release.yml

name: Build and publish SampSharp releases

on:
  workflow_dispatch:
    inputs:
      source_ref:
        description: Branch, tag, or commit to build
        required: true
        default: main
        type: string
      release_version:
        description: Optional immutable stable version (for example 1.0.0)
        required: false
        default: ""
        type: string
      push_dev:
        description: Update the mutable dev release
        required: true
        default: true
        type: boolean
      build_only:
        description: Build and retain artifacts without publishing
        required: true
        default: false
        type: boolean
      artifact_run_id:
        description: Reuse artifacts from a successful prior run; skips all native and managed builds
        required: false
        default: ""
        type: string
      native_consumers_green:
        description: Confirm consuming gamemodes passed validation before an immutable release
        required: true
        default: false
        type: boolean
      publish_nuget:
        description: Also publish stable managed packages to NuGet.org (requires NUGET_API_KEY)
        required: true
        default: false
        type: boolean
      resume_existing_release:
        description: Resume the exact existing tag/release without replacing immutable assets
        required: true
        default: false
        type: boolean

permissions:
  actions: read
  contents: read

concurrency:
  group: publish-sampsharp
  cancel-in-progress: false

jobs:
  validate:
    name: Validate release request
    runs-on: ubuntu-24.04
    outputs:
      revision: ${{ steps.source.outputs.revision }}
      dev_version: ${{ steps.source.outputs.dev_version }}
      publish_dev: ${{ steps.source.outputs.publish_dev }}
      resume_release: ${{ steps.source.outputs.resume_release }}
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.source_ref }}
          clean: true
          fetch-depth: 0

      - name: Pin source and validate inputs
        id: source
        env:
          RELEASE_VERSION: ${{ inputs.release_version }}
          PUSH_DEV: ${{ inputs.push_dev }}
          BUILD_ONLY: ${{ inputs.build_only }}
          ARTIFACT_RUN_ID: ${{ inputs.artifact_run_id }}
          CONSUMERS_GREEN: ${{ inputs.native_consumers_green }}
          RESUME_EXISTING: ${{ inputs.resume_existing_release }}
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          artifact_run_number=$GITHUB_RUN_NUMBER
          if [[ -n "$ARTIFACT_RUN_ID" ]]; then
            [[ "$ARTIFACT_RUN_ID" =~ ^[0-9]+$ ]]
            [[ "$BUILD_ONLY" != true ]]
            prior=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$ARTIFACT_RUN_ID")
            [[ "$(jq -r .conclusion <<<"$prior")" == success ]]
            [[ "$(jq -r .head_sha <<<"$prior")" == "$(git rev-parse HEAD)" ]]
            [[ "$(jq -r .path <<<"$prior")" == ".github/workflows/release.yml" ]]
            artifact_run_number=$(jq -r .run_number <<<"$prior")
          fi
          if [[ "$BUILD_ONLY" != true && -z "$RELEASE_VERSION" && "$PUSH_DEV" != true ]]; then
            echo "::error::Enable mutable dev, provide a release version, or select build-only."
            exit 1
          fi
          if [[ "$BUILD_ONLY" != true && -n "$RELEASE_VERSION" && "$CONSUMERS_GREEN" != true ]]; then
            echo "::error::Consuming gamemodes must pass native macOS validation before publication."
            exit 1
          fi
          if [[ -n "$RELEASE_VERSION" ]]; then
            [[ "$RELEASE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9][A-Za-z0-9.-]*)?$ ]]
            git check-ref-format "refs/tags/$RELEASE_VERSION"
            resume_release=false
            if remote_ref=$(git ls-remote --tags origin "refs/tags/$RELEASE_VERSION"); [[ -n "$remote_ref" ]]; then
              remote_revision=${remote_ref%%[[:space:]]*}
              current_revision=$(git rev-parse HEAD)
              if [[ "$RESUME_EXISTING" != true || "$remote_revision" != "$current_revision" ]] \
                || ! gh release view "$RELEASE_VERSION" >/dev/null 2>&1
              then
                echo "::error::Release $RELEASE_VERSION already exists; versions are immutable."
                exit 1
              fi
              resume_release=true
            fi
            echo "resume_release=$resume_release" >> "$GITHUB_OUTPUT"
          fi
          revision=$(git rev-parse HEAD)
          short_revision=$(git rev-parse --short=8 HEAD)
          echo "revision=$revision" >> "$GITHUB_OUTPUT"
          echo "dev_version=1.0.0-dev.${artifact_run_number}.${short_revision}" >> "$GITHUB_OUTPUT"
          echo "publish_dev=$PUSH_DEV" >> "$GITHUB_OUTPUT"

