release.yml

name: Release

on:
  pull_request: {}
  workflow_dispatch:
    inputs:
      version:
        description: "Version in the form v1.2.3-prerelease+buildinfo"
        required: true
        type: string
      tag-prefix:
        description: "Tag prefix"
        required: false
        type: string
        default: "release/"
      profile:
        description: "Build profile"
        required: false
        type: choice
        options: ["debug", "release"]
        default: "release"
      publish:
        description: "Publish the release?"
        required: false
        type: boolean
        default: false
      ref:
        description: "Reference of the commit to release (default: github.ref)"
        required: false
        type: string
        default: ""
      prerelease:
        description: "Is this a prerelease?"
        required: false
        type: boolean
        default: false
      draft:
        description: "Is this a draft?"
        required: false
        type: boolean
        default: false

env:
  CARGO_INCREMENTAL: 0
  CARGO_NET_RETRY: 10
  CHECKSEC_VERSION: 2.5.0
  RUSTFLAGS: "-D warnings -A deprecated"
  RUSTUP_MAX_RETRIES: 10

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref }}
  cancel-in-progress: true

jobs:
  meta:
    timeout-minutes: 5
    runs-on: ubuntu-latest
    steps:
      - id: meta
        env:
          VERSION: ${{ inputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          shopt -s extglob
          if [[ "$GITHUB_EVENT_NAME" == pull_request ]]; then
            echo version="0.0.0-test.${GITHUB_SHA:0:7}"
            echo archs='["amd64"]'
            exit 0
          fi >> "$GITHUB_OUTPUT"
          if ! [[ "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z-]+)?(\+[0-9A-Za-z-]+)?$ ]]; then
            echo "Invalid version: $VERSION" >&2
            exit 1
          fi
          ( echo version="${VERSION#v}"
            echo archs='["amd64", "arm64", "arm"]'
          ) >> "$GITHUB_OUTPUT"

      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
        if: github.event_name == 'pull_request'
      - id: changed
        if: github.event_name == 'pull_request'
        uses: tj-actions/changed-files@20576b4b9ed46d41e2d45a2256e5e2316dde6834
        with:
          files: |
            .github/workflows/release.yml
            justfile
            Cargo.toml

    outputs:
      archs: ${{ steps.meta.outputs.archs }}
      version: ${{ steps.meta.outputs.version }}
      package: ${{ github.event_name == 'workflow_dispatch' || steps.changed.outputs.any_changed == 'true' }}
      profile: ${{ inputs.profile || 'release' }}
      publish: ${{ inputs.publish }}
      ref: ${{ inputs.ref || github.ref }}
      tag: "${{ inputs.tag-prefix || 'release/' }}v${{ steps.meta.outputs.version }}"
      prerelease: ${{ inputs.prerelease }}
      draft: ${{ inputs.draft }}

  info:
    needs: meta
    runs-on: ubuntu-latest
    timeout-minutes: 3
    steps:
      - name: Info
        run: |
          echo 'github.repository_owner: ${{ github.repository_owner }}'
          echo 'inputs.version: ${{ inputs.version }}'
          echo 'inputs.tag-prefix: ${{ inputs.tag-prefix }}'
          echo 'inputs.profile: ${{ inputs.profile }}'
          echo 'inputs.publish: ${{ inputs.publish }}'
          echo 'inputs.ref: ${{ inputs.ref }}'
          echo 'needs.meta.outputs.archs: ${{ needs.meta.outputs.archs }}'
          echo 'needs.meta.outputs.version: ${{ needs.meta.outputs.version }}'
          echo 'needs.meta.outputs.package: ${{ needs.meta.outputs.package }}'
          echo 'needs.meta.outputs.profile: ${{ needs.meta.outputs.profile }}'
          echo 'needs.meta.outputs.publish: ${{ needs.meta.outputs.publish }}'
          echo 'needs.meta.outputs.ref: ${{ needs.meta.outputs.ref }}'
          echo 'needs.meta.outputs.prerelease: ${{ needs.meta.outputs.prerelease }}'
          echo 'needs.meta.outputs.draft: ${{ needs.meta.outputs.draft }}'

  package:
    needs: meta
    if: needs.meta.outputs.package == 'true'

    strategy:
      matrix:
        arch: ${{ fromJson(needs.meta.outputs.archs) }}
        libc: [gnu] # musl

    # If we're not actually building on a release tag, don't short-circuit on
    # errors. This helps us know whether a failure is platform-specific.
    continue-on-error: ${{ needs.meta.outputs.publish != 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 40
    container: docker://ghcr.io/linkerd/dev:v43-rust-musl
    env:
      LINKERD2_PROXY_VENDOR: ${{ github.repository_owner }}
      LINKERD2_PROXY_VERSION: ${{ needs.meta.outputs.version }}
    steps:
      - name: Configure git
        run: git config --global --add safe.directory "$PWD" # actions/runner#2033
      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
        with:
          ref: ${{ needs.meta.outputs.ref }}
      - uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84
        with:
          key: ${{ matrix.libc }}
      - run: just fetch
      - run: just arch=${{ matrix.arch }} libc=${{ matrix.libc }} rustup
      - run: just arch=${{ matrix.arch }} libc=${{ matrix.libc }} profile=${{ needs.meta.outputs.profile }} build
      - run: just arch=${{ matrix.arch }} libc=${{ matrix.libc }} profile=${{ needs.meta.outputs.profile }} package
      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3
        with:
          name: ${{ matrix.arch }}-artifacts
          path: target/package/*

  publish:
    needs: [meta, package]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      actions: write
      contents: write
    steps:
      - name: Configure git
        env:
          GITHUB_USERNAME: ${{ vars.LINKERD2_PROXY_GITHUB_USERNAME || 'github-actions[bot]' }}
        run: |
          git config --global --add safe.directory "$PWD" # actions/runner#2033
          git config --global user.name "$GITHUB_USERNAME"
          git config --global user.email "$GITHUB_USERNAME"@users.noreply.github.com
      # Tag the release.
      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
        with:
          token: ${{ secrets.LINKERD2_PROXY_GITHUB_TOKEN || github.token }}
          ref: ${{ needs.meta.outputs.ref }}
      - run: git tag -a -m 'v${{ needs.meta.outputs.version }}' '${{ needs.meta.outputs.tag }}'
      # Fetch the artifacts.
      - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427
        with:
          path: artifacts
      - run: du -h artifacts/**/*
      # Publish the release.
      - if: needs.meta.outputs.publish == 'true'
        run: git push origin '${{ needs.meta.outputs.tag }}'
      - if: needs.meta.outputs.publish == 'true'
        uses: softprops/action-gh-release@9d7c94cfd0a1f3ed45544c887983e9fa900f0564
        with:
          name: v${{ needs.meta.outputs.version }}
          tag_name: ${{ needs.meta.outputs.tag }}
          files: artifacts/**/*
          generate_release_notes: true
          prerelease: ${{ needs.meta.outputs.prerelease }}
          draft: ${{ needs.meta.outputs.draft }}

  release-ok:
    needs: publish
    if: always()
    timeout-minutes: 3
    runs-on: ubuntu-latest
    steps:
      - name: Results
        run: |
          echo 'needs.publish.result: ${{ needs.publish.result }}'

      - name: Verify jobs
        # All jobs must succeed or be skipped.
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: exit 1