release.yml

# Build and release ISO — builds the installer AND appliance ISOs for every
# supported architecture and publishes them as assets on a GitHub Release.
#
# Trigger either way:
#   * push a tag matching v*  (e.g. `git tag v1.2.0 && git push origin v1.2.0`)
#   * run manually from the Actions tab (workflow_dispatch), supplying a tag
#     and optionally a ref/commit to build.
#
# Like test.yml, each arch builds on its own native runner with Nix installed
# directly on the host (DeterminateSystems/nix-installer-action) and the
# /nix/store cached across runs (nix-community/cache-nix-action). Bare
# `make <target>` resolves to
# the runner's native currentSystem; the resulting ISO + its .sha256 sidecar are
# dereferenced into a host mktemp dir. The release job gathers all ISOs and
# attaches them (with sha256 checksums) to the release.

name: Build and release ISO

on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag to create/publish (e.g. v1.2.0)"
        required: true
        type: string
      ref:
        description: "Git ref/commit to build (defaults to the tag/branch)"
        required: false
        type: string
      prerelease:
        description: "Mark the release as a pre-release"
        required: false
        default: false
        type: boolean

# Only one release run per tag at a time.
concurrency:
  group: release-${{ github.event.inputs.tag || github.ref }}
  cancel-in-progress: false

env:
  # Force plain, greppable Nix output in CI logs. Nix's default animated
  # multi-line progress bar renders as unreadable ANSI redraw noise in the
  # GitHub Actions log viewer; `--log-format raw` prints one line per event and
  # `--print-build-logs` streams the actual builder output. The Makefile passes
  # $(NIX_OUTPUT_FLAGS) to every nix invocation (build / eval / flake check).
  NIX_OUTPUT_FLAGS: --log-format raw --print-build-logs

jobs:
  build:
    name: ${{ matrix.kind }} (${{ matrix.system }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: true
      matrix:
        include:
          - kind: Installer
            target: installer
            system: x86_64-linux
            runner: ubuntu-24.04
          - kind: Installer
            target: installer
            system: aarch64-linux
            runner: ubuntu-24.04-arm
          - kind: Appliance
            target: appliance
            system: x86_64-linux
            runner: ubuntu-24.04
          - kind: Appliance
            target: appliance
            system: aarch64-linux
            runner: ubuntu-24.04-arm
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          # Empty for tag push (checks out the tag); honored for manual dispatch
          # to release an arbitrary commit.
          ref: ${{ github.event.inputs.ref }}

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@main

      - name: Cache Nix store
        uses: nix-community/cache-nix-action@v6
        with:
          # ISO closures are large; cap the saved store so a build can't blow
          # past the repo's GitHub Actions cache budget (10G total).
          primary-key: nix-images-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('flake.lock', '**/*.nix') }}
          restore-prefixes-first-match: nix-images-${{ runner.os }}-${{ runner.arch }}-
          gc-max-store-size-linux: 8G

      - name: Build ISO
        id: build
        env:
          TARGET: ${{ matrix.target }}
        run: |
          # Nix is on the host, so make/git (preinstalled on the runner) build
          # straight into the host /nix/store. The ISO target puts the image and
          # its .sha256 sidecar together in out/<target>-iso/iso, so a single
          # cp -L dereferences both into a real mktemp dir for upload (release
          # consumers can verify the download). Bare target → native
          # currentSystem (matrix pins the matching native runner).
          dist="$(mktemp -d)"
          echo "dist=$dist" >>"$GITHUB_OUTPUT"
          make "$TARGET/iso"
          cp -L "out/$TARGET-iso/iso"/* "$dist/"
          ls -lh "$dist"

      - name: Upload ISO artifact
        uses: actions/upload-artifact@v6
        with:
          name: coder-box-${{ matrix.target }}-${{ matrix.system }}
          path: ${{ steps.build.outputs.dist }}/*.iso
          if-no-files-found: error

      - name: Upload ISO checksum artifact
        uses: actions/upload-artifact@v6
        with:
          name: coder-box-${{ matrix.target }}-${{ matrix.system }}-sha256
          path: ${{ steps.build.outputs.dist }}/*.iso.sha256
          if-no-files-found: error

  release:
    name: Publish GitHub Release
    needs: build
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - name: Determine release tag
        id: tag
        run: |
          if [ -n "${{ github.event.inputs.tag }}" ]; then
            tag="${{ github.event.inputs.tag }}"
          else
            tag="${GITHUB_REF#refs/tags/}"
          fi
          echo "tag=$tag" >>"$GITHUB_OUTPUT"
          echo "Releasing tag: $tag"

      - name: Download built ISOs
        uses: actions/download-artifact@v7
        with:
          path: dist
          merge-multiple: true

      - name: List release assets
        run: ls -lhR dist/

      - name: Create / update GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.tag.outputs.tag }}
          name: ${{ steps.tag.outputs.tag }}
          generate_release_notes: true
          prerelease: ${{ github.event.inputs.prerelease || false }}
          files: |
            dist/*.iso
            dist/*.iso.sha256
          fail_on_unmatched_files: true