firezone/.github/workflows/publish-release.yml

name: Publish release
run-name: Triggered by ${{ github.actor }}
on:
  workflow_dispatch:
    inputs:
      release_name:
        description: "Existing release name to publish"
        required: true
  release:
    types:
      - published

concurrency:
  group: "publish-production-${{ github.event_name }}-${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: false

jobs:
  publish-docker-images:
    if: >-
      ${{
        startsWith(inputs.release_name || github.event.release.name, 'gateway') ||
        startsWith(inputs.release_name || github.event.release.name, 'headless-client')
      }}
    runs-on: ubuntu-24.04
    permissions:
      # Needed to upload artifacts to a release
      packages: write
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Login to GitHub Container Registry
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set variables
        id: set-variables
        env:
          release_name: ${{ inputs.release_name || github.event.release.name }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -xe

          if [[ "$release_name" =~ gateway* ]]; then
            ARTIFACT=gateway
            VERSION=${release_name#gateway-}
          elif [[ "$release_name" =~ headless* ]]; then
            ARTIFACT=client
            VERSION=${release_name#headless-client-}
          else
            echo "Shouldn't have gotten here. Exiting."
            exit 1
          fi

          MAJOR_VERSION="${VERSION%%.*}"
          MAJOR_MINOR_VERSION="${VERSION%.*}"

          sha=$(gh release view "${release_name}" --json targetCommitish -q '.targetCommitish')

          # shellcheck disable=SC2129 # individual env exports are cleaner
          echo "artifact=$ARTIFACT" >> "$GITHUB_OUTPUT"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "major_version=$MAJOR_VERSION" >> "$GITHUB_OUTPUT"
          echo "major_minor_version=$MAJOR_MINOR_VERSION" >> "$GITHUB_OUTPUT"
          echo "sha=$sha" >> "$GITHUB_OUTPUT"
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Pull and push
        run: |
          set -xe

          SOURCE_TAG=ghcr.io/firezone/${{ steps.set-variables.outputs.artifact }}:${{ steps.set-variables.outputs.sha }}

          docker buildx imagetools create \
            -t ghcr.io/firezone/${{ steps.set-variables.outputs.artifact }}:${{ steps.set-variables.outputs.version }} \
            -t ghcr.io/firezone/${{ steps.set-variables.outputs.artifact }}:${{ steps.set-variables.outputs.version }}-${{ steps.set-variables.outputs.sha }} \
            -t ghcr.io/firezone/${{ steps.set-variables.outputs.artifact }}:${{ steps.set-variables.outputs.major_version }} \
            -t ghcr.io/firezone/${{ steps.set-variables.outputs.artifact }}:${{ steps.set-variables.outputs.major_minor_version }} \
            -t ghcr.io/firezone/${{ steps.set-variables.outputs.artifact }}:latest \
            $SOURCE_TAG

  publish-clients-to-winget:
    name: Publish ${{ matrix.identifier }} to winget
    runs-on: windows-latest
    strategy:
      matrix:
        include:
          - identifier: Firezone.Client.GUI
            tag_prefix: gui-client
          - identifier: Firezone.Client.Headless
            tag_prefix: headless-client
    steps:
      - id: get-version
        run: |
          version=${{ inputs.release_name || github.event.release.name }}
          version=${version#${{ matrix.tag_prefix }}-}
          echo "version=$version" >> "$GITHUB_OUTPUT"
        shell: bash
      - uses: vedantmgoyal9/winget-releaser@19e706d4c9121098010096f9c495a70a7518b30f # main
        if: ${{ startsWith((inputs.release_name || github.event.release.name), matrix.tag_prefix) }}
        with:
          identifier: ${{ matrix.identifier }}
          version: ${{ steps.get-version.outputs.version }}
          token: ${{ secrets.WINGET_TOKEN }}
          release-notes-url: https://firezone.dev/changelog
          release-tag: ${{ inputs.release_name || github.event.release.tag_name || github.ref_name }}

  create-publish-pr:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          # TODO: This hack is needed because the macOS client isn't tagged as `apple-client`.
          - tag_prefix: gateway
            component: gateway
          - tag_prefix: gui-client
            component: gui-client
          - tag_prefix: headless-client
            component: headless-client
          - tag_prefix: macos-client
            component: apple-client
          - tag_prefix: android-client
            component: android-client
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          token: ${{ secrets.RELEASE_PR_BOT_GITHUB_TOKEN }}
      - uses: ./.github/actions/setup-gpg
        id: setup-gpg
        if: ${{ startsWith(inputs.release_name || github.event.release.name, matrix.tag_prefix) }}
        with:
          key: ${{ secrets.RELEASE_PR_BOT_GPG_KEY }}
          email: github-bot@firezone.dev
      - if: ${{ startsWith(inputs.release_name || github.event.release.name, matrix.tag_prefix) }}
        run: |
          set -x

          # Extract version from release name
          version=${{ inputs.release_name || github.event.release.name }}
          version=${version#${{ matrix.tag_prefix }}-}

          # Configure git
          git config --local user.email "github-bot@firezone.dev"
          git config --local user.name "Firezone Bot"
          git config --local user.signingkey "${{ steps.setup-gpg.outputs.key_id }}"
          git config --local commit.gpgsign true

          # Create the PR
          scripts/create-publish-pr.sh ${{ matrix.component }} "$version"
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_PR_BOT_GITHUB_TOKEN }}
          RELEASE_PR_BOT_GPG_KEY: "${{ secrets.RELEASE_PR_BOT_GPG_KEY }}"

  create-sentry-release:
    name: create_${{ matrix.component }}_sentry_release
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        # TODO: This hack is needed because the macOS client isn't tagged as `apple-client`.
        include:
          - component: gateway
            projects: gateway
          - component: gui-client
            projects: gui-client
          - component: headless-client
            projects: headless-client
          - component: macos-client
            projects: apple-client
          - component: android-client
            projects: android-client
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0
      - uses: ./.github/actions/create-sentry-release
        if: ${{ startsWith(github.event.release.name, matrix.component) }}
        with:
          component: ${{ matrix.component }}
          projects: ${{ matrix.projects }}
          sentry_token: ${{ secrets.SENTRY_AUTH_TOKEN }}

  promote-deb-packages:
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        include:
          - tag_prefix: gateway
            deb_name: firezone-gateway
          - tag_prefix: gui-client
            deb_name: firezone-client-gui
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0

      - uses: ./.github/actions/setup-azure-cli

      - name: Copy preview archive to import-stable
        if: ${{ startsWith(inputs.release_name || github.event.release.name, matrix.tag_prefix) }}
        run: |
          set -e

          # Extract version from release name
          version=${{ inputs.release_name || github.event.release.name }}
          version=${version#${{ matrix.tag_prefix }}-}

          # Copy `.deb`s to `import-stable`
          az storage blob copy start-batch \
            --destination-container apt \
            --source-container apt \
            --pattern "pool-preview/${{ matrix.deb_name }}_$version*" \
            --destination-path import-stable \
            --connection-string "${{ secrets.AZURERM_ARTIFACTS_CONNECTION_STRING }}"

  regenerate-apt-index:
    needs: promote-deb-packages
    uses: ./.github/workflows/_apt.yml
    secrets: inherit