release.yaml

name: Release
permissions:
  contents: write # in order to upload release assets
on:
  release:
    types:
      - published

jobs:
  metadata:
    runs-on: ubuntu-latest
    outputs:
      versionFlags: ${{ steps.flags.outputs.versionFlags }}
    steps:
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8

      - name: Set build version metadata flags
        id: flags
        run: |
          ldflags=(
            "-X github.com/pomerium/cli/version.Version=${{ github.event.release.tag_name }}"
            "-X github.com/pomerium/cli/version.GitCommit=$(git rev-parse --short HEAD)"
            "-X github.com/pomerium/cli/version.BuildMeta=$(date +%s)"
            "-X github.com/pomerium/cli/version.ProjectName=pomerium-cli"
            "-X github.com/pomerium/cli/version.ProjectURL=https://www.pomerium.com"
          )
          echo "versionFlags=${ldflags[*]}" >> $GITHUB_OUTPUT

  build-windows:
    runs-on: windows-latest
    needs: metadata
    outputs:
      checksums: ${{ steps.build.outputs.checksums }}
    steps:
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8

      - name: Set up Go
        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c
        with:
          go-version-file: .tool-versions

      - name: Build and archive
        id: build
        shell: bash
        run: |
          echo 'checksums<<EOF' >> $GITHUB_OUTPUT
          for arch in amd64 arm64; do
            mkdir -p bin/$arch
            GOARCH=$arch CGO_ENABLED=1 go build -o bin/$arch \
              -ldflags="-s -w ${{ needs.metadata.outputs.versionFlags }}" \
              ./cmd/pomerium-cli
            zipfile="pomerium-cli-windows-$arch.zip"
            powershell "Compress-Archive -Path bin\\$arch\\\* -DestinationPath $zipfile"
            hash=$(powershell "(Get-FileHash $zipfile -Algorithm SHA256).Hash.ToLower()")
            echo "$hash  $zipfile" >> $GITHUB_OUTPUT
          done
          echo EOF >> $GITHUB_OUTPUT

      - name: Upload to release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload "${{ github.event.release.tag_name }}" pomerium-cli-windows-*.zip

  goreleaser:
    permissions:
      contents: write
      issues: read
      pull-requests: read
    runs-on: ubuntu-latest
    needs: metadata
    env:
      DOCKER_CLI_EXPERIMENTAL: "enabled"
    outputs:
      tag: ${{ steps.tagName.outputs.tag }}
      checksums: ${{ steps.checksums.outputs.checksums }}
    steps:
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
        with:
          fetch-depth: 0 # GoReleaser needs commit history for changelog

      - name: Set up Go
        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c
        with:
          go-version-file: .tool-versions

      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f

      - uses: azure/docker-login@15c4aadf093404726ab2ff205b2cdd33fa6d054c
        with:
          username: ${{ secrets.DOCKERHUB_USER }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6.4.0
        with:
          version: v2.8.2
          args: release
        env:
          GITHUB_TOKEN: ${{ github.token }}
          VERSION_FLAGS: ${{ needs.metadata.outputs.versionFlags }}

      - name: Compute checksums
        id: checksums
        working-directory: ./dist
        run: |
          echo 'checksums<<EOF' >> $GITHUB_OUTPUT
          shasum -a 256 *.{tar.gz,deb,rpm} >> $GITHUB_OUTPUT
          echo EOF >> $GITHUB_OUTPUT

      - name: Get tag name
        id: tagName
        run: |
          TAG=$(git describe --tags --exact-match)
          echo "tag=${TAG}" >> $GITHUB_OUTPUT
          echo "version=${TAG#v}" >> $GITHUB_OUTPUT
          echo "pkgversion=$(echo  ${TAG#v} | tr '-' '~')" >> $GITHUB_OUTPUT

      - name: Install Cloudsmith CLI
        run: |
          pip3 install cloudsmith-cli

      - name: Publish to Cloudsmith
        env:
          CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
        working-directory: dist/
        run: |
          VERSION=${{ steps.tagName.outputs.pkgversion }}
          RPMS="pomerium-cli-${VERSION}-1.aarch64.rpm pomerium-cli-${VERSION}-1.x86_64.rpm pomerium-cli-${VERSION}-1.armv6hl.rpm pomerium-cli-${VERSION}-1.armv7hl.rpm"
          for pkg in $(echo $RPMS); do
            cloudsmith push rpm pomerium/pomerium/el/any-version $pkg
          done

          DEBS="pomerium-cli_${VERSION}-1_amd64.deb pomerium-cli_${VERSION}-1_arm64.deb pomerium-cli_${VERSION}-1_armhf.deb"
          for pkg in $(echo $DEBS); do
            cloudsmith push deb pomerium/pomerium/debian/any-version $pkg
          done

      - name: Find latest tag
        id: latestTag
        run: |
          LATEST_TAG=$(git tag | grep -vi 'rc' | sort --version-sort | tail -1)
          echo "tag=${LATEST_TAG}" >> $GITHUB_OUTPUT

      - name: Publish latest tag
        if: "steps.latestTag.outputs.tag == steps.tagName.outputs.tag"
        run: |
          docker manifest create -a pomerium/cli:latest pomerium/cli:amd64-${{ steps.tagName.outputs.tag }} pomerium/cli:arm64v8-${{ steps.tagName.outputs.tag }}
          docker manifest push pomerium/cli:latest

  finish:
    runs-on: ubuntu-latest
    needs: [build-windows, goreleaser, metadata]
    steps:
      - name: Upload checksums
        env:
          GH_REPO: ${{ github.repository }}
          GH_TOKEN: ${{ github.token }}
        run: |
          echo "${{ needs.build-windows.outputs.checksums }}" >> pomerium-cli_checksums.txt
          echo "${{ needs.goreleaser.outputs.checksums }}" >> pomerium-cli_checksums.txt
          gh release upload "${{ github.event.release.tag_name }}" pomerium-cli_checksums.txt

      - id: clean_version
        run: |
          echo "release=${VERSION#v}" >> $GITHUB_OUTPUT
        env:
          VERSION: "${{ github.event.release.tag_name }}"

      - name: trigger mac signed and notarized builds
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697
        with:
          repository: pomerium/mac-builds
          token: ${{ secrets.APPARITOR_GITHUB_TOKEN }}
          event-type: pomerium-cli-release
          client-payload: '{ "release": "${{ github.event.release.tag_name }}", "version_flags": "${{ needs.metadata.outputs.versionFlags }}", "push": "true" }'