release.yaml

name: release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Dry run — build everything, publish nothing"
        type: boolean
        default: true

permissions:
  contents: write
  packages: write
  issues: write
  id-token: write

jobs:

  meta:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.meta.outputs.version }}
      major: ${{ steps.meta.outputs.major }}
      is_prerelease: ${{ steps.meta.outputs.is_prerelease }}
      make_latest: ${{ steps.meta.outputs.make_latest }}
      update_pm: ${{ steps.meta.outputs.update_pm }}
      tailscale_version: ${{ steps.meta.outputs.tailscale_version }}
      git_commit: ${{ steps.meta.outputs.git_commit }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Compute release metadata
        id: meta
        run: |
          if [ "${GITHUB_REF#refs/tags/}" != "${GITHUB_REF}" ]; then
            TAG="${GITHUB_REF#refs/tags/}"
          else
            TAG="v$(git describe --tags --always --dirty 2>/dev/null || echo '0.0.0-test')"
          fi
          VERSION="${TAG#v}"
          MAJOR=$(echo "$VERSION" | cut -d. -f1)

          if echo "$TAG" | grep -qE '-(alpha|beta|rc|pre|dev)'; then
            IS_PRERELEASE=true
          else
            IS_PRERELEASE=false
          fi

          # Auto-detect stable major from release branches: the highest vN
          # branch on the remote is the current stable stream.
          # When v3 branch is created, v3 tags automatically become "latest".
          STABLE_MAJOR=$(git ls-remote --heads origin \
            | sed -n 's|.*refs/heads/v\([0-9][0-9]*\)$|\1|p' \
            | sort -n | tail -1)

          echo "Detected stable major: ${STABLE_MAJOR:-none}" >> "$GITHUB_STEP_SUMMARY"

          if [ "$MAJOR" = "${STABLE_MAJOR:-0}" ] && [ "$IS_PRERELEASE" = "false" ]; then
            MAKE_LATEST=true
            UPDATE_PM=true
          else
            MAKE_LATEST=false
            UPDATE_PM=false
          fi

          TS_VER=$(grep '^	tailscale.com ' go.mod | awk '{print $2}')

          echo "version=$VERSION"        >> "$GITHUB_OUTPUT"
          echo "major=$MAJOR"            >> "$GITHUB_OUTPUT"
          echo "is_prerelease=$IS_PRERELEASE" >> "$GITHUB_OUTPUT"
          echo "make_latest=$MAKE_LATEST"     >> "$GITHUB_OUTPUT"
          echo "update_pm=$UPDATE_PM"         >> "$GITHUB_OUTPUT"
          echo "tailscale_version=$TS_VER"    >> "$GITHUB_OUTPUT"
          echo "git_commit=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"

  prepare:
    needs: meta
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-go@v6
        with:
          go-version-file: "go.mod"
          cache: false

      - name: Download Go modules
        run: go mod download

      - name: Save Go module cache
        uses: actions/cache/save@v6
        with:
          path: ~/go/pkg/mod
          key: gomod-${{ runner.os }}-${{ hashFiles('**/go.sum') }}

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Build frontend
        run: |
          bun i --cwd ./web
          bun run --cwd web build

      - name: Generate templ
        run: |
          TEMPL_VER=$(go list -m github.com/a-h/templ | awk '{print $2}')
          curl -sSL "https://github.com/a-h/templ/releases/download/${TEMPL_VER}/templ_Linux_x86_64.tar.gz" \
            | tar xz -C /usr/local/bin templ
          go generate ./...

      - name: Upload prepared assets
        uses: actions/upload-artifact@v7
        with:
          name: prepared
          path: |
            web/dist/
            internal/**/*_templ.go
          if-no-files-found: error

  build:
    needs: [meta, prepare]
    strategy:
      matrix:
        include:
          - { goos: linux,   goarch: amd64, platform: linux_amd64 }
          - { goos: linux,   goarch: arm64, platform: linux_arm64 }
          - { goos: linux,   goarch: arm,   goarm: "6", platform: linux_armv6 }
          - { goos: linux,   goarch: arm,   goarm: "7", platform: linux_armv7 }
          - { goos: windows, goarch: amd64, platform: windows_amd64 }
          - { goos: windows, goarch: arm64, platform: windows_arm64 }
          - { goos: darwin,  goarch: amd64, platform: darwin_amd64 }
          - { goos: darwin,  goarch: arm64, platform: darwin_arm64 }
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 1

      - uses: actions/setup-go@v6
        with:
          go-version-file: "go.mod"
          cache: false

      - name: Restore Go module cache
        uses: actions/cache/restore@v6
        with:
          path: ~/go/pkg/mod
          key: gomod-${{ runner.os }}-${{ hashFiles('**/go.sum') }}
          fail-on-cache-miss: false

