publish-release.yml

name: Release binaries
permissions: {}

on:
  push:
    tags:
      - "v*"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  create-installer:
    # Run Inno Setup to create the Windows app installer, then write it to actions/cache
    name: Create Windows Installer
    runs-on: windows-latest
    env:
      go: "1.26"
      cgo: "0"
      winfsp: winfsp-2.1.25156.msi
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install Go
        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version: ${{ env.go }}
          check-latest: true
          cache: false

      - name: Set CGO
        shell: bash
        run: |
          echo 'CGO_ENABLED=0' >> $GITHUB_ENV

      - name: Build
        shell: bash
        env:
          SHA: ${{ github.sha }}
        run: |
          commitDate=$(TZ=UTC0 git log -1 --format=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)
          ldflags="-s -w -X github.com/Seagate/cloudfuse/common.GitCommit=${SHA} -X github.com/Seagate/cloudfuse/common.CommitDate=$commitDate"
          go build -trimpath -ldflags ''"$ldflags"'' -o cloudfuse.exe
          go build -trimpath -ldflags ''"$ldflags"'' -o cfusemon.exe ./tools/health-monitor/
          go build -trimpath -ldflags ''"$ldflags"'' -o windows-startup.exe ./tools/windows-startup/
          go build -trimpath -ldflags ''"$ldflags"'' -o windows-service.exe ./tools/windows-service/
          touch -m -d $commitDate cloudfuse.exe
          touch -m -d $commitDate cfusemon.exe
          touch -m -d $commitDate windows-startup.
          touch -m -d $commitDate windows-service.exe

        # Get the WinFSP installer (from cache or download)
      - name: Get cached WinFSP installer
        id: restore-winfsp-installer
        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: ${{ env.winfsp }}
          key: ${{ env.winfsp }}

      - name: Download WinFSP installer
        if: ${{ ! steps.restore-winfsp-installer.outputs.cache-hit }}
        shell: bash
        env:
          WINFSP: ${{ env.winfsp }}
        run: |
          curl -LOf https://github.com/winfsp/winfsp/releases/download/v2.1/${{ env.winfsp }}

      - name: Cache WinFSP installer
        if: ${{ ! steps.restore-winfsp-installer.outputs.cache-hit }}
        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: ${{ env.winfsp }}
          key: ${{ env.winfsp }}

      - name: Set Version
        id: get_version
        shell: bash
        run: echo "VERSION=${REF_NAME#v}" >> $GITHUB_OUTPUT
        env:
          REF_NAME: ${{ github.ref_name }}

      - name: Run Inno Setup
        # Build the installer and save it to actions/cache
        working-directory: ./build
        shell: bash
        # Inno Setup is pre-installed on GitHub's windows-latest image
        # see documentation: https://github.com/actions/runner-images/blob/main/images/windows/Windows2022-Readme.md
        run: |
          "C:/Program Files (x86)/Inno Setup 6/iscc.exe" windows_installer_build.iss

      - name: Rename installer
        run: |
          mv build/Output/cloudfuse.exe build/Output/cloudfuse_${{ steps.get_version.outputs.VERSION }}_windows_amd64.exe

      - name: Cache windows installer
        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          enableCrossOsArchive: true
          path: build/Output/cloudfuse_${{ steps.get_version.outputs.VERSION }}_windows_amd64.exe
          key: windows-cloudfuse-installer-${{ github.sha }}

  release:
    # Use GoReleaser to package and publish Linux releases along with the Windows installer
    name: Release Binaries
    needs: create-installer
    runs-on: ubuntu-latest
    env:
      go: "1.26"
      zig: 0.15.2
    permissions:
      contents: write # Needed to create releases
      id-token: write # Needed for signing with Cosign

    steps:
      # libfuse-dev is required to build our command-line program and enable GoReleaser to build for ARM64
      - name: Install Libfuse
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu libfuse-dev libfuse3-dev
      # Get code and Go ready
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install Zig
        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
        with:
          version: ${{ env.zig }}
          use-cache: false

      - name: Install Go
        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version: ${{ env.go }}
          check-latest: true
          cache: false

      - name: Set up Cosign
        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Set Version
        id: get_version
        run: echo "VERSION=${REF_NAME#v}" >> $GITHUB_OUTPUT
        env:
          REF_NAME: ${{ github.ref_name }}

