buckit/.github/workflows/release.yml

name: Release

on:
  push:
    tags:
      - 'RELEASE.*'

permissions:
  contents: write
  packages: write

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64
          - goos: windows
            goarch: amd64
            ext: .exe
          - goos: darwin
            goarch: arm64
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-go@v5
        with:
          go-version: 1.25.x

      - name: Build binary
        env:
          CGO_ENABLED: 0
          BUCKIT_RELEASE: RELEASE
        run: |
          # Extract timestamp from tag (e.g., RELEASE.2026-05-10T21-48-00Z.rc1 -> 2026-05-10T21-48-00Z)
          VERSION=$(echo "${{ github.ref_name }}" | sed 's/^RELEASE\.//' | sed 's/\.rc[0-9]*$//')
          # Pass RC suffix via BUCKIT_HOTFIX so it's embedded in the binary's ReleaseTag
          if [[ "${{ github.ref_name }}" =~ \.(rc[0-9]+)$ ]]; then
            export BUCKIT_HOTFIX="${BASH_REMATCH[1]}"
          fi
          LDFLAGS=$(go run buildscripts/gen-ldflags.go "${VERSION}")
          GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} go build -tags kqueue -trimpath --ldflags "${LDFLAGS}" -o buckit-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.ext }}.${{ github.ref_name }}

      - name: Generate checksum
        run: |
          sha256sum buckit-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.ext }}.${{ github.ref_name }} > buckit-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.ext }}.${{ github.ref_name }}.sha256sum

      - name: Sign with minisign
        env:
          MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
          MINISIGN_PASSWORD: ${{ secrets.MINISIGN_PASSWORD }}
        run: |
          go install aead.dev/minisign/cmd/minisign@v0.2.1
          echo "$MINISIGN_PRIVATE_KEY" | base64 -d > /tmp/minisign.key
          echo "$MINISIGN_PASSWORD" | minisign -Sm buckit-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.ext }}.${{ github.ref_name }} -s /tmp/minisign.key
          shred -u /tmp/minisign.key

      - name: Build packages
        if: matrix.goos == 'linux'
        env:
          NFPM_VERSION: 2.46.3
          PKG_ARCH: ${{ matrix.goarch }}
        run: |
          wget -q "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_amd64.deb"
          sudo apt install -y "./nfpm_${NFPM_VERSION}_amd64.deb"
          mkdir -p dist
          cp "buckit-linux-${PKG_ARCH}.${{ github.ref_name }}" dist/buckit
          # Convert RELEASE.2026-05-11T17-20-40Z[.rcN] -> 20260511172040.0.0
          PKG_VERSION=$(echo "${{ github.ref_name }}" | sed 's/^RELEASE\.//' | sed 's/\.rc[0-9]*$//' | tr -d '\-:TZ').0.0
          export PKG_VERSION
          for pkg in rpm deb apk; do
            nfpm package -f packaging/nfpm.yaml -p "$pkg" -t dist/
          done

      - name: Generate package checksums
        if: matrix.goos == 'linux'
        run: |
          for pkg in dist/*.deb dist/*.rpm dist/*.apk; do
            sha256sum "$pkg" > "${pkg}.sha256sum"
          done

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-${{ matrix.goos }}-${{ matrix.goarch }}
          path: |
            buckit-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.ext }}.${{ github.ref_name }}
            buckit-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.ext }}.${{ github.ref_name }}.sha256sum
            buckit-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.ext }}.${{ github.ref_name }}.minisig
            dist/*.deb
            dist/*.rpm
            dist/*.apk
            dist/*.deb.sha256sum
            dist/*.rpm.sha256sum
            dist/*.apk.sha256sum

  docker:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Prepare binaries for Docker
        run: |
          cp artifacts/buckit-linux-amd64.${{ github.ref_name }} buckit-amd64.${{ github.ref_name }}
          cp artifacts/buckit-linux-arm64.${{ github.ref_name }} buckit-arm64.${{ github.ref_name }}
          cp artifacts/buckit-linux-amd64.${{ github.ref_name }}.minisig buckit-amd64.${{ github.ref_name }}.minisig
          cp artifacts/buckit-linux-arm64.${{ github.ref_name }}.minisig buckit-arm64.${{ github.ref_name }}.minisig
          chmod +x buckit-*.${{ github.ref_name }}

      - uses: docker/setup-qemu-action@v3

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Determine tags
        id: tags
        run: |
          TAGS="ghcr.io/buckit-io/buckit:${{ github.ref_name }}"
          TAGS="${TAGS},docker.io/buckitio/buckit:${{ github.ref_name }}"
          if [[ "${{ github.ref_name }}" != *".rc"* ]]; then
            TAGS="${TAGS},ghcr.io/buckit-io/buckit:latest"
            TAGS="${TAGS},docker.io/buckitio/buckit:latest"
          fi
          echo "tags=${TAGS}" >> $GITHUB_OUTPUT

