release.yml

# A release (docs/PLAN.md §13.4): pushing an annotated tag `v<version>` on a commit on main
# builds the Windows and macOS releases (Setup.exe, the .pkg, and the Velopack update feed the
# installed app reads) and the Linux AppImage on GitHub's runners, runs every CI gate on that commit, and then waits for
# the owner to approve the `release` environment before anything is published to GitHub
# Releases.
#
# Security, beyond ci.yml's:
# - only the owner can create `v*` tags, and no tag can be moved or deleted (a repository
#   ruleset); the `release` environment admits only `v*` tags and needs the owner's approval
# - script/release-check refuses a tag that isn't an annotated `v<semver>` on main whose version
#   is the workspace's; like the approval, it guards against a mistaken tag, not a hostile one
#   (a tag runs its own commit's copy of this file), which the tag ruleset keeps out
# - the builds start clean (no cache), with Cargo.lock as it is (`--locked`), in jobs whose token
#   is read-only
# - the one job that can write (publish) checks out no code and runs nothing from the repository:
#   it takes the built files, writes their SHA256SUMS, attests their build provenance (Sigstore,
#   `gh attestation verify`) and creates the release; releases are immutable once published

name: Release

on:
  push:
    tags: ["v*"]

permissions: {}

concurrency:
  group: release
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"

jobs:
  verify:
    name: The tag
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
    outputs:
      version: ${{ steps.check.outputs.version }}
      prerelease: ${{ steps.check.outputs.prerelease }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: The tag as it is on GitHub (checkout can leave a lightweight copy)
        env:
          TAG: ${{ github.ref_name }}
        run: git fetch --force origin "refs/tags/$TAG:refs/tags/$TAG"
      - name: script/release-check
        id: check
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/notes"
          bash script/release-check "$TAG" --notes "$RUNNER_TEMP/notes/notes.md" | tee -a "$GITHUB_OUTPUT"
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: notes
          path: ${{ runner.temp }}/notes/notes.md
          if-no-files-found: error
          retention-days: 7

  ci:
    name: CI
    needs: verify
    # A job-level call resolves from this same commit before anything runs, so the runtime
    # checkout the self-repository form (`$/`) guards against can't reach it; actionlint doesn't
    # read `$/` yet.
    uses: ./.github/workflows/ci.yml # zizmor: ignore[self-repository]
    permissions:
      contents: read

  linux:
    name: Linux builds
    needs: verify
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    permissions:
      contents: read
    env:
      VERSION: ${{ needs.verify.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: The app's system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libxkbcommon-x11-dev libfontconfig-dev libwayland-dev libx11-xcb-dev squashfs-tools
      - name: rustup (act's runner image has none; GitHub's has)
        if: ${{ env.ACT == 'true' }}
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs |
            sh -s -- -y --profile minimal --default-toolchain none
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Rust toolchain (rust-toolchain.toml)
        run: rustup toolchain install && rustc --version
      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: 8.0.x
      - name: vpk 1.2.161 (the velopack crate's version)
        run: dotnet tool install -g vpk --version 1.2.161
      - name: The static Linux dv WSL distros run (script/build-linux)
        env:
          DV_CHANNEL: release
          DV_VERSION: ${{ env.VERSION }}
        run: bash script/build-linux --profile dist --out target/package/linux
      - name: The Linux app's AppImage (script/package --linux-app)
        run: |
          set -euo pipefail
          bash script/package --linux-app --version "$VERSION" --out target/package/linux-release
          mkdir -p target/package/upload
          cp target/package/linux-release/dv.AppImage target/package/upload/dv-linux-x86_64.AppImage
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-builds
          path: target/package/linux/dv-linux-x86_64
          if-no-files-found: error
          retention-days: 7
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-linux
          path: target/package/upload/
          if-no-files-found: error
          retention-days: 7

  windows:
    name: Windows release
    needs: [verify, linux]
    runs-on: windows-2025
    timeout-minutes: 120
    permissions:
      contents: read
    env:
      VERSION: ${{ needs.verify.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Rust toolchain (rust-toolchain.toml)
        shell: bash
        run: rustup toolchain install && rustc --version
      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: 8.0.x
      - name: vpk 1.2.161 (the velopack crate's version)
        run: dotnet tool install -g vpk --version 1.2.161
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: linux-builds
          path: target/package/linux
      - name: The latest release's full package, for the delta and the version check
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          mkdir -p target/package/out
          vpk download github --repoUrl "https://github.com/$GITHUB_REPOSITORY" --channel win \
            --outputDir target/package/out --token "$GH_TOKEN"
          # vpk says nothing went wrong when it finds no release, or when a download fails its
          # checksum; make sure the package is there whenever a release is.
          latest="$(gh release list --repo "$GITHUB_REPOSITORY" --exclude-drafts \
            --exclude-pre-releases --limit 1 --json tagName --jq '.[0].tagName // ""')"
          if [[ -n "$latest" ]] && ! compgen -G 'target/package/out/dv-*-full.nupkg' > /dev/null; then
            echo "vpk didn't download the full package of the latest release, $latest" >&2
            exit 1
          fi
          ls -l target/package/out
      - name: script/package
        shell: bash
        run: |
          set -euo pipefail
          bash script/package --version "$VERSION" --feed "https://github.com/$GITHUB_REPOSITORY" \
            --linux-dir target/package/linux --out target/package/out
      - name: This release's files (vpk's assets.win.json, the feed and RELEASES)
        shell: bash
        run: |
          set -euo pipefail
          out=target/package/out
          upload=target/package/upload
          mkdir -p "$upload"
          jq -r '.[].RelativeFileName' "$out/assets.win.json" | tr -d '\r' | while read -r name; do
            cp "$out/$name" "$upload/"
          done
          cp "$out/releases.win.json" "$out/assets.win.json" "$out/RELEASES" "$upload/"
          ls -l "$upload"
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-windows
          path: target/package/upload/
          if-no-files-found: error
          retention-days: 7

