publish.yml

name: Publish

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  NUGET_OUTPUT: ./Artifacts/NuGet
  DOTNET8_VERSION: "8.0.410"
  DOTNET9_VERSION: "9.0.x"
  DOTNET_VERSION: "10.0.x"
  DOTNET_X64_CACHE: "dotnet-x64-cache-${{ github.sha }}"
  DOTNET_ARM64_CACHE: "dotnet-arm64-cache-${{ github.sha }}"
  WORKBENCH_CACHE: "web-cache-${{ github.sha }}"

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release'
        required: true
        default: '0.0.0'
        type: string
      release-notes:
        description: 'Release notes'
        required: true
        default: 'No release notes'
        type: string
      logLevel:
        description: 'Log level'
        required: true
        default: 'warning'
        type: choice
        options:
        - info
        - warning
        - debug
  pull_request:
    types: [closed]
    branches:
      - "**"
    paths:
      - "Source/**"


permissions:
  contents: write
  deployments: write
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.release.outputs.version }}
      publish: ${{ steps.release.outputs.should-publish }}
      prerelease: ${{ steps.release.outputs.prerelease }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Release
        id: release
        uses: cratis/release-action@v1
        with:
          version: ${{ github.event.inputs.version }}
          release-notes: ${{ github.event.inputs.release-notes }}

  generate-protos:
    if: needs.release.outputs.publish == 'true'
    needs: [release]
    uses: ./.github/workflows/generate-protos.yml

  coverage-statistics:
    if: needs.release.outputs.publish == 'true'
    runs-on: ubuntu-latest
    needs: [release]
    permissions:
      contents: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.PAT_WORKFLOWS }}

      - name: Restore cached coverage
        uses: actions/cache@v4
        with:
          path: ./coverage-reports
          key: coverage-cache-${{ github.sha }}
          fail-on-cache-miss: false

      - name: Collect coverage statistics for release
        run: |
          .github/scripts/collect-coverage.sh \
            "./coverage-reports" \
            "./Documentation/statistics/coverage-data.js" \
            "${{ needs.release.outputs.version }}" \
            "${{ github.sha }}" \
            "${{ github.event.head_commit.message }}"

      - name: Commit coverage statistics
        run: |
          git config --global user.name 'github-actions[bot]'
          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
          git add Documentation/statistics/coverage-data.js
          if git diff --staged --quiet; then
            echo "No coverage statistics changes to commit"
          else
            git commit -m "Update coverage statistics for release ${{ needs.release.outputs.version }} [skip ci]"
            git pull --rebase origin ${{ github.ref_name }}
            git push
          fi

  benchmark-results:
    if: needs.release.outputs.publish == 'true' && github.event.pull_request.merged == true
    runs-on: ubuntu-latest
    needs: [release]
    permissions:
      contents: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.PAT_WORKFLOWS }}

      - name: Restore cached benchmark results
        uses: actions/cache@v4
        with:
          path: Documentation/benchmarks/benchmark-data.json
          key: benchmark-cache-${{ github.sha }}
          fail-on-cache-miss: false

      - name: Check if benchmark data exists
        id: check-benchmark
        run: |
          if [ -f "Documentation/benchmarks/benchmark-data.json" ]; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
            echo "No cached benchmark data found for commit ${{ github.sha }}, skipping"
          fi

      - name: Commit benchmark results
        if: steps.check-benchmark.outputs.exists == 'true'
        run: |
          git config --global user.name 'github-actions[bot]'
          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
          git add Documentation/benchmarks/
          if git diff --staged --quiet; then
            echo "No benchmark result changes to commit"
          else
            git commit -m "Update benchmark results for release ${{ needs.release.outputs.version }} [skip ci]"
            git pull --rebase origin ${{ github.ref_name }}
            git push
          fi

  dotnet-x64:
    if: needs.release.outputs.publish == 'true'
    runs-on: ubuntu-latest
    needs: [release]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup .Net
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: |
            ${{ env.DOTNET8_VERSION }}
            ${{ env.DOTNET9_VERSION }}
            ${{ env.DOTNET_VERSION }}

      - uses: actions/cache@v3
        id: dotnet-x64-output
        with:
          path: ./Source/Kernel/Server/out/x64
          key: ${{ env.DOTNET_X64_CACHE }}

