build.release.yml

name: Release Build

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

on:
  release:
    types:
      - created
  workflow_dispatch:
    inputs:
      skip_nix_cache:
        description: 'Skip nix cache (genesis mode — full rebuild, no pre-seeding, no post-build publish)'
        type: boolean
        default: false

permissions:
  contents: write
  packages: write
  id-token: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  docker-build:
    name: Docker Build (${{ matrix.arch }})
    strategy:
      fail-fast: false
      # Serialize amd64 + arm64 to avoid stressing GHCR + cache.nixos.org
      # with two concurrent multi-GB push/pull pipelines from the same
      # repo. Doubles wall-clock; halves peak network pressure.
      max-parallel: 1
      matrix:
        include:
          - runner: blacksmith-4vcpu-ubuntu-2404
            arch: amd64
            platform: linux/amd64
          - runner: blacksmith-4vcpu-ubuntu-2404-arm
            arch: arm64
            platform: linux/arm64
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v5

      - name: Set lowercase image name
        run: echo "IMAGE_NAME_LC=${IMAGE_NAME,,}" >> $GITHUB_ENV

      - name: Set VERSION from tag
        run: echo "VERSION=${GITHUB_REF_NAME}" >> $GITHUB_ENV

      - name: Free disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
          sudo docker image prune -af
          df -h


      - name: Setup Blacksmith Builder
        uses: useblacksmith/setup-docker-builder@v1

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Install go-task
        uses: arduino/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      # task cell:build = swagger:generate → CGO_ENABLED=0 go build with ldflags
      # for GitCommit + BuildDate. Single source of truth shared with local dev.
      - name: Build devcell binary
        run: task cell:build

      # Hydrate /nix volume from the GHCR cache image populated by
      # build.dev.yml (same `nix-cache-${arch}-*` tag scheme). Release
      # builds reuse the same nixhome closure as dev builds, so the
      # cache is interchangeable.
      - name: Hydrate /nix volume from GHCR cache
        if: inputs.skip_nix_cache != true
        run: |
          HASH=${{ github.sha }}
          ./bin/devcell nix-store pull \
            --image "${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:nix-cache-${{ matrix.arch }}-${HASH}" \
            --fallback "${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:nix-cache-${{ matrix.arch }}-latest" \
            --volume "devcell-nix-store-${{ matrix.arch }}" \
          || echo "WARN: cache pull failed, continuing with empty volume"

      - name: Build thin image
        id: build
        env:
          DEVCELL_NIX_VOLUME: devcell-nix-store-${{ matrix.arch }}
        run: |
          TAG="${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:${{ env.VERSION }}-${{ matrix.arch }}"
          ./bin/devcell build --image "$TAG" --debug
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"

      - name: Push to GHCR
        run: docker push ${{ steps.build.outputs.tag }}

      # Publish the populated /nix volume back to the GHCR cache so
      # subsequent dev + release builds can reuse it. Runs even on
      # prior-step failure (partial volume is still useful).
      - name: Publish nix cache
        if: ${{ !cancelled() && inputs.skip_nix_cache != true }}
        timeout-minutes: 45
        env:
          ARCH: ${{ matrix.arch }}
          HASH: ${{ github.sha }}
          STAGE: release
        run: task nix-cache:publish

  docker-manifest:
    name: Docker Manifests
    needs: docker-build
    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - name: Set lowercase image name
        run: echo "IMAGE_NAME_LC=${IMAGE_NAME,,}" >> $GITHUB_ENV
        env:
          IMAGE_NAME: ${{ github.repository }}

      - name: Set VERSION from tag
        run: echo "VERSION=${GITHUB_REF_NAME}" >> $GITHUB_ENV

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create and push GHCR multi-arch manifests
        run: |
          R=${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}
          V=${{ env.VERSION }}
          docker buildx imagetools create \
            -t "${R}:${V}" \
            -t "${R}:latest" \
            "${R}:${V}-amd64" \
            "${R}:${V}-arm64"

      - name: Inspect manifests
        run: |
          R=${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}
          V=${{ env.VERSION }}
          echo "=== ${V} ==="
          docker buildx imagetools inspect "${R}:${V}"

  devcell-release:
    name: Devcell CLI Release Build
    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Set env
        run: |
          echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
          echo "SHORT_SHA=$(echo ${GITHUB_SHA} | cut -c1-8)" >> $GITHUB_ENV

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean -f .goreleaser.yaml
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
          SHORT_SHA: ${{ env.SHORT_SHA }}

      - name: Publish release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release edit "${{ env.RELEASE_VERSION }}" --draft=false --latest=false

  e2e-install:
    name: E2E Install (${{ matrix.arch }})
    needs: [devcell-release, docker-manifest]
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: blacksmith-4vcpu-ubuntu-2404
            arch: amd64
          - runner: blacksmith-4vcpu-ubuntu-2404-arm
            arch: arm64
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    steps:
      - name: Set version
        run: echo "VERSION=${GITHUB_REF_NAME}" >> $GITHUB_ENV

      - name: Download devcell binary
        run: |
          TARBALL="devcell-linux-${{ matrix.arch }}.tar.gz"
          URL="https://github.com/DimmKirr/devcell/releases/download/${VERSION}/${TARBALL}"
          echo "Downloading: ${URL}"
          curl -fsSL -o "${TARBALL}" "${URL}"
          tar xzf "${TARBALL}"
          chmod +x devcell
          sudo mv devcell /usr/local/bin/devcell
          sudo ln -sf devcell /usr/local/bin/cell

      - name: Verify devcell binary
        run: |
          devcell --help
          echo "--- devcell binary OK ---"

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Run devcell claude --version (full pipeline)
        run: |
          # Simulate a new user in a fresh project dir
          mkdir -p /tmp/e2e-project && cd /tmp/e2e-project

          # Flow: scaffold devcell.toml → pull base image → build user image → start container → print claude version
          OUTPUT=$(devcell --plain-text claude --version 2>&1) || true
          echo "$OUTPUT"

          # Assert devcell version string is present
          if echo "$OUTPUT" | grep -qE "devcell\s+v?[0-9]+\.[0-9]+\.[0-9]+"; then
            echo "--- PASS: devcell version found ---"
          else
            echo "--- FAIL: devcell version string not found in output ---"
            exit 1
          fi