release.yml

name: Prepare server release
on:
  workflow_dispatch:
    inputs:
      source_commit:
        description: Reviewed full source commit SHA
        type: string
        required: true
      tag:
        description: New server release tag (vX.Y.Z)
        type: string
        required: true
permissions:
  contents: read
jobs:
  binaries:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.source_commit }}
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - env:
          SOURCE_COMMIT: ${{ inputs.source_commit }}
          TAG: ${{ inputs.tag }}
        run: |
          test "$(git rev-parse HEAD)" = "$SOURCE_COMMIT"
          printf '%s' "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'
          test "$TAG" = "v$(python3 -c 'import json; print(json.load(open("release.json"))["version"])')"
      - run: go vet ./... && go test ./...
      - run: go run ./cmd/prepare-web -manifest web-artifact/manifest.json -output web/dist
      - run: go test -tags=embed_web ./web
      - name: Cross-compile binaries and checksums
        run: |
          mkdir release
          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64; do
            os="${target%/*}"
            arch="${target#*/}"
            suffix=""; if [ "$os" = windows ]; then suffix=.exe; fi
            CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" go build -tags=embed_web -trimpath -ldflags="-s -w" -o "release/zennotes-server-$os-$arch$suffix" ./cmd/zennotes-server
          done
          cp LICENSE web-artifact/manifest.json release/
          cd release && sha256sum zennotes-server-* > SHA256SUMS
      - uses: actions/upload-artifact@v4
        with:
          name: server-release
          path: release/*
  draft:
    needs: binaries
    runs-on: ubuntu-latest
    environment: server-release
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: server-release
          path: release
      - env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          TAG: ${{ inputs.tag }}
          SOURCE_COMMIT: ${{ inputs.source_commit }}
        run: gh release create "$TAG" release/* --target "$SOURCE_COMMIT" --title "$TAG" --draft --notes "Self-hosted server with a pinned browser artifact. Complete candidate install and rollback checks before publication."