      - name: Build x64 Kernel - self contained, ready to run
        working-directory: ./Source/Kernel/Server
        run: |
          dotnet publish -c Release -f net10.0 -r linux-x64 -p:PublishReadyToRun=true -p:DisableProxyGenerator=true -p:Version=${{ needs.release.outputs.version }} -p:SourceRevisionId=${{ github.sha }} --self-contained -o out/x64

  dotnet-arm64:
    if: needs.release.outputs.publish == 'true'
    runs-on: ubuntu-24.04-arm
    needs: [release]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup .Net
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: |
            ${{ env.DOTNET8_VERSION }}
            ${{ env.DOTNET9_VERSION }}
            ${{ env.DOTNET_VERSION }}

      - uses: actions/cache@v3
        id: dotnet-arm64-output
        with:
          path: ./Source/Kernel/Server/out/arm64
          key: ${{ env.DOTNET_ARM64_CACHE }}

      - name: Build arm64 Kernel - self contained, ready to run
        working-directory: ./Source/Kernel/Server
        run: |
          dotnet publish -c Release -f net10.0 -r linux-arm64 -p:PublishReadyToRun=true -p:DisableProxyGenerator=true -p:Version=${{ needs.release.outputs.version }} -p:SourceRevisionId=${{ github.sha }} --self-contained -o out/arm64

  workbench:
    if: needs.release.outputs.publish == 'true'
    runs-on: ubuntu-latest
    needs: [release]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - uses: actions/cache@v3
        id: workbench-output
        with:
          path: ./Source/Workbench/wwwroot
          key: ${{ env.WORKBENCH_CACHE }}

      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version: 20.x
          registry-url: "https://registry.npmjs.org"

      - uses: actions/cache@v3
        id: yarn-cache
        with:
          path: |
            .yarn/cache
            **/node_modules
            **/.eslintcache
            **/yarn.lock
          key: ${{ runner.os }}-yarn-${{ hashFiles('**/package.json') }}

      - name: Yarn install
        working-directory: ./Source/Workbench
        run: yarn install

      - name: Build Workbench
        working-directory: ./Source/Workbench
        run: |
          yarn build
        env:
          CHRONICLE_VERSION: ${{ needs.release.outputs.version }}
          CHRONICLE_COMMIT_SHA: ${{ github.sha }}

  dotnet-pack-and-publish:
    if: needs.release.outputs.publish == 'true'
    runs-on: ubuntu-latest
    needs: [release, dotnet-x64, dotnet-arm64, workbench, dotnet-x64-development, dotnet-arm64-development]
    permissions:
      # Required for NuGet trusted publishing using OIDC tokens
      id-token: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - uses: actions/cache@v3
        id: workbench-output
        with:
          path: ./Source/Workbench/wwwroot
          key: ${{ env.WORKBENCH_CACHE }}

      - name: Setup .Net
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: |
            ${{ env.DOTNET8_VERSION }}
            ${{ env.DOTNET9_VERSION }}
            ${{ env.DOTNET_VERSION }}

      - name: Remove any existing artifacts
        run: rm -rf ${{ env.NUGET_OUTPUT }}

      - name: Build and Create NuGet packages
        run: |
          for project in $(find ./Source/Clients -name "*.csproj" ! -name "*.Specs.csproj"); do
            dotnet pack "$project" --configuration Release -o ${{ env.NUGET_OUTPUT }} -p:IsPackaging=true -p:Version=${{ needs.release.outputs.version }} -p:PackageVersion=${{ needs.release.outputs.version }} -p:SourceRevisionId=${{ github.sha }}
          done
          # Also pack the Contracts project from Kernel
          dotnet pack ./Source/Kernel/Contracts/Contracts.csproj --configuration Release -o ${{ env.NUGET_OUTPUT }} -p:IsPackaging=true -p:Version=${{ needs.release.outputs.version }} -p:PackageVersion=${{ needs.release.outputs.version }} -p:SourceRevisionId=${{ github.sha }}

      # Get a short-lived NuGet API key
      - name: NuGet login (OIDC → temp API key)
        uses: NuGet/login@v1
        id: login
        with:
          user: ${{ secrets.NUGET_USER }}