  macos:
    name: macOS release
    needs: verify
    runs-on: macos-15
    timeout-minutes: 120
    permissions:
      contents: read
    env:
      VERSION: ${{ needs.verify.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Rust toolchain (rust-toolchain.toml)
        run: rustup toolchain install && rustc --version
      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: 8.0.x
      - name: vpk 1.2.161 (the velopack crate's version)
        run: dotnet tool install -g vpk --version 1.2.161
      - name: The latest release's full macOS package, for the delta and the version check
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          mkdir -p target/package/out
          "$HOME/.dotnet/tools/vpk" download github --repoUrl "https://github.com/$GITHUB_REPOSITORY" \
            --channel osx --outputDir target/package/out --token "$GH_TOKEN"
          # As on Windows: vpk says nothing when it finds no release or a download fails, so
          # make sure the package is there whenever the latest release has a macOS feed.
          latest="$(gh release list --repo "$GITHUB_REPOSITORY" --exclude-drafts \
            --exclude-pre-releases --limit 1 --json tagName --jq '.[0].tagName // ""')"
          if [[ -n "$latest" ]] && gh release view "$latest" --repo "$GITHUB_REPOSITORY" \
              --json assets --jq '.assets[].name' | grep -qx releases.osx.json &&
            ! compgen -G 'target/package/out/dv-*-osx-full.nupkg' > /dev/null; then
            echo "vpk didn't download the full macOS package of the latest release, $latest" >&2
            exit 1
          fi
          ls -l target/package/out
      - name: script/package (on macOS, the macOS release)
        run: |
          set -euo pipefail
          bash script/package --version "$VERSION" --feed "https://github.com/$GITHUB_REPOSITORY" \
            --out target/package/out
      - name: This release's files (vpk's assets.osx.json and the feed)
        run: |
          set -euo pipefail
          out=target/package/out
          upload=target/package/upload
          mkdir -p "$upload"
          jq -r '.[].RelativeFileName' "$out/assets.osx.json" | while read -r name; do
            cp "$out/$name" "$upload/"
          done
          cp "$out/releases.osx.json" "$out/assets.osx.json" "$upload/"
          ls -l "$upload"
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-macos
          path: target/package/upload/
          if-no-files-found: error
          retention-days: 7

  publish:
    name: Publish (after the owner approves)
    needs: [verify, ci, linux, windows, macos]
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    environment:
      name: release
      url: ${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ github.ref_name }}
    permissions:
      contents: write # creates the release and uploads its files
      id-token: write # the OIDC token Sigstore signs the provenance with
      attestations: write # stores the provenance attestations
    env:
      VERSION: ${{ needs.verify.outputs.version }}
      PRERELEASE: ${{ needs.verify.outputs.prerelease }}
    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: release-windows
          path: dist
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: release-linux
          path: dist
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: release-macos
          path: dist
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: notes
          path: notes
      - name: SHA256SUMS
        run: |
          set -euo pipefail
          cd dist
          sha256sum -- * > "$RUNNER_TEMP/SHA256SUMS"
          mv "$RUNNER_TEMP/SHA256SUMS" SHA256SUMS
          cat SHA256SUMS
      - name: Build provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: dist/*
      - name: The release, a draft until every file is on it
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          kind=(--latest)
          if [[ "$PRERELEASE" == true ]]; then
            kind=(--prerelease --latest=false)
          fi
          # A re-run after a failure part way finds its own draft and finishes it.
          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json isDraft --jq .isDraft \
            2> /dev/null | grep -qx true; then
            gh release upload "$TAG" --repo "$GITHUB_REPOSITORY" --clobber dist/*
          else
            gh release create "$TAG" --repo "$GITHUB_REPOSITORY" --verify-tag --draft \
              --title "dv $VERSION" --notes-file notes/notes.md "${kind[@]}" dist/*
          fi
          gh release edit "$TAG" --repo "$GITHUB_REPOSITORY" --draft=false "${kind[@]}"