ARTEX-chixuweihu/.github/workflows/release.yml

name: release
on:
  workflow_dispatch:
    inputs:
      tag:
        description: "已存在的正式版本标签，例如 v0.3.16"
        required: true
        type: string
  push:
    tags: ["v*"]

permissions:
  contents: read

concurrency:
  group: release-${{ inputs.tag || github.ref_name }}
  cancel-in-progress: false

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.version.outputs.tag }}
      commit: ${{ steps.commit.outputs.sha }}
    steps:
      - name: Validate release version
        id: version
        env:
          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
        run: |
          if [[ ! "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
            echo "正式版本必须是 v主版本.次版本.修订号，例如 v0.3.16" >&2
            exit 1
          fi
          echo "tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
      - uses: actions/checkout@v4
        with:
          ref: refs/tags/${{ steps.version.outputs.tag }}
      - name: Pin release commit
        id: commit
        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

  # ① 前端静态导出（一次），产物给交叉编译各平台复用
  frontend:
    needs: prepare
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.prepare.outputs.commit }}
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: web/package-lock.json
      - run: npm ci
        working-directory: web
      - run: npm run build:static
        working-directory: web
      - uses: actions/upload-artifact@v4
        with:
          name: web-dist
          path: web/out

  # ② 五平台交叉编译（内嵌前端）+ 打 zip
  binaries:
    needs: [prepare, frontend]
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - { goos: linux, goarch: amd64 }
          - { goos: linux, goarch: arm64 }
          - { goos: darwin, goarch: amd64 }
          - { goos: darwin, goarch: arm64 }
          - { goos: windows, goarch: amd64 }
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.prepare.outputs.commit }}
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
      - uses: actions/download-artifact@v4
        with:
          name: web-dist
          path: server/webui/dist
      - name: Build and package with build.sh
        env:
          ARTEX_TARGET_OS: ${{ matrix.goos }}
          ARTEX_TARGET_ARCH: ${{ matrix.goarch }}
          ARTEX_BUILD_VERSION: ${{ needs.prepare.outputs.tag }}
          ARTEX_SKIP_FRONTEND: "1"
          ARTEX_SKIP_NPM_CI: "1"
          # UPX 自解压 ELF 在部分 Linux 内核、虚拟化和安全策略下会崩溃。
          # Release 使用 Go linker 裁剪和 zip 压缩，优先保证可移植性。
          ARTEX_COMPRESS: "0"
          ARTEX_PACKAGE: "1"
          ARTEX_PACKAGE_DIR: dist
        run: |
          ./build.sh --target "${ARTEX_TARGET_OS}/${ARTEX_TARGET_ARCH}"
      - name: Smoke test Linux amd64 binary
        if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
        run: dist/artex-linux-amd64/artex -h
      - uses: actions/upload-artifact@v4
        with:
          name: pkg-${{ matrix.goos }}-${{ matrix.goarch }}
          path: "dist/*.zip"
      # Linux 生二进制单独上传，供 docker job 复用（免在镜像里重编前端+Go）
      - if: matrix.goos == 'linux'
        uses: actions/upload-artifact@v4
        with:
          name: bin-linux-${{ matrix.goarch }}
          path: dist/artex-linux-${{ matrix.goarch }}/artex

  # ③ 汇总所有 zip → 创建 GitHub Release
  release:
    needs: [prepare, binaries]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ github.token }}
      GH_REPO: ${{ github.repository }}
      RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: pkg-*
          merge-multiple: true
          path: dist
      - name: Generate checksums
        working-directory: dist
        run: |
          version="${RELEASE_TAG#v}"
          for target in linux-amd64 linux-arm64 darwin-amd64 darwin-arm64 windows-amd64; do
            test -s "artex-${version}-${target}.zip"
          done
          sha256sum *.zip > SHA256SUMS
          sha256sum --check SHA256SUMS
      - name: Refuse to overwrite a published release
        run: |
          if gh release view "$RELEASE_TAG" --json isDraft > /tmp/artex-release.json 2>/tmp/artex-release.err; then
            test "$(jq -r .isDraft /tmp/artex-release.json)" = true || {
              echo "该版本已发布，请使用新的版本标签" >&2
              exit 1
            }
          elif ! grep -qi 'release not found\|HTTP 404' /tmp/artex-release.err; then
            cat /tmp/artex-release.err >&2
            exit 1
          fi
      - uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.prepare.outputs.tag }}
          target_commitish: ${{ needs.prepare.outputs.commit }}
          draft: true
          fail_on_unmatched_files: true
          files: |
            dist/*.zip
            dist/SHA256SUMS
          generate_release_notes: true
      - name: Publish complete release
        run: gh release edit "$RELEASE_TAG" --draft=false --latest

  # ④ 多架构镜像 → 推 Docker Hub（复用 binaries 编好的 Linux 二进制，
  #    镜像里只装工具 + 放二进制；arm64 仅需模拟 apt 层，构建快很多）
  docker:
    # 页面更新只需要 Release；镜像发布按需启用，不依赖原作者的账号。
    if: vars.ARTEX_DOCKER_IMAGE != ''
    needs: [prepare, binaries]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4 # 取 Dockerfile 与 skills/
        with:
          ref: ${{ needs.prepare.outputs.commit }}
      - uses: actions/download-artifact@v4
        with:
          name: bin-linux-amd64
          path: dist/amd64
      - uses: actions/download-artifact@v4
        with:
          name: bin-linux-arm64
          path: dist/arm64
      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: ${{ vars.ARTEX_DOCKER_IMAGE }}
          tags: |
            type=raw,value=${{ needs.prepare.outputs.tag }}
            type=raw,value=latest
      - uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max