps.get --only prod
          mix release --overwrite

          release_dir="_build/prod/rel/mirror_neuron"
          if [[ ! -d "$release_dir" ]]; then
            echo "Expected OTP release directory was not created: $release_dir" >&2
            exit 1
          fi

          mkdir -p dist
          tarball="dist/MirrorNeuron-${TAG_NAME}-${PLATFORM}-otp-release.tar.gz"
          if [[ -e "$tarball" ]]; then
            echo "Refusing to overwrite existing OTP release tarball: $tarball" >&2
            exit 1
          fi

          tar -czf "$tarball" -C "$(dirname "$release_dir")" "$(basename "$release_dir")"
          scripts/check-release-artifacts.sh "$tarball"

      - name: Upload OTP release tarball
        uses: actions/upload-artifact@v4
        with:
          name: otp-release-${{ matrix.platform }}
          path: dist/*.tar.gz
          if-no-files-found: error

  github-release:
    name: Create GitHub Release
    runs-on: ubuntu-24.04
    needs:
      - validate
      - build-otp
    permissions:
      contents: write

    steps:
      - name: Check out repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: refs/tags/${{ needs.validate.outputs.tag_name }}

      - name: Verify checkout matches validated tag commit
        shell: bash
        env:
          TAG_NAME: ${{ needs.validate.outputs.tag_name }}
          VALIDATED_TAG_COMMIT: ${{ needs.validate.outputs.tag_commit }}
        run: |
          set -euo pipefail

          tag_commit="$(git rev-list -n 1 "refs/tags/$TAG_NAME")"
          head_commit="$(git rev-parse HEAD)"

          if [[ "$tag_commit" != "$VALIDATED_TAG_COMMIT" ]]; then
            echo "::error::Tag $TAG_NAME resolved to $tag_commit, expected validated commit $VALIDATED_TAG_COMMIT." >&2
            exit 1
          fi

          if [[ "$head_commit" != "$VALIDATED_TAG_COMMIT" ]]; then
            echo "::error::Checked-out commit $head_commit does not match validated $TAG_NAME commit $VALIDATED_TAG_COMMIT." >&2
            exit 1
          fi

          echo "Verified $TAG_NAME is checked out at validated commit $head_commit."

      - name: Download OTP release tarballs
        uses: actions/download-artifact@v4
        with:
          pattern: otp-release-*
          path: release-assets
          merge-multiple: true

      - name: Create SHA256 checksums
        shell: bash
        run: |
          set -euo pipefail
          cd release-assets

          mapfile -t tarballs < <(find . -maxdepth 1 -type f -name '*.tar.gz' -print | LC_ALL=C sort)
          if [[ "${#tarballs[@]}" -ne 3 ]]; then
            echo "Expected exactly 3 OTP release tarballs, found ${#tarballs[@]}." >&2
            printf '%s\n' "${tarballs[@]}" >&2
            exit 1
          fi

          shasum -a 256 "${tarballs[@]}" > SHA256SUMS.txt

      - name: Validate release assets
        shell: bash
        run: |
          set -euo pipefail
          mapfile -t assets < <(find release-assets -maxdepth 1 -type f \( -name '*.tar.gz' -o -name 'SHA256SUMS.txt' \) | LC_ALL=C sort)
          scripts/check-release-artifacts.sh "${assets[@]}"

      - name: Create GitHub Release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ needs.validate.outputs.tag_name }}
          IS_PRERELEASE: ${{ needs.validate.outputs.is_prerelease }}
        run: |
          set -euo pipefail

          if gh release view "$TAG_NAME" >/dev/null 2>&1; then
            echo "Release $TAG_NAME already exists; refusing to overwrite it." >&2
            exit 1
          fi

          mapfile -t assets < <(find release-assets -maxdepth 1 -type f | LC_ALL=C sort)
          if [[ "${#assets[@]}" -ne 4 ]]; then
            echo "Expected exactly 4 release assets, found ${#assets[@]}." >&2
            printf '%s\n' "${assets[@]}" >&2
            exit 1
          fi

          release_args=(release create "$TAG_NAME")
          release_args+=("${assets[@]}")
          release_args+=(--title "$TAG_NAME" --verify-tag --generate-notes)

          if [[ "$IS_PRERELEASE" == "true" ]]; then
            release_args+=(--prerelease)
          fi

          gh "${release_args[@]}"