      - name: Download prepared assets
        uses: actions/download-artifact@v8
        with:
          name: prepared

      - name: Build binaries
        env:
          VERSION: ${{ needs.meta.outputs.version }}
          TS_VER: ${{ needs.meta.outputs.tailscale_version }}
          COMMIT: ${{ needs.meta.outputs.git_commit }}
        run: |
          set -euo pipefail
          ext=""
          [ "${{ matrix.goos }}" = "windows" ] && ext=".exe"
          mkdir -p dist

          CGO_ENABLED=0 GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} GOARM=${{ matrix.goarm }} \
            go build -ldflags "-s -w \
              -X github.com/almeidapaulopt/tsdproxy/internal/core.version=${VERSION} \
              -X tailscale.com/version.Short=${TS_VER} \
              -X tailscale.com/version.Long=${TS_VER}-TSDProxy \
              -X tailscale.com/version.GitCommit=${COMMIT} \
              -X tailscale.com/version.shortStamp=${TS_VER} \
              -X tailscale.com/version.longStamp=${TS_VER}-TSDProxy \
              -X tailscale.com/version.gitCommitStamp=${COMMIT}" \
            -o "dist/tsdproxyd${ext}" ./cmd/server/



      - name: Create archive
        env:
          VERSION: ${{ needs.meta.outputs.version }}
        run: |
          cp README.md LICENSE dist/
          if [ "${{ matrix.goos }}" = "windows" ]; then
            cd dist && zip -r -X "../tsdproxy_${VERSION}_${{ matrix.platform }}.zip" .
          else
            tar czf "tsdproxy_${VERSION}_${{ matrix.platform }}.tar.gz" -C dist .
          fi

      - name: Upload archive
        uses: actions/upload-artifact@v7
        with:
          name: archive-${{ matrix.platform }}
          path: tsdproxy_${{ needs.meta.outputs.version }}_${{ matrix.platform }}.*
          if-no-files-found: error

  assemble:
    needs: [meta, build]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Download all archives
        uses: actions/download-artifact@v8
        with:
          pattern: archive-*
          merge-multiple: true
          path: dist

      - name: Generate checksums
        run: |
          cd dist
          sha256sum tsdproxy_* | tee checksums.txt

      - name: Generate SBOM
        uses: anchore/sbom-action@v0.24.2
        with:
          format: spdx-json
          output-file: ${{ github.workspace }}/dist/sbom.spdx.json

      - name: Prepare Docker binaries
        env:
          VERSION: ${{ needs.meta.outputs.version }}
        run: |
          set -euo pipefail
          for plat in amd64:amd64 arm64:arm64 armv6:arm/v6 armv7:arm/v7; do
            src="${plat%%:*}"
            dst="${plat##*:}"
            mkdir -p "docker-binaries/linux/${dst}"
            tmp=$(mktemp -d)
            tar xzf "dist/tsdproxy_${VERSION}_linux_${src}.tar.gz" -C "$tmp/"
            cp "$tmp/tsdproxyd" "docker-binaries/linux/${dst}/"
            rm -rf "$tmp"
          done

      - name: Upload release assets
        uses: actions/upload-artifact@v7
        with:
          name: release-assets
          path: |
            dist/tsdproxy_*
            dist/checksums.txt
            dist/sbom.spdx.json
          if-no-files-found: error

      - name: Upload Docker binaries
        uses: actions/upload-artifact@v7
        with:
          name: docker-binaries
          path: docker-binaries/
          if-no-files-found: error

  docker:
    needs: [meta, assemble]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: docker/setup-qemu-action@v4
      - uses: docker/setup-buildx-action@v4

      - name: DockerHub login
        if: inputs.dry_run != true
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: GHCR login
        if: inputs.dry_run != true
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Download Docker binaries
        uses: actions/download-artifact@v8
        with:
          name: docker-binaries
          path: docker-binaries

      - name: Restore executable permissions
        run: |
          find docker-binaries -name tsdproxyd -exec chmod +x {} +

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: |
            almeidapaulopt/tsdproxy
            ghcr.io/almeidapaulopt/tsdproxy
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable=${{ needs.meta.outputs.make_latest == 'true' }}
          labels: |
            io.artifacthub.package.maintainers={"name":"Paulo Almeida","email":"almeidapaulopt@gmail.com"}
            io.artifacthub.package.license=MIT
            org.opencontainers.image.title=tsdproxy
            org.opencontainers.image.description=TSDProxy
            org.opencontainers.image.url=https://github.com/almeidapaulopt/tsdproxy

