release.yaml

'env':
  'BASE_IMAGE': |-
    ${{ vars.BASE_IMAGE || 'adguard/go-builder:1.26.8--1' }}
  'BUILD_DIR': |-
    build
  'CHANNEL': |-
    ${{ case(
      startsWith(github.ref_name, 'release-v'), 'release',
      startsWith(github.ref_name, 'beta-v'), 'beta',
      'edge'
    ) }}
  'CLIENT_DIR': |-
    ${{ case(
      startsWith(github.ref_name, 'release-v'), 'client',
      startsWith(github.ref_name, 'beta-v'), 'client',
      'client_v2'
    ) }}
  'DIST_DIR': |-
    dist
  'FRONTEND_BASE_IMAGE': |-
    ${{ vars.FRONTEND_BASE_IMAGE || 'adguard/home-js-builder:4.0' }}
'jobs':
  'Build':
    'if': |
      ${{ github.repository_owner == 'AdGuardSoftwareLimited' }}
    'permissions':
      'contents': 'read'
      'id-token': 'write'
    'runs-on': 'team-go'
    'steps':
      - 'uses': 'actions/checkout@v6'
        'with':
          'fetch-depth': 0
          # Set to false to avoid GITHUB_TOKEN leaking.
          #
          # See https://github.com/actions/checkout/issues/485#issuecomment-934422611.
          'persist-credentials': false
      - 'name': 'Build frontend'
        'uses': 'AdGuardSoftwareLimited/actions/actions/docker-build@master'
        'with':
          'dockerfile': 'docker/frontend.Dockerfile'
          'context': '.'
          'target': 'builder-exporter'
          'output': '.'
          'build-args': |
            BASE_IMAGE=${{ env.FRONTEND_BASE_IMAGE }}
            CACHE_BUSTER=${{ inputs.cache_buster || '0' }}
            CLIENT_DIR=${{ env.CLIENT_DIR }}
            DIST_DIR=${{ env.BUILD_DIR }}
      - 'name': 'Set source date epoch'
        'run': |
          echo "SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)" >> "$GITHUB_ENV"
      - 'name': 'Retrieve GPG signing secrets'
        'uses': 'hashicorp/vault-action@v4'
        'with':
          'url': ${{ vars.VAULT_URL }}
          'method': 'jwt'
          'role': 'gpg-signing'
          'secrets': |
            secret/data/ci-secrets/gpg-signing gpgPassword | GPG_PASSWORD ;
            secret/data/ci-secrets/gpg-signing gpgSecretKey | GPG_SECRET_KEY ;
      - 'name': 'Build release artifacts'
        'uses': 'AdGuardSoftwareLimited/actions/actions/docker-build@master'
        'with':
          'dockerfile': 'docker/ci.Dockerfile'
          'context': '.'
          'target': 'builder-exporter'
          'output': '.'
          # TODO(d.kolyshev): !! Check correct version.
          'build-args': |
            BASE_IMAGE=${{ env.BASE_IMAGE }}
            BRANCH=${{ github.ref_name }}
            CACHE_BUSTER=${{ inputs.cache_buster || '0' }}
            CHANNEL=${{ env.CHANNEL }}
            DIST_DIR=${{ env.DIST_DIR }}
            REVISION=${{ github.sha }}
            SIGN=1
            SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
            VERSION=${{ github.ref_name }}
          'secrets': |
            GPG_KEY_PASSPHRASE=${{ env.GPG_PASSWORD }}
            GPG_SECRET_KEY=${{ env.GPG_SECRET_KEY }}
      - 'uses': 'actions/upload-artifact@v7'
        'with':
          'name': 'adguardhome'
          'path': |
            ${{ env.DIST_DIR }}
  'SignWindowsBuilds':
    'name': 'Sign Windows executables'
    'needs': 'Build'
    'if': |
      ${{ github.repository_owner == 'AdGuardSoftwareLimited' }}
    'permissions':
      'contents': 'read'
      'id-token': 'write'
    'uses': 'AdGuardSoftwareLimited/actions/.github/workflows/sign-by-signer.yml@master'
    'with':
      'team': 'go'
      'artifact-name': 'adguardhome'
      'files': '**/**/AdGuardHome.exe'
      'signed-artifact-name': 'adguardhome'
  # TODO(d.kolyshev): !! Rewrite windows ZIP archives.
  'CalculateChecksums':
    'name': 'Calculate Checksums'
    'needs': 'SignWindowsBuilds'
    'if': |
      ${{ github.repository_owner == 'AdGuardSoftwareLimited' }}
    'permissions':
      'contents': 'read'
    'runs-on': 'team-go'
    'steps':
      - 'uses': 'actions/checkout@v6'
        'with':
          # Set to false to avoid GITHUB_TOKEN leaking.
          #
          # See https://github.com/actions/checkout/issues/485#issuecomment-934422611.
          'persist-credentials': false
      - 'uses': 'actions/download-artifact@v8'
        'with':
          'name': 'adguardhome'
          'path': |
            ${{ env.DIST_DIR }}
      - 'name': 'Calculate Checksums'
        'run': |
          env \
            DIST_DIR="${{ env.DIST_DIR }}" \
            VERBOSE=1 \
            sh ./scripts/make/calc-checksums.sh
      - 'uses': 'actions/upload-artifact@v7'
        'with':
          'name': 'adguardhome'
          'overwrite': true
          'path': |
            ${{ env.DIST_DIR }}
  'DeployToStaticStorage':
    'if': |
      ${{ github.event_name == 'workflow_dispatch' && github.repository_owner == 'AdGuardSoftwareLimited' }}
    'needs': 'CalculateChecksums'
    'permissions':
      'contents': 'read'
      'id-token': 'write'
    'uses': 'AdGuardSoftwareLimited/actions/.github/workflows/deploy-to-static.yml@master'
    'with':
      'team': 'go'
      # env is not available in reusable workflow inputs; keep this in sync
      # with the workflow-level CHANNEL value.
      'deployer-module': |-
        adguard-home-${{ case(
          startsWith(github.ref_name, 'release-v'), 'release',
          startsWith(github.ref_name, 'beta-v'), 'beta',
          'edge'
        ) }}
      'artifact-name': 'adguardhome'
      'environment': |-
        ${{ case(
          startsWith(github.ref_name, 'release-v'), 'release',
          startsWith(github.ref_name, 'beta-v'), 'beta',
          'edge'
        ) }}-static
  'PublishDocker':
    'if': |
      ${{ github.event_name == 'workflow_dispatch' && github.repository_owner == 'AdGuardSoftwareLimited' }}
    'needs': 'DeployToStaticStorage'
    'permissions':
      'contents': 'read'
    'runs-on': 'team-go'
    'steps':
      - 'uses': 'actions/checkout@v6'
        'with':
          'fetch-depth': 0
          # Set to false to avoid GITHUB_TOKEN leaking.
          #
          # See https://github.com/actions/checkout/issues/485#issuecomment-934422611.
          'persist-credentials': false
      - 'uses': 'actions/download-artifact@v8'
        'with':
          'name': 'adguardhome'
          'path': |
            ${{ env.DIST_DIR }}
      - 'name': 'Publish to Docker Hub'
        'run': |
          #!/bin/sh

