release.yml

name: release

on:
  push:
    tags: ["v[0-9]*"]
  pull_request:
    branches: ["main"]
  workflow_dispatch:
    inputs:
      force:
        description: "Force release even if one already exists"
        type: boolean
        default: false

concurrency:
  group: release-${{ github.ref_name }}

env:
  CARGO_TERM_COLOR: always
  DRY_RUN: ${{ startsWith(github.ref, 'refs/tags/v') && '0' || '1' }}
  RUST_BACKTRACE: 1
  GITHUB_API_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
  GITHUB_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
  GH_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}

jobs:
  build-tarball-linux:
    if: github.event_name != 'pull_request' || github.head_ref == 'release'
    name: build-tarball-${{matrix.name}}
    runs-on: namespace-profile-endev-linux-amd64-large
    timeout-minutes: 45
    env:
      MINIO_AWS_ACCESS_KEY_ID: ${{ secrets.MINIO_AWS_ACCESS_KEY_ID }}
      MINIO_AWS_SECRET_ACCESS_KEY: ${{ secrets.MINIO_AWS_SECRET_ACCESS_KEY }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux-x64
            target: x86_64-unknown-linux-gnu
          - name: linux-x64-musl
            target: x86_64-unknown-linux-musl
          - name: linux-arm64
            target: aarch64-unknown-linux-gnu
          - name: linux-arm64-musl
            target: aarch64-unknown-linux-musl
          - name: linux-armv7
            target: armv7-unknown-linux-gnueabi
          - name: linux-armv7-musl
            target: armv7-unknown-linux-musleabi
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - name: Install cross
        uses: taiki-e/install-action@51cd0b8c0499559d9a4d75c0f5c67bec3a894ec8 # v2
        with:
          tool: cross
      - name: build-tarball ${{matrix.target}}
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4
        with:
          timeout_minutes: 45
          max_attempts: 3
          command: scripts/build-tarball.sh ${{matrix.target}}
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: tarball-${{matrix.target}}
          path: |
            dist/mise-*.tar.xz
            dist/mise-*.tar.gz
            dist/mise-*.tar.zst
          if-no-files-found: error
  build-tarball-macos:
    if: github.event_name != 'pull_request' || github.head_ref == 'release'
    name: build-tarball-${{matrix.name}}
    runs-on: namespace-profile-endev-macos-arm64
    timeout-minutes: 90
    env:
      MINIO_AWS_ACCESS_KEY_ID: ${{ secrets.MINIO_AWS_ACCESS_KEY_ID }}
      MINIO_AWS_SECRET_ACCESS_KEY: ${{ secrets.MINIO_AWS_SECRET_ACCESS_KEY }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: macos-x64
            target: x86_64-apple-darwin
          - name: macos-arm64
            target: aarch64-apple-darwin
    steps:
      - uses: apple-actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466 # v7
        with:
          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTS_P12 }}
          p12-password: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTS_P12_PASS }}
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - name: Setup Rust target
        run: rustup target add ${{matrix.target}}
      - name: build-tarball ${{matrix.target}}
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4
        with:
          timeout_minutes: 90
          max_attempts: 3
          command: scripts/build-tarball.sh ${{matrix.target}}
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: tarball-${{matrix.target}}
          path: |
            dist/mise-*.tar.xz
            dist/mise-*.tar.gz
            dist/mise-*.tar.zst
          if-no-files-found: error
  build-tarball-windows:
    if: github.event_name != 'pull_request' || github.head_ref == 'release'
    name: build-tarball-windows-${{matrix.arch}}
    runs-on: windows-latest
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: arm64
            target: aarch64-pc-windows-msvc
          - arch: x64
            target: x86_64-pc-windows-msvc
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - run: rustup target add ${{matrix.target}}
      - run: scripts/build-tarball.ps1 ${{matrix.target}}
        env:
          OS: windows
          ARCH: ${{matrix.arch}}
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: tarball-${{matrix.target}}
          path: dist/*.zip
          if-no-files-found: error
  e2e-linux:
    if: github.event_name != 'pull_request' || github.head_ref == 'release'
    name: e2e-linux-${{matrix.tranche}}
    needs: [build-tarball-linux]
    runs-on: ubuntu-latest
    #container: ghcr.io/jdx/mise:github-actions
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        tranche: [0, 1, 2, 3, 4, 5, 6, 7]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - name: Install zsh/fish/direnv/fd
        run: sudo apt-get update; sudo apt-get install zsh fish direnv fd-find liblzma-dev libbz2-dev
      - name: Install fd-find
        run: |
          mkdir -p "$HOME/.local/bin"
          ln -s "$(which fdfind)" "$HOME/.local/bin/fd"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: tarball-x86_64-unknown-linux-gnu
          path: dist
      - uses: taiki-e/install-action@51cd0b8c0499559d9a4d75c0f5c67bec3a894ec8 # v2
        with:
          tool: usage-cli
      - run: tar -C "$HOME" -xvf "dist/mise-$(./scripts/get-version.sh)-linux-x64.tar.zst"
      - run: echo "$HOME/mise/bin" >> "$GITHUB_PATH"
      - run: mise -v
      - run: mise x wait-for-gh-rate-limit -- wait-for-gh-rate-limit
      - run: mise i
      - name: Run e2e tests
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4
        env:
          TEST_TRANCHE: ${{matrix.tranche}}
          TEST_TRANCHE_COUNT: 8
          TEST_ALL: 1
        with:
          timeout_minutes: 20
          max_attempts: 3
          command: ./e2e/run_all_tests
  rpm:
    if: github.event_name != 'pull_request' || github.head_ref == 'release'
    runs-on: ubuntu-latest
    needs: [build-tarball-linux]
    timeout-minutes: 10
    container: ghcr.io/jdx/mise:rpm@sha256:4d4b300e61d9896e1846f1a55ada6937f65943f3341979dda5bc0cc019e49046
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
        with:
          gpg_private_key: ${{ secrets.MISE_GPG_KEY }}
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: tarball-x86_64-unknown-linux-gnu
          path: dist
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: tarball-aarch64-unknown-linux-gnu
          path: dist
      - run: scripts/build-rpm.sh
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: rpm
          path: dist/rpmrepo
          if-no-files-found: error
  deb:
    if: github.event_name != 'pull_request' || github.head_ref == 'release'
    runs-on: ubuntu-latest
    needs: [build-tarball-linux]
    container: ghcr.io/jdx/mise:deb@sha256:7f8a538db9e31f782f5e91b458f31ac9f96b55ddd6659789e07f3072cba44dac
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
        with:
          gpg_private_key: ${{ secrets.MISE_GPG_KEY }}
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: tarball-x86_64-unknown-linux-gnu
