rustguac/.github/workflows/release.yml

name: Release

on:
  push:
    tags: ["v*"]

permissions:
  contents: write

env:
  GUACD_REPO: https://github.com/apache/guacamole-server.git
  GUACD_COMMIT: 6719b20d  # Pin: guacamole-server main @ 1.6.0-302 (uplifted 2026-07; -Werror verified clean, patch 006 upstreamed)

jobs:
  # ---------------------------------------------------------------------------
  # Build .deb package (Debian 13 / Trixie)
  # ---------------------------------------------------------------------------
  build-deb:
    name: Build .deb
    runs-on: ubuntu-latest
    container: debian:trixie

    steps:
      - uses: actions/checkout@v7

      - name: Install build dependencies
        run: |
          apt-get update
          apt-get install -y --no-install-recommends \
            curl ca-certificates gcc g++ pkg-config make git \
            autoconf automake libtool \
            libcairo2-dev libjpeg-dev libpng-dev libwebp-dev \
            libssh2-1-dev libssl-dev libvncserver-dev \
            libpango1.0-dev libpulse-dev \
            libavcodec-dev libavformat-dev libavutil-dev libswscale-dev \
            libcunit1-dev libtelnet-dev libwebsockets-dev \
            uuid-dev freerdp3-dev \
            dpkg-dev debhelper fakeroot build-essential

      - name: Install Rust
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: Clone and build guacd
        run: |
          git clone $GUACD_REPO /tmp/guacamole-server && git -C /tmp/guacamole-server checkout $GUACD_COMMIT
          for patch in patches/*.patch; do
            [ -f "$patch" ] || continue
            echo "Applying: $patch"
            git -C /tmp/guacamole-server apply "$GITHUB_WORKSPACE/$patch"
          done
          cd /tmp/guacamole-server && autoreconf -fi
          mkdir /tmp/guacd-build && cd /tmp/guacd-build
          /tmp/guacamole-server/configure \
            --prefix=/opt/rustguac \
            --with-ssh --with-vnc --with-rdp \
            --without-telnet --without-kubernetes \
            --disable-guacenc --disable-guaclog --disable-static
          make -j"$(nproc)"
          make DESTDIR="$GITHUB_WORKSPACE/debian/staging" install

      - name: Build rustguac
        run: $HOME/.cargo/bin/cargo build --release

      - name: Build .deb package
        run: |
          VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
          GIT_HASH=$(echo "$GITHUB_SHA" | cut -c1-7)
          DEB_VERSION="${VERSION}+g${GIT_HASH}"
          cat > debian/changelog <<EOF
          rustguac (${DEB_VERSION}) unstable; urgency=medium

            * Release ${GITHUB_REF_NAME}

           -- rustguac build <rustguac@localhost>  $(date -R)
          EOF
          dpkg-buildpackage -us -uc -b
          # dpkg-buildpackage puts .deb in parent dir; copy to workspace for upload
          cp ../*.deb .

      - name: Upload .deb artifact
        uses: actions/upload-artifact@v7
        with:
          name: deb-package
          path: "*.deb"
          if-no-files-found: error

      # Also build tarball from the same environment
      - name: Build release tarball
        run: |
          VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          TARBALL_DIR="/tmp/rustguac-${TAG_VERSION}-linux-amd64"
          mkdir -p "$TARBALL_DIR/bin" "$TARBALL_DIR/sbin" "$TARBALL_DIR/lib" "$TARBALL_DIR/static" "$TARBALL_DIR/systemd"

          cp target/release/rustguac "$TARBALL_DIR/bin/"
          cp debian/staging/opt/rustguac/sbin/guacd "$TARBALL_DIR/sbin/"
          cp -a debian/staging/opt/rustguac/lib/*.so* "$TARBALL_DIR/lib/"
          cp -r static/* "$TARBALL_DIR/static/"
          cp debian/config.toml.default "$TARBALL_DIR/config.toml.default"
          cp debian/rustguac.service "$TARBALL_DIR/systemd/"
          cp debian/rustguac-guacd.service "$TARBALL_DIR/systemd/"
          cp install-release.sh "$TARBALL_DIR/install.sh"
          chmod +x "$TARBALL_DIR/install.sh"
          [ -d scripts ] && cp -r scripts "$TARBALL_DIR/" || true

          cd /tmp
          tar czf "$GITHUB_WORKSPACE/rustguac-${TAG_VERSION}-linux-amd64.tar.gz" \
            "rustguac-${TAG_VERSION}-linux-amd64"