      - name: Push NuGet packages
        run: dotnet nuget push --skip-duplicate '${{ env.NUGET_OUTPUT }}/*.nupkg' --timeout 900 --api-key ${{steps.login.outputs.NUGET_API_KEY}} --source https://api.nuget.org/v3/index.json

  publish-typescript-client:
    if: needs.release.outputs.publish == 'true'
    needs: [release, generate-protos]
    uses: ./.github/workflows/publish-typescript-client.yml
    secrets: inherit
    with:
      version: ${{ needs.release.outputs.version }}
      protos-artifact: proto-files

  publish-kotlin-client:
    if: needs.release.outputs.publish == 'true'
    needs: [release, generate-protos]
    uses: ./.github/workflows/publish-kotlin-client.yml
    secrets: inherit
    with:
      version: ${{ needs.release.outputs.version }}
      protos-artifact: proto-files

  publish-elixir-client:
    if: needs.release.outputs.publish == 'true'
    needs: [release, generate-protos]
    uses: ./.github/workflows/publish-elixir-client.yml
    secrets: inherit
    with:
      version: ${{ needs.release.outputs.version }}
      protos-artifact: proto-files

  dotnet-x64-development:
    if: needs.release.outputs.publish == 'true'
    runs-on: ubuntu-latest
    needs: [release]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup .Net
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: |
            ${{ env.DOTNET8_VERSION }}
            ${{ env.DOTNET9_VERSION }}
            ${{ env.DOTNET_VERSION }}

      - uses: actions/cache@v3
        id: dotnet-x64-development-output
        with:
          path: ./Source/Kernel/Server/out/x64
          key: ${{ env.DOTNET_X64_CACHE }}-development

      - name: Build development x64 Kernel (DEVELOPMENT symbol)
        working-directory: ./Source/Kernel/Server
        run: |
          dotnet publish -c Debug -f net10.0 -r linux-x64 -p:DefineConstants=DEVELOPMENT -p:Version=${{ needs.release.outputs.version }} -p:SourceRevisionId=${{ github.sha }} -o out/x64

  dotnet-arm64-development:
    if: needs.release.outputs.publish == 'true'
    runs-on: ubuntu-24.04-arm
    needs: [release]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup .Net
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: |
            ${{ env.DOTNET8_VERSION }}
            ${{ env.DOTNET9_VERSION }}
            ${{ env.DOTNET_VERSION }}

      - uses: actions/cache@v3
        id: dotnet-arm64-development-output
        with:
          path: ./Source/Kernel/Server/out/arm64
          key: ${{ env.DOTNET_ARM64_CACHE }}-development

      - name: Build development arm64 Kernel (DEVELOPMENT symbol)
        working-directory: ./Source/Kernel/Server
        run: |
          dotnet publish -c Debug -f net10.0 -r linux-arm64 -p:DefineConstants=DEVELOPMENT -p:Version=${{ needs.release.outputs.version }} -p:SourceRevisionId=${{ github.sha }} -o out/arm64

  publish-docker-production:
    if: needs.release.outputs.publish == 'true'
    runs-on: ubuntu-latest
    needs: [release, dotnet-x64, dotnet-arm64, workbench, dotnet-x64-development, dotnet-arm64-development]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - uses: actions/cache@v3
        id: dotnet-x64-output
        with:
          path: ./Source/Kernel/Server/out/x64
          key: ${{ env.DOTNET_X64_CACHE }}
          fail-on-cache-miss: true

      - uses: actions/cache@v3
        id: dotnet-arm64-output
        with:
          path: ./Source/Kernel/Server/out/arm64
          key: ${{ env.DOTNET_ARM64_CACHE }}

      - uses: actions/cache@v3
        id: workbench-output
        with:
          path: ./Source/Workbench/wwwroot
          key: ${{ env.WORKBENCH_CACHE }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@master
        with:
          platforms: all

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@master

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Prepare Docker tags
        id: docker-tags
        run: |
          TAGS="cratis/chronicle:${{ needs.release.outputs.version }}"
          if [ "${{ needs.release.outputs.prerelease }}" != "true" ]; then
            TAGS="${TAGS}\ncratis/chronicle:latest"
          fi
          echo "tags<<EOF" >> $GITHUB_OUTPUT
          echo -e "$TAGS" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Build Production Docker Image
        uses: docker/build-push-action@v5
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: .
          file: ./Docker/Production/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.docker-tags.outputs.tags }}
          build-args: |
            VERSION=${{ needs.release.outputs.version }}

  publish-docker-workbench:
    if: needs.release.outputs.publish == 'true'
    runs-on: ubuntu-latest
    needs: [release, dotnet-x64, dotnet-arm64, workbench, dotnet-x64-development, dotnet-arm64-development]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - uses: actions/cache@v3
        id: workbench-output
        with:
          path: ./Source/Workbench/wwwroot
          key: ${{ env.WORKBENCH_CACHE }}
          fail-on-cache-miss: true

      - name: Set up QEMU
        uses: docker/setup-qemu-action@master
        with:
          platforms: all