  native-build:
    needs: validate
    if: inputs.artifact_run_id == ''
    uses: ./.github/workflows/component-native.yml
    with:
      source_ref: ${{ needs.validate.outputs.revision }}

  libraries:
    name: Build, test, and pack managed libraries
    needs: validate
    if: inputs.artifact_run_id == ''
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ needs.validate.outputs.revision }}
          clean: true

      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x

      - name: Build and test
        run: |
          ./build.sh libraries
          ./build.sh libraries test --no-build

      - name: Pack dev libraries
        if: needs.validate.outputs.publish_dev == 'true'
        run: |
          ./build.sh libraries publish --version="${{ needs.validate.outputs.dev_version }}"
          mkdir -p dev-packages
          cp build/artifacts/packages/*.{nupkg,snupkg} dev-packages/

      - name: Upload dev libraries
        if: needs.validate.outputs.publish_dev == 'true'
        uses: actions/upload-artifact@v7
        with:
          name: sampsharp-nuget-dev
          path: dev-packages/
          if-no-files-found: error
          retention-days: 30

      - name: Pack versioned libraries
        if: inputs.release_version != ''
        run: |
          rm -rf build/artifacts/packages
          ./build.sh libraries publish --version="${{ inputs.release_version }}"
          mkdir -p version-packages
          cp build/artifacts/packages/*.{nupkg,snupkg} version-packages/

      - name: Upload versioned libraries
        if: inputs.release_version != ''
        uses: actions/upload-artifact@v7
        with:
          name: sampsharp-nuget-versioned
          path: version-packages/
          if-no-files-found: error
          retention-days: 30

  publish:
    name: Publish selected releases
    needs: [validate, native-build, libraries]
    if: >-
      always() && needs.validate.result == 'success' && !inputs.build_only &&
      (inputs.release_version != '' || needs.validate.outputs.publish_dev == 'true') &&
      (inputs.artifact_run_id != '' ||
       (needs.native-build.result == 'success' && needs.libraries.result == 'success'))
    runs-on: ubuntu-24.04
    environment: release-publish
    permissions:
      actions: read
      contents: write
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ needs.validate.outputs.revision }}
          clean: true
          fetch-depth: 0

      - uses: actions/setup-dotnet@v5
        if: inputs.release_version != ''
        with:
          dotnet-version: 10.0.x

      - uses: actions/download-artifact@v8
        with:
          pattern: sampsharp-component-*
          path: native-components
          run-id: ${{ inputs.artifact_run_id || github.run_id }}
          github-token: ${{ github.token }}

      - uses: actions/download-artifact@v8
        if: needs.validate.outputs.publish_dev == 'true'
        with:
          name: sampsharp-nuget-dev
          path: dev-packages
          run-id: ${{ inputs.artifact_run_id || github.run_id }}
          github-token: ${{ github.token }}

      - uses: actions/download-artifact@v8
        if: inputs.release_version != ''
        with:
          name: sampsharp-nuget-versioned
          path: version-packages
          run-id: ${{ inputs.artifact_run_id || github.run_id }}
          github-token: ${{ github.token }}