      - name: Upload tarball artifact
        uses: actions/upload-artifact@v7
        with:
          name: tarball
          path: rustguac-*-linux-amd64.tar.gz
          if-no-files-found: error


  # ---------------------------------------------------------------------------
  # Build .deb + tarball (ARM64 / Debian 13)
  # ---------------------------------------------------------------------------
  build-deb-arm64:
    name: Build .deb (arm64)
    runs-on: ubuntu-24.04-arm
    container: debian:trixie

    steps:
      - uses: actions/checkout@v7

      - name: Install build dependencies
        run: |
          apt-get update
          apt-get install -y --no-install-recommends \
            curl ca-certificates gcc g++ pkg-config make git \
            autoconf automake libtool \
            libcairo2-dev libjpeg-dev libpng-dev libwebp-dev \
            libssh2-1-dev libssl-dev libvncserver-dev \
            libpango1.0-dev libpulse-dev \
            libavcodec-dev libavformat-dev libavutil-dev libswscale-dev \
            libcunit1-dev libtelnet-dev libwebsockets-dev \
            uuid-dev freerdp3-dev \
            dpkg-dev debhelper fakeroot build-essential

      - name: Install Rust
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: Clone and build guacd
        run: |
          git clone $GUACD_REPO /tmp/guacamole-server && git -C /tmp/guacamole-server checkout $GUACD_COMMIT
          for patch in patches/*.patch; do
            [ -f "$patch" ] || continue
            echo "Applying: $patch"
            git -C /tmp/guacamole-server apply "$GITHUB_WORKSPACE/$patch"
          done
          cd /tmp/guacamole-server && autoreconf -fi
          mkdir /tmp/guacd-build && cd /tmp/guacd-build
          /tmp/guacamole-server/configure \
            --prefix=/opt/rustguac \
            --with-ssh --with-vnc --with-rdp \
            --without-telnet --without-kubernetes \
            --disable-guacenc --disable-guaclog --disable-static
          make -j"$(nproc)"
          make DESTDIR="$GITHUB_WORKSPACE/debian/staging" install

      - name: Build rustguac
        run: $HOME/.cargo/bin/cargo build --release

      - name: Build .deb package
        run: |
          VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
          GIT_HASH=$(echo "$GITHUB_SHA" | cut -c1-7)
          DEB_VERSION="${VERSION}+g${GIT_HASH}"
          cat > debian/changelog <<EOF
          rustguac (${DEB_VERSION}) unstable; urgency=medium

            * Release ${GITHUB_REF_NAME}

           -- rustguac build <rustguac@localhost>  $(date -R)
          EOF
          dpkg-buildpackage -us -uc -b
          cp ../*.deb .

      - name: Upload .deb artifact
        uses: actions/upload-artifact@v7
        with:
          name: deb-package-arm64
          path: "*.deb"
          if-no-files-found: error