        # Get cached intermediate build products
      - name: Restore cached Windows installer
        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          enableCrossOsArchive: true
          path: build/Output/cloudfuse_${{ steps.get_version.outputs.VERSION }}_windows_amd64.exe
          key: windows-cloudfuse-installer-${{ github.sha }}
          fail-on-cache-miss: true

        # Run GoReleaser (see .goreleaser.yaml)
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
        with:
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  update-package-repos:
    name: Update APT & RPM Repositories
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: write # Needed to update gh-pages branch

    steps:
      - name: Install dependencies
        run: sudo apt-get update && sudo apt-get install -y createrepo-c

      - name: Checkout gh-pages branch
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: gh-pages
          path: gh-pages
          persist-credentials: true

      - name: Download .deb and .rpm packages from release
        env:
          GH_REPO: ${{ github.repository }}
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          mkdir ./packages
          gh release download "$TAG" --repo "$GH_REPO" --dir ./packages -p "*.deb"
          gh release download "$TAG" --repo "$GH_REPO" --dir ./packages -p "*.rpm"

      - name: Import GPG key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}

      - name: Update APT repository
        working-directory: ./gh-pages
        run: |
          set -euo pipefail
          # Move new .deb files into the repository
          find ../packages -name "*_amd64.deb" -exec mv {} dists/stable/main/binary-amd64/ \;
          find ../packages -name "*_arm64.deb" -exec mv {} dists/stable/main/binary-arm64/ \;
          # Generate Packages metadata
          apt-ftparchive packages dists/stable/main/binary-amd64 > dists/stable/main/binary-amd64/Packages
          gzip -k -f dists/stable/main/binary-amd64/Packages
          apt-ftparchive packages dists/stable/main/binary-arm64 > dists/stable/main/binary-arm64/Packages
          gzip -k -f dists/stable/main/binary-arm64/Packages
          # Generate Release file
          apt-ftparchive \
            -o APT::FTPArchive::Release::Origin="Seagate Technology" \
            -o APT::FTPArchive::Release::Label="cloudfuse" \
            -o APT::FTPArchive::Release::Suite="stable" \
            -o APT::FTPArchive::Release::Codename="stable" \
            -o APT::FTPArchive::Release::Architectures="amd64 arm64" \
            -o APT::FTPArchive::Release::Components="main" \
            -o APT::FTPArchive::Release::Description="APT repository for cloudfuse" \
            release dists/stable > dists/stable/Release
          # Remove old signatures to avoid "File exists"
          rm -f dists/stable/InRelease dists/stable/Release.gpg
          # Sign the Release file
          gpg --yes --clearsign -u "${STEPS_IMPORT_GPG_OUTPUTS_FINGERPRINT}" --batch --pinentry-mode loopback --passphrase "${SECRET_GPG_PASSPHRASE}" -o dists/stable/InRelease dists/stable/Release
          gpg --yes -u "${STEPS_IMPORT_GPG_OUTPUTS_FINGERPRINT}" --batch --pinentry-mode loopback --passphrase "${SECRET_GPG_PASSPHRASE}" -abs -o dists/stable/Release.gpg dists/stable/Release
        env:
          STEPS_IMPORT_GPG_OUTPUTS_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
          SECRET_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      - name: Update RPM repository
        working-directory: ./gh-pages
        run: |
          set -euo pipefail
          # Move new .rpm files
          find ../packages -name "*.rpm" -exec mv {} rpm-repo/ \;
          # Create/update repository metadata
          createrepo_c --database rpm-repo/
          # Remove old signatures to avoid "File exists"
          rm -f rpm-repo/repodata/repomd.xml.asc rpm-repo/repodata/repomd.xml.gpg
          # Sign the repository metadata
          gpg --yes --detach-sign --armor -u "${STEPS_IMPORT_GPG_OUTPUTS_FINGERPRINT}" --batch --pinentry-mode loopback --passphrase "${SECRET_GPG_PASSPHRASE}" -o rpm-repo/repodata/repomd.xml.asc \
             rpm-repo/repodata/repomd.xml
        env:
          STEPS_IMPORT_GPG_OUTPUTS_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
          SECRET_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      - name: Commit and push repository updates
        working-directory: ./gh-pages
        env:
          GITHUB_REF_NAME: ${{ github.ref_name }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add .
          if git diff-index --quiet HEAD; then
            echo "No changes to commit."
          else
            git commit -m "Update APT & RPM repositories for release ${GITHUB_REF_NAME}"
            git push
          fi