      - uses: docker/build-push-action@v5
        with:
          context: .
          file: Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.tags.outputs.tags }}
          build-args: |
            RELEASE=${{ github.ref_name }}

  publish:
    needs: [build, docker]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Prepare release assets
        run: |
          mkdir -p release-assets
          find artifacts -type f \
            ! -name 'buckit.rpm' \
            ! -name 'buckit.deb' \
            ! -name 'buckit.apk' \
            ! -name 'buckit.rpm.sha256sum' \
            ! -name 'buckit.deb.sha256sum' \
            ! -name 'buckit.apk.sha256sum' \
            -exec cp {} release-assets/ \;

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          prerelease: ${{ contains(github.ref_name, '.rc') }}
          files: release-assets/*

  update-gh-pages:
    if: "!contains(github.ref_name, '.rc')"
    needs: [build, publish]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Publish stable download files
        run: |
          tag="${{ github.ref_name }}"
          for arch in amd64 arm64; do
            dir="pages/server/buckit/release/linux-${arch}"
            mkdir -p "${dir}"
            cp "artifacts/buckit-linux-${arch}.${tag}" "${dir}/buckit"
            cp "artifacts/buckit-linux-${arch}.${tag}.minisig" "${dir}/buckit.minisig"
            sha=$(sha256sum "${dir}/buckit" | awk '{print $1}')
            echo "${sha}  buckit" > "${dir}/buckit.sha256sum"
          done
          cp artifacts/buckit_*_amd64.deb pages/server/buckit/release/linux-amd64/buckit.deb
          sha=$(sha256sum pages/server/buckit/release/linux-amd64/buckit.deb | awk '{print $1}')
          echo "${sha}  buckit.deb" > pages/server/buckit/release/linux-amd64/buckit.deb.sha256sum
          cp artifacts/buckit-*.x86_64.rpm pages/server/buckit/release/linux-amd64/buckit.rpm
          sha=$(sha256sum pages/server/buckit/release/linux-amd64/buckit.rpm | awk '{print $1}')
          echo "${sha}  buckit.rpm" > pages/server/buckit/release/linux-amd64/buckit.rpm.sha256sum
          cp artifacts/buckit_*_x86_64.apk pages/server/buckit/release/linux-amd64/buckit.apk
          sha=$(sha256sum pages/server/buckit/release/linux-amd64/buckit.apk | awk '{print $1}')
          echo "${sha}  buckit.apk" > pages/server/buckit/release/linux-amd64/buckit.apk.sha256sum
          cp artifacts/buckit_*_arm64.deb pages/server/buckit/release/linux-arm64/buckit.deb
          sha=$(sha256sum pages/server/buckit/release/linux-arm64/buckit.deb | awk '{print $1}')
          echo "${sha}  buckit.deb" > pages/server/buckit/release/linux-arm64/buckit.deb.sha256sum
          cp artifacts/buckit-*.aarch64.rpm pages/server/buckit/release/linux-arm64/buckit.rpm
          sha=$(sha256sum pages/server/buckit/release/linux-arm64/buckit.rpm | awk '{print $1}')
          echo "${sha}  buckit.rpm" > pages/server/buckit/release/linux-arm64/buckit.rpm.sha256sum
          cp artifacts/buckit_*_aarch64.apk pages/server/buckit/release/linux-arm64/buckit.apk
          sha=$(sha256sum pages/server/buckit/release/linux-arm64/buckit.apk | awk '{print $1}')
          echo "${sha}  buckit.apk" > pages/server/buckit/release/linux-arm64/buckit.apk.sha256sum
          # Windows
          dir="pages/server/buckit/release/windows-amd64"
          mkdir -p "${dir}"
          cp "artifacts/buckit-windows-amd64.exe.${tag}" "${dir}/buckit.exe"
          cp "artifacts/buckit-windows-amd64.exe.${tag}.minisig" "${dir}/buckit.exe.minisig"
          sha=$(sha256sum "${dir}/buckit.exe" | awk '{print $1}')
          echo "${sha}  buckit.exe" > "${dir}/buckit.sha256sum"
          # macOS
          dir="pages/server/buckit/release/darwin-arm64"
          mkdir -p "${dir}"
          cp "artifacts/buckit-darwin-arm64.${tag}" "${dir}/buckit"
          cp "artifacts/buckit-darwin-arm64.${tag}.minisig" "${dir}/buckit.minisig"
          sha=$(sha256sum "${dir}/buckit" | awk '{print $1}')
          echo "${sha}  buckit" > "${dir}/buckit.sha256sum"

      - name: Deploy to gh-pages
        uses: peaceiris/actions-gh-pages@v4
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: ./pages
          keep_files: true