      - name: Build release tarball
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          TARBALL_DIR="/tmp/rustguac-${TAG_VERSION}-linux-arm64"
          mkdir -p "$TARBALL_DIR/bin" "$TARBALL_DIR/sbin" "$TARBALL_DIR/lib" "$TARBALL_DIR/static" "$TARBALL_DIR/systemd"

          cp target/release/rustguac "$TARBALL_DIR/bin/"
          cp debian/staging/opt/rustguac/sbin/guacd "$TARBALL_DIR/sbin/"
          cp -a debian/staging/opt/rustguac/lib/*.so* "$TARBALL_DIR/lib/"
          cp -r static/* "$TARBALL_DIR/static/"
          cp debian/config.toml.default "$TARBALL_DIR/config.toml.default"
          cp debian/rustguac.service "$TARBALL_DIR/systemd/"
          cp debian/rustguac-guacd.service "$TARBALL_DIR/systemd/"
          cp install-release.sh "$TARBALL_DIR/install.sh"
          chmod +x "$TARBALL_DIR/install.sh"
          [ -d scripts ] && cp -r scripts "$TARBALL_DIR/" || true

          cd /tmp
          tar czf "$GITHUB_WORKSPACE/rustguac-${TAG_VERSION}-linux-arm64.tar.gz" \
            "rustguac-${TAG_VERSION}-linux-arm64"

      - name: Upload tarball artifact
        uses: actions/upload-artifact@v7
        with:
          name: tarball-arm64
          path: rustguac-*-linux-arm64.tar.gz
          if-no-files-found: error

  # ---------------------------------------------------------------------------
  # Build and push Docker images — per-arch on native runners, then
  # combined into a multi-arch manifest. Native ARM avoids the QEMU
  # slowdown that was making the previous combined build the long pole
  # of the pipeline.
  # ---------------------------------------------------------------------------
  build-docker-amd64:
    name: Build Docker (amd64)
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v7
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Log in to Docker Hub
        uses: docker/login-action@v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
      - name: Build and push amd64 image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64
          push: true
          tags: sol1/rustguac:${{ steps.version.outputs.version }}-amd64
          cache-from: type=gha,scope=docker-amd64
          cache-to: type=gha,mode=max,scope=docker-amd64

  build-docker-arm64:
    name: Build Docker (arm64)
    runs-on: ubuntu-24.04-arm
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v7
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Log in to Docker Hub
        uses: docker/login-action@v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
      - name: Build and push arm64 image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/arm64
          push: true
          tags: sol1/rustguac:${{ steps.version.outputs.version }}-arm64
          cache-from: type=gha,scope=docker-arm64
          cache-to: type=gha,mode=max,scope=docker-arm64

  # Combine the two per-arch images into the published multi-arch tags.
  # This is cheap (metadata only — no rebuild).
  build-docker-manifest:
    name: Publish Docker manifest
    needs: [build-docker-amd64, build-docker-arm64]
    runs-on: ubuntu-latest
    steps:
      - name: Log in to Docker Hub
        uses: docker/login-action@v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
      - name: Create and push multi-arch manifests
        run: |
          VER="${{ steps.version.outputs.version }}"
          docker buildx imagetools create \
            -t "sol1/rustguac:${VER}" \
            -t "sol1/rustguac:latest" \
            "sol1/rustguac:${VER}-amd64" \
            "sol1/rustguac:${VER}-arm64"

  # ---------------------------------------------------------------------------
  # Create GitHub Release
  # ---------------------------------------------------------------------------
  release:
    name: Create Release
    needs: [build-deb, build-deb-arm64, build-docker-manifest]
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7

      - name: Download deb artifact
        uses: actions/download-artifact@v8
        with:
          name: deb-package
          path: artifacts/deb-package

      - name: Download tarball artifact
        uses: actions/download-artifact@v8
        with:
          name: tarball
          path: artifacts/tarball

      - name: Download deb artifact (arm64)
        uses: actions/download-artifact@v8
        with:
          name: deb-package-arm64
          path: artifacts/deb-package-arm64

      - name: Download tarball artifact (arm64)
        uses: actions/download-artifact@v8
        with:
          name: tarball-arm64
          path: artifacts/tarball-arm64

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          generate_release_notes: true
          files: |
            artifacts/deb-package/*.deb
            artifacts/deb-package-arm64/*.deb
            artifacts/tarball/*.tar.gz
            artifacts/tarball-arm64/*.tar.gz