release.yml

name: Release

# Builds the application package in the published devkit image (the same
# environment as `scripts/devkit.sh run scripts/build-app.sh`), signs the
# checksums, and creates or updates a DRAFT GitHub release. Nothing is
# published: a maintainer reviews the draft, attaches the firmware images
# (scripts/release-firmware.sh) and clicks Publish, which creates the tag.
#
# Trigger: Actions → Release → Run workflow with the version (no tag needed),
# or push a vX.Y.Z tag. Either way the version must equal Cargo.toml's.
#
# Signing: the RELEASE_SIGNING_KEY secret holds an ASCII-armored private key
# without a passphrase (see docs/firmware-release.md). Without it the draft is
# created unsigned and the run prints a warning.

on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      version:
        description: Version without the leading v, e.g. 0.1.0
        required: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  ASSET: rustkvm_app-aarch64-unknown-linux-gnu

jobs:
  build:
    name: application package
    runs-on: ubuntu-latest
    timeout-minutes: 90
    container:
      image: ghcr.io/rust-kvm/rustkvm-devkit:nightly-2026-06-14
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@v7
      - name: Check version
        id: version
        env:
          INPUT_VERSION: ${{ inputs.version }}
        run: |
          if [ "$GITHUB_REF_TYPE" = tag ]; then want=${GITHUB_REF_NAME#v}; else want=$INPUT_VERSION; fi
          have=$(sed -n 's/^version *= *"\(.*\)"/\1/p' Cargo.toml | head -n1)
          test "$want" = "$have" || {
            echo "::error::requested version $want does not match workspace version $have"
            exit 1
          }
          echo "version=$have" >> "$GITHUB_OUTPUT"
      - name: Build
        run: scripts/build-app.sh
      - name: GPL source bundle
        run: OUT=out/app scripts/gpl-source-bundle.sh
      - uses: actions/upload-artifact@v7
        with:
          name: release-assets
          path: out/app/
          if-no-files-found: error

  draft:
    name: draft release
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      VERSION: ${{ needs.build.outputs.version }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/download-artifact@v8
        with:
          name: release-assets
          # Not "assets/": the checkout already has an assets/ directory.
          path: release-assets
      - name: Checksums and signature
        env:
          RELEASE_SIGNING_KEY: ${{ secrets.RELEASE_SIGNING_KEY }}
        run: |
          cd release-assets
          sha256sum -- * > SHA256SUMS
          if [ -n "$RELEASE_SIGNING_KEY" ]; then
            export GNUPGHOME="$RUNNER_TEMP/gnupg"
            mkdir -m 700 "$GNUPGHOME"
            printf '%s\n' "$RELEASE_SIGNING_KEY" | gpg --batch --import
            gpg --batch --armor --detach-sign --output SHA256SUMS.asc SHA256SUMS
            gpg --batch --verify SHA256SUMS.asc SHA256SUMS
            rm -rf "$GNUPGHOME"
          else
            echo "::warning::RELEASE_SIGNING_KEY is not set; the draft is unsigned"
          fi
          ls -l
      - name: Release notes
        id: notes
        run: |
          f="docs/release-notes/v$VERSION.md"
          if [ -f "$f" ]; then echo "path=$f" >> "$GITHUB_OUTPUT"; fi
      - uses: softprops/action-gh-release@v3
        with:
          draft: true
          tag_name: v${{ env.VERSION }}
          target_commitish: ${{ github.sha }}
          name: RustKVM v${{ env.VERSION }}
          body_path: ${{ steps.notes.outputs.path }}
          generate_release_notes: ${{ steps.notes.outputs.path == '' }}
          prerelease: ${{ contains(env.VERSION, '-') }}
          files: release-assets/*