publish_release.yaml

name: Publish a release
on:
  # Trigger this release via the GitHub Actions interface for this workflow
  workflow_dispatch:

env:
  PUBLISH_GIT_USERNAME: "AppSignal release bot"
  PUBLISH_GIT_EMAIL: "support+build-sign@appsignal.com"

jobs:
  build:
    name: "Build the release"
    runs-on: ${{matrix.runner}}
    strategy:
      fail-fast: true
      matrix:
        include:
          - runner: ubuntu-22.04
            target: "x86_64-unknown-linux-gnu"
          - runner: ubuntu-22.04
            target: "x86_64-unknown-linux-musl"
          - runner: ubuntu-22.04
            target: "aarch64-unknown-linux-gnu"
          - runner: ubuntu-22.04
            target: "aarch64-unknown-linux-musl"
          - runner: macos-14
            target: "x86_64-apple-darwin"
          - runner: macos-14
            target: "aarch64-apple-darwin"
    steps:
      - name: "Checkout the project"
        uses: actions/checkout@v4
        with:
          path: "main"

      - name: "Checkout Mono"
        uses: actions/checkout@v4
        with:
          repository: "appsignal/mono"
          path: "mono"

      - name: "Install Cross"
        run: |
          cargo install cross

      # Linux targets will cross compile on Docker images used by Cross.
      - name: "Login to Docker Hub"
        if: matrix.runner == 'ubuntu-22.04'
        uses: docker/login-action@v3
        with:
          username: ${{secrets.PUBLISH_DOCKERHUB_USERNAME}}
          password: ${{secrets.PUBLISH_DOCKERHUB_TOKEN}}

      # macOS targets do not build using a Cross image, so they may need to
      # download the target for their architecture.
      - name: "Install macOS architecture target"
        if: matrix.runner == 'macos-14'
        working-directory: "./main"
        run: |
          rustup target add "${{matrix.target}}"

      # The version number needs to be written to the project's `Cargo.toml`
      # file before building the release.
      - name: "Write new version number"
        working-directory: "./main"
        run: |
          ../mono/bin/mono publish --no-git --no-package-push --yes

      - name: "Build artifact"
        working-directory: "./main"
        run: |
          script/build_artifact "${{matrix.target}}"

      # Temporarily store the build artifact as a GitHub Action artifact to
      # move it to the next job.
      - name: "Store build artifact"
        uses: actions/upload-artifact@v4
        with:
          name: "${{matrix.target}}"
          path: "main/release/${{matrix.target}}.tar.gz"
          retention-days: 1
          if-no-files-found: error

  publish:
    name: "Publish the release"
    needs:
      - build
    runs-on: ubuntu-22.04
    steps:
      - name: "Checkout the project"
        uses: actions/checkout@v4
        with:
          ssh-key: "${{secrets.PUBLISH_DEPLOY_KEY}}"
          path: "main"

      - name: "Checkout Mono"
        uses: actions/checkout@v4
        with:
          repository: "appsignal/mono"
          path: "mono"

      - name: "Configure Git"
        run: |
          export PUBLISH_GIT_SSH_PATH="$HOME/.ssh"
          export PUBLISH_GIT_SIGN_KEY_PATH="$HOME/.ssh/sign_key"
          mkdir -p "$PUBLISH_GIT_SSH_PATH"
          echo "${{secrets.PUBLISH_GIT_SIGN_KEY}}" > "$PUBLISH_GIT_SIGN_KEY_PATH"
          echo "${{secrets.PUBLISH_GIT_SIGN_PUBLIC_KEY}}" > "$PUBLISH_GIT_SIGN_KEY_PATH.pub"
          chmod 600 "$PUBLISH_GIT_SIGN_KEY_PATH"
          git config --global user.name "$PUBLISH_GIT_USERNAME (as ${{github.actor}})"
          git config --global user.email "$PUBLISH_GIT_EMAIL"
          git config --global gpg.format ssh
          git config --global commit.gpgsign true
          touch ~/.ssh/allowed_signers
          echo "$(git config --get user.email) namespaces=\"git\" $(cat $PUBLISH_GIT_SIGN_KEY_PATH.pub)" >> ~/.ssh/allowed_signers
          git config --global user.signingkey "$PUBLISH_GIT_SIGN_KEY_PATH"

      - name: "Login to Docker Hub"
        uses: docker/login-action@v3
        with:
          username: ${{secrets.PUBLISH_DOCKERHUB_USERNAME}}
          password: ${{secrets.PUBLISH_DOCKERHUB_TOKEN}}

      - name: "Fetch build artifacts"
        uses: actions/download-artifact@v4
        with:
          path: "main/release"

      - name: "Push release tag"
        id: version
        working-directory: "./main"
        run: |
          ../mono/bin/mono publish --no-package-push --yes

          export RELEASE_VERSION="$(script/read_version)"
          echo "RELEASE_VERSION=$RELEASE_VERSION" >> "$GITHUB_OUTPUT"
          echo "TAG_NAME=v$RELEASE_VERSION" >> "$GITHUB_OUTPUT"

      - name: "Create a release on the repository"
        working-directory: "./main"
        run: |
          gh release create ${{steps.version.outputs.TAG_NAME}} \
            --title "${{steps.version.outputs.RELEASE_VERSION}}" \
            --notes-from-tag \
            --verify-tag \
            'release/x86_64-unknown-linux-gnu/x86_64-unknown-linux-gnu.tar.gz#Linux (x86_64)' \
            'release/x86_64-unknown-linux-musl/x86_64-unknown-linux-musl.tar.gz#Linux (x86_64, musl)' \
            'release/aarch64-unknown-linux-gnu/aarch64-unknown-linux-gnu.tar.gz#Linux (arm64)' \
            'release/aarch64-unknown-linux-musl/aarch64-unknown-linux-musl.tar.gz#Linux (arm64, musl)' \
            'release/x86_64-apple-darwin/x86_64-apple-darwin.tar.gz#macOS (x86_64)' \
            'release/aarch64-apple-darwin/aarch64-apple-darwin.tar.gz#macOS (arm64)' \
            'install.sh#Installer script'
        env:
          GH_TOKEN: ${{github.token}}