---
name: cli-release
on:
  push:
    tags:
    - release/cli/**
permissions:
  contents: read
env:
  VERSIONS_FILE: "VERSIONS.json"
jobs:
  get-dev-image:
    uses: ./.github/workflows/get_image.yaml
    with:
      image-base-name: "dev_image_with_extras"
  build-release:
    name: Build Release
    runs-on: oracle-16cpu-64gb-x86-64
    needs: get-dev-image
    permissions:
      contents: read
      packages: write
    container:
      image: ${{ needs.get-dev-image.outputs.image-with-tag }}
    env:
      ARTIFACT_UPLOAD_LOG: "artifact_uploads.json"
      # When macOS signing is enabled, push-signed-artifacts owns the manifest update.
      MANIFEST_UPDATES: ${{ vars.ENABLE_MACOS_SIGNING == 'true' && '' || 'manifest_updates.json' }}
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      with:
        fetch-depth: 0
    - name: Add pwd to git safe dir
      run: git config --global --add safe.directory `pwd`
    - name: get bazel config
      uses: ./.github/actions/bazelrc
      with:
        download_toplevel: 'true'
        BB_API_KEY: ${{ secrets.BB_IO_API_KEY }}
    - name: Setup podman
      run: |
        # With some kernel configs (eg. COS), podman only works with legacy iptables.
        update-alternatives --set iptables /usr/sbin/iptables-legacy
        update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
    - name: Import GPG key
      env:
        BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
      run: |
        echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
    - name: Login to GHCR
      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3.7.0
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ github.token }}
    - name: Build & Push Artifacts
      env:
        REF: ${{ github.event.ref }}
        BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        BUILD_NUMBER: ${{ github.run_attempt }}
        JOB_NAME: ${{ github.job }}
        GH_REPO: ${{ github.repository }}
        IMAGE_REPO: ${{ vars.IMAGE_REPO || 'ghcr.io/pixie-io' }}
      shell: bash
      run: |
        export TAG_NAME="${REF#*/tags/}"
        mkdir -p "artifacts/"
        export ARTIFACTS_DIR="$(realpath artifacts/)"
        ./ci/save_version_info.sh
        ./ci/cli_build_release.sh
    # Despite the name, linux-artifacts also contains the unsigned darwin
    # binaries (cli_darwin_{amd64,arm64}_unsigned). sign-release downloads
    # this artifact to feed cli_merge_sign.sh.
    - name: Upload Github Artifacts
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
      with:
        name: linux-artifacts
        path: artifacts/
    - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
      with:
        name: artifact-upload-log
        path: ${{ env.ARTIFACT_UPLOAD_LOG }}
    - if: vars.ENABLE_MACOS_SIGNING != 'true'
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
      with:
        name: manifest-updates
        path: manifest_updates.json
  sign-release:
    name: Sign Release for MacOS
    if: vars.ENABLE_MACOS_SIGNING == 'true'
    runs-on: macos-latest
    needs: build-release
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      with:
        fetch-depth: 0
    - name: Add pwd to git safe dir
      run: git config --global --add safe.directory `pwd`
    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
      with:
        name: linux-artifacts
        path: artifacts/
    - name: Install gon
      run: brew install Bearer/tap/gon
    - name: Sign CLI release
      env:
        REF: ${{ github.event.ref }}
        AC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
        KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
        CERT_BASE64: ${{ secrets.APPLE_SIGN_CERT_B64 }}
        CERT_PASSWORD: ${{ secrets.APPLE_SIGN_CERT_PASSWORD }}
      shell: bash
      run: |
        export CERT_PATH="pixie.cert"
        echo -n "$CERT_BASE64" | base64 --decode -o "$CERT_PATH"
        export TAG_NAME="${REF#*/tags/}"
        export ARTIFACTS_DIR="$(pwd)/artifacts"
        ./ci/cli_merge_sign.sh
    - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
      with:
        name: macos-artifacts
        path: artifacts/
  push-signed-artifacts:
    name: Push Signed Artifacts for MacOS
    if: vars.ENABLE_MACOS_SIGNING == 'true'
    runs-on: ubuntu-latest
    needs: [get-dev-image, sign-release]
    container:
      image: ${{ needs.get-dev-image.outputs.image-with-tag }}
    env:
      MANIFEST_UPDATES: "manifest_updates.json"
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      with:
