release.yml

name: Release

# Release is triggered by pushing a vX.Y.Z tag.
#
# Tags are created from develop (the default branch).
# Single-branch flow: develop → tag → release.

on:
  push:
    tags:
      - 'v*'

env:
  CARGO_TERM_COLOR: always

jobs:

  build-release:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            artifact: titen-x86_64-unknown-linux-gnu
            ext: tar.gz
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            artifact: titen-aarch64-unknown-linux-gnu
            ext: tar.gz
          - os: macos-latest
            target: aarch64-apple-darwin
            artifact: titen-aarch64-apple-darwin
            ext: tar.gz

    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Build release binaries
        run: cargo build --release --target ${{ matrix.target }} -p titen-api -p titen-cli -p titen-mcp

      - name: Strip binaries (Unix)
        if: runner.os != 'Windows'
        run: |
          strip target/${{ matrix.target }}/release/titen-api || true
          strip target/${{ matrix.target }}/release/titen || true
          strip target/${{ matrix.target }}/release/titen-mcp || true

      - name: Extract version
        id: version
        shell: bash
        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT

      - name: Package
        run: |
          mkdir -p release
          cp target/${{ matrix.target }}/release/titen-api release/titen-api
          cp target/${{ matrix.target }}/release/titen release/titen
          cp target/${{ matrix.target }}/release/titen-mcp release/titen-mcp
          cd release
          tar czf "${{ matrix.artifact }}-${{ steps.version.outputs.VERSION }}.${{ matrix.ext }}" titen-api titen titen-mcp

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}-${{ steps.version.outputs.VERSION }}
          path: release/${{ matrix.artifact }}-${{ steps.version.outputs.VERSION }}.${{ matrix.ext }}

  release:
    name: Create GitHub Release
    needs: [build-release]
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: release-artifacts
          merge-multiple: true

      - name: Generate SHA256 checksums
        run: |
          cd release-artifacts
          sha256sum * > checksums-sha256.txt
          cat checksums-sha256.txt

      - name: Extract version from tag
        id: version
        run: |
          echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
          echo "SEMVER=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.version.outputs.VERSION }}
          name: v${{ steps.version.outputs.SEMVER }}
          files: |
            release-artifacts/*.tar.gz
            release-artifacts/checksums-sha256.txt
          body: |
            See [CHANGELOG.md](https://github.com/${{ github.repository }}/blob/${{ steps.version.outputs.VERSION }}/CHANGELOG.md) for full release notes.
          draft: false
          prerelease: ${{ contains(steps.version.outputs.VERSION, '-') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  docker-build:
    name: Docker ${{ matrix.target }} ${{ matrix.platform }}
    needs: [build-release]
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: api
            platform: linux/amd64
            arch: amd64
            runner: ubuntu-latest
          - target: api
            platform: linux/arm64
            arch: arm64
            runner: ubuntu-24.04-arm
          - target: web
            platform: linux/amd64
            arch: amd64
            runner: ubuntu-latest
          - target: web
            platform: linux/arm64
            arch: arm64
            runner: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v4

      - name: Extract version
        id: version
        run: |
          TAG_VERSION="${GITHUB_REF#refs/tags/}"
          SEMVER="${TAG_VERSION#v}"
          echo "TAG=$TAG_VERSION" >> $GITHUB_OUTPUT
          echo "SEMVER=$SEMVER" >> $GITHUB_OUTPUT

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/${{ github.repository }}
          flavor: |
            suffix=-${{ matrix.target }},onlatest=true
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          target: ${{ matrix.target }}
          platforms: ${{ matrix.platform }}
          outputs: type=image,name=ghcr.io/${{ github.repository }},push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=${{ matrix.target }}-${{ matrix.arch }}
          cache-to: type=gha,scope=${{ matrix.target }}-${{ matrix.arch }},mode=max

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digest-${{ matrix.target }}-${{ matrix.arch }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  docker-merge:
    name: Docker merge ${{ matrix.target }}
    needs: [docker-build]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        target: [api, web]
    steps:
      - uses: actions/checkout@v4

      - name: Extract version parts
        id: version
        run: |
          SEMVER="${GITHUB_REF#refs/tags/v}"
          MAJOR_MINOR=$(echo "$SEMVER" | cut -d. -f1-2)
          echo "SEMVER=$SEMVER" >> $GITHUB_OUTPUT
          echo "MAJOR_MINOR=$MAJOR_MINOR" >> $GITHUB_OUTPUT

      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digest-${{ matrix.target }}-*
          merge-multiple: true

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create manifest list and push
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create \
            -t ghcr.io/${{ github.repository }}:${{ steps.version.outputs.SEMVER }}-${{ matrix.target }} \
            -t ghcr.io/${{ github.repository }}:${{ steps.version.outputs.MAJOR_MINOR }}-${{ matrix.target }} \
            -t ghcr.io/${{ github.repository }}:latest-${{ matrix.target }} \
            $(printf 'ghcr.io/${{ github.repository }}@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ghcr.io/${{ github.repository }}:${{ steps.version.outputs.SEMVER }}-${{ matrix.target }}