          set -e -f -u -x

          # TODO(d.kolyshev):  Use AdGuardSoftwareLimited/actions/actions/docker-build.
          # TODO(d.kolyshev): !! Set DOCKER_PUSH='1'.
          env \
              CHANNEL=${{ env.CHANNEL }} \
              REVISION=${{ github.sha }} \
              DIST_DIR=${{ env.DIST_DIR }} \
              DOCKER_IMAGE_NAME='adguard/adguardhome' \
              DOCKER_PUSH='0' \
              VERBOSE='1' \
              sh ./scripts/make/build-docker.sh \
              ;
  'PublishGitHubRelease':
    'if': |
      ${{ github.event_name == 'workflow_dispatch' && github.repository_owner == 'AdGuardSoftwareLimited' }}
    'needs': 'DeployToStaticStorage'
    'permissions':
      'contents': 'read'
      # Octopass OIDC for the cross-repo token.
      'id-token': 'write'
    'uses': 'AdGuardSoftwareLimited/actions/.github/workflows/create-gh-release.yml@master'
    'with':
      'artifact_name': 'adguardhome'
      'draft': true
      'tag_name': ${{ github.ref_name }}
      'team': 'go'
      'target_repo': 'AdguardTeam/AdGuardHome'
'name': 'Build and publish releases'
'on':
  # TODO(d.kolyshev): !! Remove on push.
  'push':
    'branches':
      - '*'
  'workflow_dispatch':
    'inputs':
      'cache_buster':
        'default': ''
        'description': |
          Override to force re-run of cached stages (pass any unique value).
        'type': 'string'
# Permissions are disabled for all the jobs by default, and then overridden for
# specific jobs if needed.  This is a recommended practice for security reasons,
# and also allows to avoid mistakes with permissions when creating new jobs.
#
# See https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions.
'permissions': {}