      - name: Build${{ inputs.dry_run == true && ' (dry-run, not pushed)' || '' }}
        id: push
        uses: docker/build-push-action@v7
        with:
          context: ./docker-binaries
          file: ./Dockerfile.ci
          platforms: linux/amd64,linux/arm64,linux/arm/v6,linux/arm/v7
          push: ${{ inputs.dry_run != true }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - uses: sigstore/cosign-installer@v4.1.2
        if: inputs.dry_run != true

      - name: Sign images with cosign
        if: inputs.dry_run != true
        env:
          COSIGN_EXPERIMENTAL: "1"
        run: |
          digest="${{ steps.push.outputs.digest }}"
          cosign sign --yes "almeidapaulopt/tsdproxy@${digest}"
          cosign sign --yes "ghcr.io/almeidapaulopt/tsdproxy@${digest}"

  github-release:
    needs: [meta, assemble]
    if: inputs.dry_run != true
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          name: release-assets
          path: dist

      - name: Generate changelog
        env:
          VERSION: ${{ needs.meta.outputs.version }}
        run: |
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
          if [ -n "$PREV_TAG" ]; then
            RANGE="${PREV_TAG}..HEAD"
          else
            RANGE="HEAD"
          fi

          {
            echo "## Changes"
            echo ""
            echo "### New Features"
            git log "$RANGE" --oneline --no-decorate --grep='^feat' | sed 's/^[a-f0-9]* /- /' || true
            echo ""
            echo "### Security Updates"
            git log "$RANGE" --oneline --no-decorate --grep='^sec' | sed 's/^[a-f0-9]* /- /' || true
            echo ""
            echo "### Bug Fixes"
            git log "$RANGE" --oneline --no-decorate --grep='^fix' | sed 's/^[a-f0-9]* /- /' || true
            echo ""
            echo "### Dependency Updates"
            git log "$RANGE" --oneline --no-decorate --grep='^.*\(deps\)\!:' | sed 's/^[a-f0-9]* /- /' || true
            echo ""
            echo "### Documentation"
            git log "$RANGE" --oneline --no-decorate --grep='^docs' | sed 's/^[a-f0-9]* /- /' || true
            echo ""
            echo "### Other Changes"
            git log "$RANGE" --oneline --no-decorate \
              --invert-grep \
              --grep='^feat' --grep='^fix' --grep='^sec' --grep='^docs' --grep='^chore' --grep='^test' \
              | sed 's/^[a-f0-9]* /- /' || true
          } > dist/CHANGELOG.md

      - name: Create release
        uses: softprops/action-gh-release@v3
        with:
          name: TSDProxy v${{ needs.meta.outputs.version }}
          body_path: dist/CHANGELOG.md
          prerelease: ${{ needs.meta.outputs.is_prerelease == 'true' }}
          make_latest: ${{ needs.meta.outputs.make_latest }}
          discussion_category_name: General
          files: |
            dist/tsdproxy_*
            dist/checksums.txt
            dist/sbom.spdx.json
          target_commitish: ${{ github.sha }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  homebrew:
    needs: [meta, github-release]
    if: inputs.dry_run != true && needs.meta.outputs.update_pm == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          name: release-assets
          path: dist

      - name: Compute SHA256 for darwin archives
        id: sha
        env:
          VERSION: ${{ needs.meta.outputs.version }}
        run: |
          echo "amd64=$(sha256sum "dist/tsdproxy_${VERSION}_darwin_amd64.tar.gz" | awk '{print $1}')" >> "$GITHUB_OUTPUT"
          echo "arm64=$(sha256sum "dist/tsdproxy_${VERSION}_darwin_arm64.tar.gz" | awk '{print $1}')" >> "$GITHUB_OUTPUT"

      - name: Update Homebrew tap
        env:
          VERSION: ${{ needs.meta.outputs.version }}
          SHA_AMD64: ${{ steps.sha.outputs.amd64 }}
          SHA_ARM64: ${{ steps.sha.outputs.arm64 }}
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          set -euo pipefail
          REPO_DIR="homebrew-tap"
          git clone "https://x-access-token:${HOMEBREW_TAP_TOKEN}@github.com/almeidapaulopt/homebrew-tap.git" "$REPO_DIR"

          cat > "$REPO_DIR/Casks/tsdproxy.rb" <<RUBY
          cask "tsdproxy" do
            arch arm: "arm64", intel: "amd64"

            version "${VERSION}"
            sha256 arm: "${SHA_ARM64}", intel: "${SHA_AMD64}"

            url "https://github.com/almeidapaulopt/tsdproxy/releases/download/v#{version}/tsdproxy_#{version}_darwin_#{arch}.tar.gz",
                verified: "github.com/almeidapaulopt/tsdproxy/"
            name "TSDProxy"
            desc "Tailscale Docker reverse proxy — expose containers with one label"
            homepage "https://github.com/almeidapaulopt/tsdproxy"

            binary "tsdproxyd"

            post_install do
              if OS.mac?
                system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/tsdproxyd"]
              end
            end
          end
          RUBY

          cd "$REPO_DIR"
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Casks/tsdproxy.rb
          git commit -m "tsdproxy ${VERSION}"
          git push

  aur:
    needs: [meta, github-release]
    if: inputs.dry_run != true && needs.meta.outputs.update_pm == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          name: release-assets
          path: dist

