release.yml

# Publishes a release to Hypha's opam repository: uploads the source
# archive to the GitHub release once, and pushes the opam files that name
# it on a release/ branch, which that repository's CI checks and lands.
# Run by hand with a tag to publish a release again; nothing published
# changes.
name: release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: The released tag to publish
        required: true

permissions:
  contents: write

jobs:
  opam:
    runs-on: ubuntu-24.04
    env:
      TAG: ${{ github.event.release.tag_name || inputs.tag }}
      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.event.release.tag_name || inputs.tag }}
          fetch-depth: 0
      # The archive is a release asset, since GitHub's generated archives
      # may change byte for byte; one already uploaded is never replaced.
      - name: Upload the source archive
        run: |
          repo=${GITHUB_REPOSITORY#*/}
          archive=$repo-$TAG.tar.gz
          mkdir -p "$RUNNER_TEMP/dist"
          if ! gh release download "$TAG" -p "$archive" -D "$RUNNER_TEMP/dist"; then
            git archive --format=tar --prefix="$repo-$TAG/" "$TAG" \
              | gzip -n -9 > "$RUNNER_TEMP/dist/$archive"
            gh release upload "$TAG" "$RUNNER_TEMP/dist/$archive"
          fi
      - name: Write the opam files
        run: |
          repo=${GITHUB_REPOSITORY#*/}
          archive=$repo-$TAG.tar.gz
          sha256=$(sha256sum "$RUNNER_TEMP/dist/$archive" | cut -d' ' -f1)
          sha512=$(sha512sum "$RUNNER_TEMP/dist/$archive" | cut -d' ' -f1)
          commit=$(git rev-parse "$TAG^{commit}")
          for f in *.opam; do
            name=${f%.opam}
            if grep -q '^pin-depends' "$f"; then
              echo "::error::$f has pin-depends, which opam ignores in a repository"
              exit 1
            fi
            dir=$RUNNER_TEMP/packages/$name/$name.$TAG
            mkdir -p "$dir"
            {
              grep -v '^# This file is generated by dune' "$f"
              echo "x-commit-hash: \"$commit\""
              echo "url {"
              echo "  src: \"https://github.com/$GITHUB_REPOSITORY/releases/download/$TAG/$archive\""
              echo "  checksum: ["
              echo "    \"sha256=$sha256\""
              echo "    \"sha512=$sha512\""
              echo "  ]"
              echo "}"
            } > "$dir/opam"
          done
      - name: Push them to Hypha's opam repository
        env:
          KEY: ${{ secrets.OPAM_REPOSITORY_KEY }}
        run: |
          repo=${GITHUB_REPOSITORY#*/}
          mkdir -p ~/.ssh
          printf '%s\n' "$KEY" > ~/.ssh/opam_repository
          chmod 600 ~/.ssh/opam_repository
          export GIT_SSH_COMMAND="ssh -i $HOME/.ssh/opam_repository -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
          git clone --depth 1 git@github.com:hyphatech/opam-repository.git "$RUNNER_TEMP/opam-repository"
          cd "$RUNNER_TEMP/opam-repository"
          for dir in "$RUNNER_TEMP"/packages/*/*; do
            target=packages/$(basename "$(dirname "$dir")")/$(basename "$dir")
            if [ -e "$target" ]; then
              if diff -r "$dir" "$target"; then continue; fi
              echo "::error::$target is published and differs; a published version never changes"
              exit 1
            fi
            mkdir -p "$(dirname "$target")"
            cp -R "$dir" "$target"
          done
          if [ -z "$(git status --porcelain)" ]; then
            echo "$repo $TAG is published already."
            exit 0
          fi
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git switch -c "release/$repo-$TAG"
          git add packages
          git commit -m "Publish $repo $TAG"
          git push origin "release/$repo-$TAG"