          path: dist
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: tarball-aarch64-unknown-linux-gnu
          path: dist
      - run: scripts/build-deb.sh
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: deb
          path: dist/deb
          if-no-files-found: error
  release:
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: write
    needs:
      - rpm
      - deb
      - e2e-linux
      - build-tarball-linux
      - build-tarball-macos
      - build-tarball-windows
    if: ${{ !cancelled() && !failure() }}
    steps:
      - name: Verify all build targets succeeded
        if: github.event_name != 'pull_request' || github.head_ref == 'release'
        run: |
          failed=""
          for result in \
            "${{ needs.build-tarball-linux.result }}" \
            "${{ needs.build-tarball-macos.result }}" \
            "${{ needs.build-tarball-windows.result }}" \
            "${{ needs.e2e-linux.result }}" \
            "${{ needs.rpm.result }}" \
            "${{ needs.deb.result }}"; do
            if [ "$result" != "success" ]; then
              failed="true"
            fi
          done
          if [ -n "$failed" ]; then
            echo "::error::One or more required jobs did not succeed:"
            echo "  build-tarball-linux: ${{ needs.build-tarball-linux.result }}"
            echo "  build-tarball-macos: ${{ needs.build-tarball-macos.result }}"
            echo "  build-tarball-windows: ${{ needs.build-tarball-windows.result }}"
            echo "  e2e-linux: ${{ needs.e2e-linux.result }}"
            echo "  rpm: ${{ needs.rpm.result }}"
            echo "  deb: ${{ needs.deb.result }}"
            exit 1
          fi
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0
      - name: Check for existing release
        id: check-release
        if: startsWith(github.ref, 'refs/tags/v') && inputs.force != true
        run: |
          VERSION="$(./scripts/get-version.sh)"
          if gh api "repos/${{ github.repository }}/releases/tags/$VERSION" --jq '.draft' 2>/dev/null; then
            DRAFT="$(gh api "repos/${{ github.repository }}/releases/tags/$VERSION" --jq '.draft')"
            if [[ "$DRAFT" == "false" ]]; then
              echo "::warning::Release $VERSION already exists and is published — skipping publish steps"
              echo "exists=true" >> "$GITHUB_OUTPUT"
            else
              echo "Draft release $VERSION exists — will continue publishing"
              echo "exists=false" >> "$GITHUB_OUTPUT"
            fi
          else
            echo "No release found for $VERSION"
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi
      - name: Skip release for non-release branch PRs
        if: github.event_name == 'pull_request' && github.head_ref != 'release'
        run: |
          echo "Skipping release steps for PR from non-release branch"
          echo "All release operations will be skipped"
      - uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
        if: github.event_name != 'pull_request' || github.head_ref == 'release'
        with:
          gpg_private_key: ${{ secrets.MISE_GPG_KEY }}
          git_user_signingkey: true
          git_commit_gpgsign: true
      - run: ./scripts/setup-zipsign.sh
        if: github.event_name != 'pull_request' || github.head_ref == 'release'
        env:
          ZIPSIGN: ${{ secrets.ZIPSIGN }}
      - name: Install fd-find
        if: github.event_name != 'pull_request' || github.head_ref == 'release'
        run: |
          sudo apt-get update
          sudo apt-get install fd-find minisign
          mkdir -p "$HOME/.local/bin"
          ln -s "$(which fdfind)" "$HOME/.local/bin/fd"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        if: github.event_name != 'pull_request' || github.head_ref == 'release'
        with: { path: artifacts }
      - run: ls -R artifacts
        if: github.event_name != 'pull_request' || github.head_ref == 'release'
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        if: github.event_name != 'pull_request' || github.head_ref == 'release'
        with:
          path: artifacts
          pattern: |
            mise-v*.tar.gz
            mise-v*.tar.xz
            mise-v*.tar.zst
            mise-v*.zip
          merge-multiple: true
      - run: echo "${{ secrets.MINISIGN_KEY }}" >minisign.key
        if: github.event_name != 'pull_request' || github.head_ref == 'release'
      - run: ls -R artifacts
        if: github.event_name != 'pull_request' || github.head_ref == 'release'
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        if: github.event_name != 'pull_request' || github.head_ref == 'release'
        with:
          name: tarball-x86_64-unknown-linux-gnu
          path: dist
      - run: tar -C "$HOME" -xvf "dist/mise-$(./scripts/get-version.sh)-linux-x64.tar.zst"
        if: github.event_name != 'pull_request' || github.head_ref == 'release'
      - run: echo "$HOME/mise/bin" >> "$GITHUB_PATH"
        if: github.event_name != 'pull_request' || github.head_ref == 'release'
      - run: which mise && mise -v && mise i
        if: github.event_name != 'pull_request' || github.head_ref == 'release'
      - run: mise x -- scripts/release.sh
        if: github.event_name != 'pull_request' || github.head_ref == 'release'
      - name: Generate release notes
        if: startsWith(github.ref, 'refs/tags/v') && steps.check-release.outputs.exists != 'true'
        run: |
          VERSION="$(./scripts/get-version.sh)"
          if mise x -- communique generate "$VERSION" -o /tmp/release-notes.txt; then
            TITLE="$(head -1 /tmp/release-notes.txt | sed 's/^#* //' | sed "s/^$VERSION: //")"
            echo "RELEASE_TITLE=$VERSION: $TITLE" >> "$GITHUB_ENV"
            # Remove the title line (and any blank line after it) from the notes body
            tail -n +2 /tmp/release-notes.txt | sed '/./,$!d' > /tmp/release-notes-body.txt
            mv /tmp/release-notes-body.txt /tmp/release-notes.txt
          else
            echo "::warning::communique failed, falling back to git-cliff changelog"
            mise x -- git cliff --strip all --latest > /tmp/release-notes.txt 2>/dev/null || echo "Release $VERSION" > /tmp/release-notes.txt
            echo "RELEASE_TITLE=$VERSION" >> "$GITHUB_ENV"
          fi
          # Strip any pre-existing sponsor section from the generated notes
          # (communique has at times included its own) and trim trailing blanks,
          # so the heredoc below always produces exactly one canonical block.
          awk '
            /^## (💚 )?Sponsor mise[[:space:]]*$/ { exit }
            /^[[:space:]]*$/ { blanks++; next }
            { while (blanks-- > 0) print ""; blanks = 0; print }
          ' /tmp/release-notes.txt > /tmp/release-notes-trimmed.txt
          mv /tmp/release-notes-trimmed.txt /tmp/release-notes.txt
          cat >> /tmp/release-notes.txt <<'EOF'

