release.yml

name: Release

on:
  pull_request:
    paths:
      - .github/workflows/release.yml
      - justfile
  push:
    tags:
      - 'release/*'

permissions:
  contents: write

env:
  CARGO_INCREMENTAL: 0
  CARGO_NET_RETRY: 10
  CHECKSEC_VERSION: 2.5.0
  RUSTFLAGS: "-D warnings -A deprecated"
  RUSTUP_MAX_RETRIES: 10

jobs:
  meta:
    timeout-minutes: 5
    runs-on: ubuntu-latest
    steps:
      - id: meta
        shell: bash
        run: |
          shopt -s extglob
          ref="${{ github.ref }}"
          if [[ "$ref" == refs/tags/release/* ]]; then
            ver="${ref##refs/tags/release/}"
            if [[ "$ver" != v+([0-9]).+([0-9]).+([0-9])?(-+([a-z0-9-])) ]]; then
              echo "Invalid version: $ver" >&2
              exit 1
            fi
            echo "publish=true" >> "$GITHUB_OUTPUT"
            echo "version=$ver" >> "$GITHUB_OUTPUT"
          else
            sha="${{ github.sha }}"
            echo version="test-${sha:0:7}" >> "$GITHUB_OUTPUT"
          fi
    outputs:
      publish: ${{ steps.meta.outputs.publish }}
      version: ${{ steps.meta.outputs.version }}

  package:
    needs: [meta]
    strategy:
      matrix:
        arch: [amd64, arm64, arm]
    name: Package (${{ matrix.arch }})
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      ARCH: ${{ matrix.arch }}
      PACKAGE_VERSION: ${{ needs.meta.outputs.version }}
      CARGO_RELEASE: "1"
      DEBIAN_FRONTEND: noninteractive
    container: docker://ghcr.io/linkerd/dev:v43-rust-musl
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
      - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
      - run: just release
      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32
        with:
          name: ${{ matrix.arch }}-artifacts
          path: release/*

  publish:
    needs: [meta, package]
    name: GitHub Release
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
        with:
          path: artifacts
      - run: find artifacts -type f -ls
      - if: needs.meta.outputs.publish == 'true'
        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          name: ${{ needs.meta.outputs.version }}
          files: artifacts/**/*
          generate_release_notes: true