      - name: Compute SHA256 for linux archives
        id: sha
        env:
          VERSION: ${{ needs.meta.outputs.version }}
        run: |
          echo "amd64=$(sha256sum "dist/tsdproxy_${VERSION}_linux_amd64.tar.gz" | awk '{print $1}')" >> "$GITHUB_OUTPUT"
          echo "arm64=$(sha256sum "dist/tsdproxy_${VERSION}_linux_arm64.tar.gz" | awk '{print $1}')" >> "$GITHUB_OUTPUT"
          echo "armv6=$(sha256sum "dist/tsdproxy_${VERSION}_linux_armv6.tar.gz" | awk '{print $1}')" >> "$GITHUB_OUTPUT"
          echo "armv7=$(sha256sum "dist/tsdproxy_${VERSION}_linux_armv7.tar.gz" | awk '{print $1}')" >> "$GITHUB_OUTPUT"

      - name: Update AUR package
        env:
          VERSION: ${{ needs.meta.outputs.version }}
          SHA_AMD64: ${{ steps.sha.outputs.amd64 }}
          SHA_ARM64: ${{ steps.sha.outputs.arm64 }}
          SHA_ARMV6: ${{ steps.sha.outputs.armv6 }}
          SHA_ARMV7: ${{ steps.sha.outputs.armv7 }}
          AUR_KEY: ${{ secrets.AUR_KEY }}
        run: |
          set -euo pipefail

          mkdir -p ~/.ssh
          ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts
          echo "${AUR_KEY}" > ~/.ssh/aur_key
          chmod 600 ~/.ssh/aur_key
          export GIT_SSH_COMMAND="ssh -i ~/.ssh/aur_key"

          git clone "ssh://aur@aur.archlinux.org/tsdproxy-bin.git" aur-repo

          cat > aur-repo/PKGBUILD <<PKGBUILD
          pkgname=tsdproxy-bin
          pkgver=${VERSION}
          pkgrel=1
          pkgdesc="Tailscale Docker reverse proxy — expose containers with one label"
          arch=('x86_64' 'aarch64' 'armv6h' 'armv7h')
          url="https://github.com/almeidapaulopt/tsdproxy"
          license=('MIT')
          provides=('tsdproxy')
          conflicts=('tsdproxy')

          source_x86_64=("\${pkgname}-\${pkgver}-linux-amd64.tar.gz::\${url}/releases/download/v\${pkgver}/tsdproxy_\${pkgver}_linux_amd64.tar.gz")
          source_aarch64=("\${pkgname}-\${pkgver}-linux-arm64.tar.gz::\${url}/releases/download/v\${pkgver}/tsdproxy_\${pkgver}_linux_arm64.tar.gz")
          source_armv6h=("\${pkgname}-\${pkgver}-linux-armv6.tar.gz::\${url}/releases/download/v\${pkgver}/tsdproxy_\${pkgver}_linux_armv6.tar.gz")
          source_armv7h=("\${pkgname}-\${pkgver}-linux-armv7.tar.gz::\${url}/releases/download/v\${pkgver}/tsdproxy_\${pkgver}_linux_armv7.tar.gz")

          sha256sums_x86_64=('${SHA_AMD64}')
          sha256sums_aarch64=('${SHA_ARM64}')
          sha256sums_armv6h=('${SHA_ARMV6}')
          sha256sums_armv7h=('${SHA_ARMV7}')

          package() {
              install -Dm755 "tsdproxyd" "\${pkgdir}/usr/bin/tsdproxyd"
              install -Dm644 "LICENSE" "\${pkgdir}/usr/share/licenses/\${pkgname}/LICENSE"
          }
          PKGBUILD

          cd aur-repo
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          docker run --rm -v "$PWD:/build" archlinux:latest bash -c \
            "cd /build && pacman -Sy --noconfirm pacman-contrib && makepkg --printsrcinfo > .SRCINFO"
          git add PKGBUILD .SRCINFO
          git commit -m "tsdproxy-bin ${VERSION}"
          git push