TNT/.github/workflows/release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            target: linux-amd64
            artifact: tnt-linux-amd64
            ctl_artifact: tntctl-linux-amd64
          - os: ubuntu-24.04-arm
            target: linux-arm64
            artifact: tnt-linux-arm64
            ctl_artifact: tntctl-linux-arm64
          - os: macos-15-intel
            target: darwin-amd64
            artifact: tnt-darwin-amd64
            ctl_artifact: tntctl-darwin-amd64
          - os: macos-15
            target: darwin-arm64
            artifact: tnt-darwin-arm64
            ctl_artifact: tntctl-darwin-arm64

    steps:
    - uses: actions/checkout@v6

    - name: Verify release tag matches source version
      run: scripts/check_release_ref.sh "${GITHUB_REF_NAME}"

    - name: Install dependencies (Ubuntu)
      if: runner.os == 'Linux'
      run: |
        sudo apt-get update
        sudo apt-get install -y libssh-dev        

    - name: Install dependencies (macOS)
      if: runner.os == 'macOS'
      run: |
        brew install libssh        

    - name: Run release preflight
      run: make release-check

    - name: Build release binary
      run: make release

    - name: Verify artifact architecture
      run: |
        file tnt
        file tntctl
        case "${{ matrix.target }}" in
          linux-amd64)
            file tnt | grep -E 'ELF 64-bit.*x86-64'
            file tntctl | grep -E 'ELF 64-bit.*x86-64'
            ;;
          linux-arm64)
            file tnt | grep -E 'ELF 64-bit.*(aarch64|ARM aarch64)'
            file tntctl | grep -E 'ELF 64-bit.*(aarch64|ARM aarch64)'
            ;;
          darwin-amd64)
            file tnt | grep -E 'Mach-O 64-bit.*x86_64'
            file tntctl | grep -E 'Mach-O 64-bit.*x86_64'
            ;;
          darwin-arm64)
            file tnt | grep -E 'Mach-O 64-bit.*arm64'
            file tntctl | grep -E 'Mach-O 64-bit.*arm64'
            ;;
        esac        

    - name: Rename binary
      run: |
        mv tnt ${{ matrix.artifact }}
        mv tntctl ${{ matrix.ctl_artifact }}        

    - name: Upload artifact
      uses: actions/upload-artifact@v4
      with:
        name: ${{ matrix.artifact }}
        path: |
          ${{ matrix.artifact }}
          ${{ matrix.ctl_artifact }}          

  source-archive:
    name: Source archive
    runs-on: ubuntu-24.04

    steps:
    - uses: actions/checkout@v6
      with:
        fetch-depth: 0

    - name: Verify release tag matches source version
      run: scripts/check_release_ref.sh "${GITHUB_REF_NAME}"

    - name: Build source archive
      run: |
        archive=$(scripts/package_source_archive.sh "${GITHUB_REF_NAME}" dist)
        sha256sum "$archive"        

    - name: Upload source archive
      uses: actions/upload-artifact@v4
      with:
        name: tnt-chat-source
        path: dist/tnt-chat-v*-source.tar.gz

  artifact-gate:
    name: Release artifact gate
    needs: [build, source-archive]
    runs-on: ubuntu-24.04

    steps:
    - uses: actions/checkout@v6

    - name: Verify release tag matches source version
      run: scripts/check_release_ref.sh "${GITHUB_REF_NAME}"

    - name: Download build artifacts
      uses: actions/download-artifact@v4
      with:
        path: ./artifacts

    - name: Verify and package release assets
      run: scripts/package_release_assets.sh ./artifacts ./dist/release-assets

    - name: Upload release asset bundle
      uses: actions/upload-artifact@v4
      with:
        name: release-assets
        path: dist/release-assets/*

  release:
    needs: [artifact-gate, source-archive]
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
    - uses: actions/checkout@v6

    - name: Verify release tag matches source version
      run: scripts/check_release_ref.sh "${GITHUB_REF_NAME}"

    - name: Download release asset bundle
      uses: actions/download-artifact@v4
      with:
        name: release-assets
        path: ./release-assets

    - name: Verify release checksums
      run: |
        cd release-assets
        sha256sum -c checksums.txt
        cat checksums.txt        

    - name: Create Release
      uses: softprops/action-gh-release@v1
      with:
        files: |
          release-assets/*          
        body: |
          ## Installation

          Install the libssh runtime before running TNT:
          ```bash
          # Ubuntu/Debian
          sudo apt install libssh-4

          # Arch
          sudo pacman -S libssh

          # macOS
          brew install libssh
          ```

          Download the binary for your platform:

          **Linux AMD64:**
          ```bash
          curl -LO https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/tnt-linux-amd64
          curl -LO https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/tntctl-linux-amd64
          chmod +x tnt-linux-amd64
          chmod +x tntctl-linux-amd64
          sudo mv tnt-linux-amd64 /usr/local/bin/tnt
          sudo mv tntctl-linux-amd64 /usr/local/bin/tntctl
          ```

          **Linux ARM64:**
          ```bash
          curl -LO https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/tnt-linux-arm64
          curl -LO https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/tntctl-linux-arm64
          chmod +x tnt-linux-arm64
          chmod +x tntctl-linux-arm64
          sudo mv tnt-linux-arm64 /usr/local/bin/tnt
          sudo mv tntctl-linux-arm64 /usr/local/bin/tntctl
          ```

          **macOS Intel:**
          ```bash
          curl -LO https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/tnt-darwin-amd64
          curl -LO https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/tntctl-darwin-amd64
          chmod +x tnt-darwin-amd64
          chmod +x tntctl-darwin-amd64
          sudo mv tnt-darwin-amd64 /usr/local/bin/tnt
          sudo mv tntctl-darwin-amd64 /usr/local/bin/tntctl
          ```

          **macOS Apple Silicon:**
          ```bash
          curl -LO https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/tnt-darwin-arm64
          curl -LO https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/tntctl-darwin-arm64
          chmod +x tnt-darwin-arm64
          chmod +x tntctl-darwin-arm64
          sudo mv tnt-darwin-arm64 /usr/local/bin/tnt
          sudo mv tntctl-darwin-arm64 /usr/local/bin/tntctl
          ```

          **Verify checksums:**
          ```bash
          curl -LO https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/checksums.txt

          # Linux
          sha256sum -c checksums.txt --ignore-missing

          # macOS
          for f in tnt-* tntctl-* tnt-chat-*-source.tar.gz; do
            grep "  $f$" checksums.txt | shasum -a 256 -c -
          done
          ```

          The release also includes `tnt-chat-${{ github.ref_name }}-source.tar.gz`
          for package-manager recipes. Verify it with the same `checksums.txt`
          before updating Arch, Homebrew, Debian, Ubuntu, or container package
          metadata.

          ## What's Changed
          See [docs/CHANGELOG.md](https://github.com/${{ github.repository }}/blob/${{ github.ref_name }}/docs/CHANGELOG.md)          
        draft: true
        prerelease: false
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}