CreateRelease.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

name: Create a Release

on:
  workflow_dispatch:
  push:
    branches: [main]

permissions:
  contents: write
  issues: read

jobs:

  release-blocker-check:
    # see https://github.com/orgs/community/discussions/26286#discussioncomment-3251208 for why we need to check the ref
    if: ${{ contains(github.ref, 'refs/heads/release/') }} ||  ${{ github.ref=='refs/heads/main' }}
    uses: ./.github/workflows/ReleaseBlockerCheck.yml
    with:
      repository: ${{ github.repository }}
    secrets: inherit

  build-rust-ubuntu:
    # see https://github.com/orgs/community/discussions/26286#discussioncomment-3251208 for why we need to check the ref
    if: ${{ contains(github.ref, 'refs/heads/release/') }} ||  ${{ github.ref=='refs/heads/main' }}
    runs-on: [self-hosted, Linux, X64, "1ES.Pool=hld-kvm-amd", "JobId=build-rust-ubuntu-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}"]
    needs: [release-blocker-check]

    steps:
      - uses: actions/checkout@v6

      - uses: hyperlight-dev/ci-setup-workflow@v1.9.0
        with:
          rust-toolchain: "1.89"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Debug
        run: cargo build --verbose

      - name: Build Release
        run: cargo build --verbose --release

  build-rust-windows:
    # see https://github.com/orgs/community/discussions/26286#discussioncomment-3251208 for why we need to check the ref
    if: ${{ contains(github.ref, 'refs/heads/release/') }} ||  ${{ github.ref=='refs/heads/main' }}
    runs-on: windows-2025
    needs: [release-blocker-check]

    steps:
      - uses: actions/checkout@v6

      - uses: hyperlight-dev/ci-setup-workflow@v1.9.0
        with:
          rust-toolchain: "1.89"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Debug
        run: cargo build --verbose

      - name: Build Release
        run: cargo build --verbose --release

  build-guests:
    uses: ./.github/workflows/dep_build_guests.yml
    secrets: inherit
    needs: [release-blocker-check]
    with:
      config: release

  benchmarks:
    needs: [build-guests]
    strategy:
      fail-fast: true
      matrix:
        hypervisor: ['hyperv-ws2025', mshv3, kvm]
        cpu: [amd, intel]
    uses: ./.github/workflows/dep_benchmarks.yml
    secrets: inherit
    with:
      hypervisor: ${{ matrix.hypervisor }}
      cpu: ${{ matrix.cpu }}
    permissions:
      contents: read

  cargo-publish:
    needs: [publish]
    uses: ./.github/workflows/CargoPublish.yml
    with:
      dry_run: false
    secrets: inherit
    permissions:
      contents: read
      id-token: write

  publish:
    # see https://github.com/orgs/community/discussions/26286#discussioncomment-3251208 for why we need to check the ref
    if: ${{ contains(github.ref, 'refs/heads/release/') }} ||  ${{ github.ref=='refs/heads/main' }}
    runs-on: [self-hosted, Linux, X64, "1ES.Pool=hld-kvm-amd", "JobId=create-release-publish-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}"]
    needs:
      [
        build-rust-ubuntu,
        build-rust-windows,
        benchmarks,
      ]

    steps:
      - name: Set Debug Configuration
        if: ${{ github.ref=='refs/heads/main' }}
        run: echo "CONFIG=debug" >> $GITHUB_ENV

      - name: Set Release Configuration
        if: ${{ contains(github.ref, 'refs/heads/release/') }}
        run: echo "CONFIG=release" >> $GITHUB_ENV

      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          fetch-tags: true

      - uses: hyperlight-dev/ci-setup-workflow@v1.9.0
        with:
          rust-toolchain: "1.89"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      
      # HYPERLIGHT_VERSION does not include the v prefix
      - name: Set HYPERLIGHT_VERSION
        if: ${{ contains(github.ref, 'refs/heads/release/') }}
        id: set_hyperlight_version
        run: |
          git fetch --tags
          version=$(echo "${{ github.ref }}" | sed -E 's#refs/heads/release/v##')
          echo "HYPERLIGHT_VERSION=$version" >> $GITHUB_ENV
          echo "HYPERLIGHT_VERSION=$version"

      - name: Build and archive guest library + header files
        run: |
          just tar-headers
          just tar-static-lib

      - name: Download all benchmarks
        uses: actions/download-artifact@v8
        with:
          pattern: benchmarks_*

      - name: Archive benchmarks
        run: |
          # windows (server 2025)
          tar -zcvf benchmarks_Windows_hyperv-ws2025_amd.tar.gz benchmarks_Windows_hyperv-ws2025_amd
          tar -zcvf benchmarks_Windows_hyperv-ws2025_intel.tar.gz benchmarks_Windows_hyperv-ws2025_intel
          # kvm
          tar -zcvf benchmarks_Linux_kvm_amd.tar.gz benchmarks_Linux_kvm_amd
          tar -zcvf benchmarks_Linux_kvm_intel.tar.gz benchmarks_Linux_kvm_intel
          # mshv3
          tar -zcvf benchmarks_Linux_mshv3_amd.tar.gz benchmarks_Linux_mshv3_amd
          tar -zcvf benchmarks_Linux_mshv3_intel.tar.gz benchmarks_Linux_mshv3_intel

      - name: Extract release notes from changelog
        if: ${{ contains(github.ref, 'refs/heads/release/') }}
        run: just create-release-notes v${{ env.HYPERLIGHT_VERSION }} > RELEASE_NOTES.md
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Extract prerelease notes from changelog
        if: ${{ github.ref=='refs/heads/main' }}
        run: just create-release-notes dev-latest > RELEASE_NOTES.md
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Create release
        if: ${{ contains(github.ref, 'refs/heads/release/') }}
        run: |
            gh release create v${{ env.HYPERLIGHT_VERSION }} -t "Release v${{ env.HYPERLIGHT_VERSION }}" --notes-file RELEASE_NOTES.md \
            benchmarks_Windows_hyperv-ws2025_amd.tar.gz \
            benchmarks_Windows_hyperv-ws2025_intel.tar.gz \
            benchmarks_Linux_kvm_amd.tar.gz \
            benchmarks_Linux_kvm_intel.tar.gz \
            benchmarks_Linux_mshv3_amd.tar.gz \
            benchmarks_Linux_mshv3_intel.tar.gz \
            hyperlight-guest-c-api-linux.tar.gz \
            include.tar.gz
        env:
            GH_TOKEN: ${{ github.token }}
      
      - name: Create prerelease
        if: ${{ github.ref=='refs/heads/main' }}
        run: |
            gh release delete dev-latest -y --cleanup-tag || true
            gh release create dev-latest -t "Latest prerelease from main branch" --notes-file RELEASE_NOTES.md --latest=false -p \
            benchmarks_Windows_hyperv-ws2025_amd.tar.gz \
            benchmarks_Windows_hyperv-ws2025_intel.tar.gz \
            benchmarks_Linux_kvm_amd.tar.gz \
            benchmarks_Linux_kvm_intel.tar.gz \
            benchmarks_Linux_mshv3_amd.tar.gz \
            benchmarks_Linux_mshv3_intel.tar.gz \
            hyperlight-guest-c-api-linux.tar.gz \
            include.tar.gz
        env:
            GH_TOKEN: ${{ github.token }}