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@master

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Prepare Docker tags
        id: docker-tags
        run: |
          TAGS="cratis/chronicle:${{ needs.release.outputs.version }}-workbench"
          if [ "${{ needs.release.outputs.prerelease }}" != "true" ]; then
            TAGS="${TAGS}\ncratis/chronicle:latest-workbench"
          fi
          echo "tags<<EOF" >> $GITHUB_OUTPUT
          echo -e "$TAGS" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Build Workbench Image
        uses: docker/build-push-action@v5
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: .
          file: ./Docker/Workbench/Dockerfile
          push: true
          tags: ${{ steps.docker-tags.outputs.tags }}
          build-args: |
            VERSION=${{ needs.release.outputs.version }}

  publish-docker-development:
    if: needs.release.outputs.publish == 'true'
    runs-on: ubuntu-latest
    needs: [release, dotnet-x64, dotnet-arm64, workbench, dotnet-x64-development, dotnet-arm64-development]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - uses: actions/cache@v3
        id: dotnet-x64-development-output
        with:
          path: ./Source/Kernel/Server/out/x64
          key: ${{ env.DOTNET_X64_CACHE }}-development
          fail-on-cache-miss: true

      - uses: actions/cache@v3
        id: dotnet-arm64-development-output
        with:
          path: ./Source/Kernel/Server/out/arm64
          key: ${{ env.DOTNET_ARM64_CACHE }}-development
          fail-on-cache-miss: true

      - uses: actions/cache@v3
        id: workbench-output
        with:
          path: ./Source/Workbench/wwwroot
          key: ${{ env.WORKBENCH_CACHE }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@master
        with:
          platforms: all

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@master

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Prepare Docker tags
        id: docker-tags
        run: |
          TAGS="cratis/chronicle:${{ needs.release.outputs.version }}-development"
          if [ "${{ needs.release.outputs.prerelease }}" != "true" ]; then
            TAGS="${TAGS}\ncratis/chronicle:latest-development"
          fi
          echo "tags<<EOF" >> $GITHUB_OUTPUT
          echo -e "$TAGS" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Build Development Docker Image
        uses: docker/build-push-action@v5
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: .
          file: ./Docker/Development/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.docker-tags.outputs.tags }}
          build-args: |
            VERSION=${{ needs.release.outputs.version }}

      - name: Trigger Documentation Build
        uses: peter-evans/repository-dispatch@v3
        with:
          token: ${{ secrets.PAT_DOCUMENTATION }}
          repository: cratis/documentation
          event-type: build-docs

      - name: Trigger Dependency Updates on Sample Repository
        uses: peter-evans/repository-dispatch@v3
        with:
          token: ${{ secrets.PAT_DOCUMENTATION }}
          repository: cratis/samples
          event-type: update-dependencies

  publish-docker-development-slim:
    if: needs.release.outputs.publish == 'true'
    runs-on: ubuntu-latest
    needs: [release, dotnet-x64, dotnet-arm64, workbench, dotnet-x64-development, dotnet-arm64-development]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - uses: actions/cache@v3
        id: dotnet-x64-development-output
        with:
          path: ./Source/Kernel/Server/out/x64
          key: ${{ env.DOTNET_X64_CACHE }}-development
          fail-on-cache-miss: true

      - uses: actions/cache@v3
        id: dotnet-arm64-development-output
        with:
          path: ./Source/Kernel/Server/out/arm64
          key: ${{ env.DOTNET_ARM64_CACHE }}-development
          fail-on-cache-miss: true

      - uses: actions/cache@v3
        id: workbench-output
        with:
          path: ./Source/Workbench/wwwroot
          key: ${{ env.WORKBENCH_CACHE }}
          fail-on-cache-miss: true

      - name: Set up QEMU
        uses: docker/setup-qemu-action@master
        with:
          platforms: all

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@master

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Prepare Docker tags
        id: docker-tags
        run: |
          TAGS="cratis/chronicle:${{ needs.release.outputs.version }}-development-slim"
          if [ "${{ needs.release.outputs.prerelease }}" != "true" ]; then
            TAGS="${TAGS}\ncratis/chronicle:latest-development-slim"
          fi
          echo "tags<<EOF" >> $GITHUB_OUTPUT
          echo -e "$TAGS" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Build Development Slim Docker Image
        uses: docker/build-push-action@v5
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: .
          file: ./Docker/DevelopmentSlim/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.docker-tags.outputs.tags }}
          build-args: |
            VERSION=${{ needs.release.outputs.version }}