release.yml

name: Build Docker Image Tar

on:
  workflow_dispatch:
    inputs:
      version:
        description: Version for the Docker image tag and tarball name, for example 1.2.3
        required: true
        type: string
  push:
    tags:
      - "*"

permissions:
  contents: write

env:
  TELEGRAM_ENABLED: ${{ secrets.TELEGRAM_TOKEN != '' && secrets.TELEGRAM_CHAT_ID != '' }}

jobs:
  send-start-tg-msg:
    name: Send TG message
    runs-on: ubuntu-latest

    steps:
      - name: Telegram notifications are disabled
        if: env.TELEGRAM_ENABLED != 'true'
        run: echo "Skipping Telegram notification because TELEGRAM_TOKEN or TELEGRAM_CHAT_ID is missing."

      - name: Check out repository
        if: env.TELEGRAM_ENABLED == 'true'
        uses: actions/checkout@v4

      - name: Send Telegram message
        if: env.TELEGRAM_ENABLED == 'true'
        continue-on-error: true
        uses: proDreams/actions-telegram-notifier@main
        with:
          token: ${{ secrets.TELEGRAM_TOKEN }}
          chat_id: ${{ secrets.TELEGRAM_CHAT_ID }}
          thread_id: ${{ secrets.TELEGRAM_TOPIC_ID }}
          status: pending
          notify_fields: "repo_with_tag,commit,workflow"
          title: "Building Exodus Node release."

  build-image-tar:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      IMAGE_NAME: cerberus-node

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Resolve build metadata
        id: meta
        run: |
          if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
            VERSION="${{ github.event.inputs.version }}"
          else
            VERSION="${GITHUB_REF_NAME}"
          fi

          VERSION="$(printf '%s' "${VERSION}" | tr -d '[:space:]')"
          if [ -z "${VERSION}" ]; then
            echo "Version must not be empty" >&2
            exit 1
          fi
          if ! printf '%s' "${VERSION}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "Version must match 1.2.3 format without a leading v" >&2
            exit 1
          fi

          IMAGE_REF="${IMAGE_NAME}:${VERSION}"
          ARTIFACT_NAME_AMD64="${IMAGE_NAME}-${VERSION}-linux-amd64.tar"
          ARTIFACT_NAME_ARM64="${IMAGE_NAME}-${VERSION}-linux-arm64.tar"

          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
          echo "image_ref=${IMAGE_REF}" >> "${GITHUB_OUTPUT}"
          echo "artifact_name_amd64=${ARTIFACT_NAME_AMD64}" >> "${GITHUB_OUTPUT}"
          echo "artifact_name_arm64=${ARTIFACT_NAME_ARM64}" >> "${GITHUB_OUTPUT}"

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Run tests
        run: go test ./...

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build linux/amd64 Docker image tarball
        run: |
          docker buildx build \
            --platform linux/amd64 \
            --tag "${{ steps.meta.outputs.image_ref }}" \
            --output "type=docker,dest=${{ steps.meta.outputs.artifact_name_amd64 }}" \
            .

      - name: Build linux/arm64 Docker image tarball
        run: |
          docker buildx build \
            --platform linux/arm64 \
            --tag "${{ steps.meta.outputs.image_ref }}" \
            --output "type=docker,dest=${{ steps.meta.outputs.artifact_name_arm64 }}" \
            .

      - name: Generate checksums
        run: |
          sha256sum "${{ steps.meta.outputs.artifact_name_amd64 }}" > "${{ steps.meta.outputs.artifact_name_amd64 }}.sha256"
          sha256sum "${{ steps.meta.outputs.artifact_name_arm64 }}" > "${{ steps.meta.outputs.artifact_name_arm64 }}.sha256"

      - name: Upload workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: docker-image-${{ steps.meta.outputs.version }}
          path: |
            ${{ steps.meta.outputs.artifact_name_amd64 }}
            ${{ steps.meta.outputs.artifact_name_amd64 }}.sha256
            ${{ steps.meta.outputs.artifact_name_arm64 }}
            ${{ steps.meta.outputs.artifact_name_arm64 }}.sha256
          if-no-files-found: error

      - name: Create GitHub release and upload assets
        id: release
        continue-on-error: true
        uses: softprops/action-gh-release@v2
        with:
          token: ${{ secrets.RELEASE_TOKEN || github.token }}
          tag_name: ${{ steps.meta.outputs.version }}
          target_commitish: ${{ github.sha }}
          name: ${{ steps.meta.outputs.version }}
          generate_release_notes: true
          files: |
            ${{ steps.meta.outputs.artifact_name_amd64 }}
            ${{ steps.meta.outputs.artifact_name_amd64 }}.sha256
            ${{ steps.meta.outputs.artifact_name_arm64 }}
            ${{ steps.meta.outputs.artifact_name_arm64 }}.sha256

      - name: Warn when GitHub release upload is unavailable
        if: steps.release.outcome == 'failure'
        run: |
          echo "::warning::GitHub release upload failed. Workflow artifacts were uploaded successfully."
          echo "::warning::If you need GitHub Releases, grant Actions write access to contents or set the RELEASE_TOKEN secret."

  send-finish-tg-msg:
    name: Send TG message
    needs: [build-image-tar]
    if: ${{ always() && needs.build-image-tar.result == 'success' }}
    runs-on: ubuntu-latest

    steps:
      - name: Telegram notifications are disabled
        if: env.TELEGRAM_ENABLED != 'true'
        run: echo "Skipping Telegram notification because TELEGRAM_TOKEN or TELEGRAM_CHAT_ID is missing."

      - name: Check out repository
        if: env.TELEGRAM_ENABLED == 'true'
        uses: actions/checkout@v4

      - name: Send Telegram message
        if: env.TELEGRAM_ENABLED == 'true'
        continue-on-error: true
        uses: proDreams/actions-telegram-notifier@main
        with:
          token: ${{ secrets.TELEGRAM_TOKEN }}
          chat_id: ${{ secrets.TELEGRAM_CHAT_ID }}
          thread_id: ${{ secrets.TELEGRAM_TOPIC_ID }}
          status: success
          notify_fields: "repo_with_tag,commit,workflow"
          title: "Exodus Node release finished."

  notify-on-error:
    needs: [build-image-tar]
    if: ${{ always() && needs.build-image-tar.result == 'failure' }}
    runs-on: ubuntu-latest

    steps:
      - name: Telegram notifications are disabled
        if: env.TELEGRAM_ENABLED != 'true'
        run: echo "Skipping Telegram notification because TELEGRAM_TOKEN or TELEGRAM_CHAT_ID is missing."

      - name: Check out repository
        if: env.TELEGRAM_ENABLED == 'true'
        uses: actions/checkout@v4

      - name: Send error notification
        if: env.TELEGRAM_ENABLED == 'true'
        continue-on-error: true
        uses: proDreams/actions-telegram-notifier@main
        with:
          token: ${{ secrets.TELEGRAM_TOKEN }}
          chat_id: ${{ secrets.TELEGRAM_CHAT_ID }}
          thread_id: ${{ secrets.TELEGRAM_TOPIC_ID }}
          status: failure
          notify_fields: "repo_with_tag,commit,workflow"
          title: "Exodus Node release failed."