          ## 💚 Sponsor mise

          mise is maintained by [@jdx](https://github.com/jdx), an open source developer for [**entire.io**](https://entire.io), the title sponsor of the [jdx.dev](https://jdx.dev) open source tools. Development is funded by sponsors.

          If mise saves you or your team time, please consider sponsoring at [jdx.dev](https://jdx.dev/sponsors.html). Individual and company sponsorships keep mise fast, free, and independent.
          EOF
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
      - name: Create Draft GitHub Release
        if: startsWith(github.ref, 'refs/tags/v') && steps.check-release.outputs.exists != 'true'
        run: |
          VERSION="$(./scripts/get-version.sh)"
          gh release create "$VERSION" \
            --title "$RELEASE_TITLE" \
            --notes-file /tmp/release-notes.txt \
            --verify-tag \
            --draft \
            "releases/$VERSION"/*
        env:
          GH_TOKEN: ${{ secrets.MISE_GH_TOKEN }}
      - name: Publish Release Assets to CDN
        if: startsWith(github.ref, 'refs/tags/v') && steps.check-release.outputs.exists != 'true'
        run: mise x -- scripts/publish-release.sh
        env:
          CLOUDFLARE_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_ACCESS_KEY_ID }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN }}
          CLOUDFLARE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_SECRET_ACCESS_KEY }}
      - name: Publish GitHub Release
        if: startsWith(github.ref, 'refs/tags/v') && steps.check-release.outputs.exists != 'true'
        run: |
          VERSION="$(./scripts/get-version.sh)"
          gh release edit "$VERSION" --draft=false
        env:
          GH_TOKEN: ${{ secrets.MISE_GH_TOKEN }}