      - name: Package native components
        shell: bash
        run: |
          mkdir -p release-assets
          for component_dir in native-components/sampsharp-component-*; do
            artifact=${component_dir#native-components/sampsharp-component-}
            tar -czf "release-assets/SampSharp-component-${artifact}.tar.gz" -C "$component_dir" .
          done

      - name: Stage checksum-complete release assets
        shell: bash
        run: |
          if [[ "${{ needs.validate.outputs.publish_dev }}" == true ]]; then
            mkdir -p dev-release
            cp release-assets/* dev-packages/* dev-release/
            (cd dev-release && sha256sum * > SHA256SUMS)
          fi
          if [[ -n "${{ inputs.release_version }}" ]]; then
            bad_package=$(find version-packages -type f \( -name '*.nupkg' -o -name '*.snupkg' \) \
              ! -name "*.${{ inputs.release_version }}.nupkg" \
              ! -name "*.${{ inputs.release_version }}.snupkg" -print -quit)
            test -z "$bad_package" || { echo "Versioned artifact does not match requested version: $bad_package" >&2; exit 1; }
            mkdir -p version-release
            cp release-assets/* version-packages/* version-release/
            (cd version-release && sha256sum * > SHA256SUMS)
          fi

      - name: Publish selected releases
        env:
          GH_TOKEN: ${{ github.token }}
          PUSH_DEV: ${{ needs.validate.outputs.publish_dev }}
          RELEASE_VERSION: ${{ inputs.release_version }}
          REVISION: ${{ needs.validate.outputs.revision }}
          DEV_VERSION: ${{ needs.validate.outputs.dev_version }}
          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
          PUBLISH_NUGET: ${{ inputs.publish_nuget }}
          RESUME_RELEASE: ${{ needs.validate.outputs.resume_release }}
        shell: bash
        run: |
          if [[ -n "$RELEASE_VERSION" ]]; then
            if [[ "$RESUME_RELEASE" == true ]]; then
              expected=$(find version-release -maxdepth 1 -type f -printf '%f\n' | sort)
              actual=$(gh release view "$RELEASE_VERSION" --json assets --jq '.assets[].name' | sort)
              [[ "$actual" == "$expected" ]] || {
                echo "::error::Existing release assets differ; refusing to replace immutable files."
                exit 1
              }
            else
              git tag "$RELEASE_VERSION" "$REVISION"
              git push origin "refs/tags/$RELEASE_VERSION"
              prerelease=()
              [[ "$RELEASE_VERSION" != *-* ]] || prerelease+=(--prerelease)
              gh release create "$RELEASE_VERSION" version-release/* \
                --verify-tag \
                --generate-notes \
                --notes "Active-development downstream release; APIs and packaging may change before a future stability declaration." \
                "${prerelease[@]}" \
                --title "SampSharp $RELEASE_VERSION"
            fi
            if [[ "$PUBLISH_NUGET" == true ]]; then
              [[ -n "$NUGET_API_KEY" ]] || {
                echo "::error::publish_nuget requires the NUGET_API_KEY repository secret."
                exit 1
              }
              for package in version-packages/*.nupkg; do
                dotnet nuget push "$package" \
                  --source https://api.nuget.org/v3/index.json \
                  --api-key "$NUGET_API_KEY" \
                  --skip-duplicate
              done
            fi
          fi

          if [[ "$PUSH_DEV" == true ]]; then
            git tag --force dev "$REVISION"
            git push origin refs/tags/dev --force
            notes="Rolling native and managed build from \`$REVISION\`. NuGet version: \`$DEV_VERSION\`."
            if gh release view dev >/dev/null 2>&1; then
              gh release edit dev --title "SampSharp development build" --prerelease --notes "$notes"
            else
              gh release create dev --target "$REVISION" \
                --title "SampSharp development build" --prerelease --notes "$notes"
            fi
            gh release view dev --json assets --jq '.assets[].name' | while IFS= read -r asset; do
              [[ -z "$asset" ]] || gh release delete-asset dev "$asset" --yes
            done
            gh release upload dev dev-release/* --clobber
          fi