        fetch-depth: 0
    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
      with:
        name: macos-artifacts
    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
      with:
        name: artifact-upload-log
    - name: Import GPG key
      env:
        BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
      run: |
        echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
    - name: Add pwd to git safe dir
      run: |
        git config --global --add safe.directory `pwd`
    - name: Upload signed CLI
      env:
        REF: ${{ github.event.ref }}
        BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
        ARTIFACT_UPLOAD_LOG: "artifact_uploads.json"
        GH_REPO: ${{ github.repository }}
      shell: bash
      run: |
        export TAG_NAME="${REF#*/tags/}"
        mkdir -p "artifacts/"
        export ARTIFACTS_DIR="$(pwd)/artifacts"
        ./ci/cli_upload_signed.sh
    - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
      with:
        name: macos-signed-artifacts
        path: artifacts/
    - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
      with:
        name: manifest-updates
        path: ${{ env.MANIFEST_UPDATES }}
  create-github-release:
    name: Create Release on Github
    runs-on: ubuntu-latest
    needs: [build-release, push-signed-artifacts]
    if: |
      always() &&
      needs.build-release.result == 'success' &&
      (needs.push-signed-artifacts.result == 'success' || needs.push-signed-artifacts.result == 'skipped')
    permissions:
      contents: write
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      with:
        fetch-depth: 0
    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
    - name: Create Release
      env:
        REF: ${{ github.event.ref }}
        GH_TOKEN: ${{ secrets.BUILDBOT_GH_API_TOKEN }}
      shell: bash
      run: |
        export TAG_NAME="${REF#*/tags/}"
        # actions/checkout doesn't get the tag annotation properly.
        git fetch origin tag "${TAG_NAME}" -f
        export changelog="$(git tag -l --format='%(contents)' "${TAG_NAME}")"
        prerelease=()
        if [[ "${REF}" == *"-"* ]]; then
          prerelease=("--prerelease")
        fi
        gh release create "${TAG_NAME}" "${prerelease[@]}" \
          --title "CLI ${TAG_NAME#release/cli/}" \
          --notes $'Pixie CLI Release:\n'"${changelog}"
        shopt -s nullglob
        upload_paths=(linux-artifacts/*)
        if [[ -d macos-artifacts ]]; then
          upload_paths+=(macos-artifacts/*)
        fi
        gh release upload "${TAG_NAME}" "${upload_paths[@]}"
  update-gh-artifacts-manifest:
    if: |
      always() && needs.create-github-release.result == 'success'
    runs-on: oracle-8cpu-32gb-x86-64
    needs: [get-dev-image, create-github-release]
    container:
      image: ${{ needs.get-dev-image.outputs.image-with-tag }}
    concurrency: gh-pages
    permissions:
      contents: write
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      with:
        fetch-depth: 0
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      with:
        ref: gh-pages
        path: gh-pages
    - name: Add pwd to git safe dir
      run: |
        git config --global --add safe.directory `pwd`
        git config --global --add safe.directory "$(pwd)/gh-pages"
    - name: Import GPG key
      env:
        BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
      run: |
        echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
    - name: Setup git
      shell: bash
      env:
        BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
      run: |
        git config --global user.name "${{ vars.BUILDBOT_NAME || 'pixie-io-buildbot' }}"
        git config --global user.email "${{ vars.BUILDBOT_EMAIL || 'build@pixielabs.ai' }}"
        git config --global user.signingkey "${BUILDBOT_GPG_KEY_ID}"
        git config --global commit.gpgsign true
    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
      id: download-artifact
      with:
        name: manifest-updates
    - name: Update gh-pages Manifest
      env:
        ARTIFACT_MANIFEST_PATH: "gh-pages/artifacts/manifest.json"
        MANIFEST_UPDATES: "manifest_updates.json"
      run: |
        ./ci/update_artifact_manifest.sh
        cd gh-pages
        export ARTIFACT_MANIFEST_PATH="${ARTIFACT_MANIFEST_PATH##gh-pages/}"
        git add "${ARTIFACT_MANIFEST_PATH}" "${ARTIFACT_MANIFEST_PATH}.sha256"
        git commit -s -m "Update artifact manifest"
        git push origin "gh-pages"