_release.yml

name: _release

permissions:
  contents: read

on:
  workflow_call:
    secrets:
      app-id:
      app-key:
    inputs:
      action:
        type: string
        required: true
      arches:
        type: string
        default: |
          ["amd64", "arm64"]
      bazel-versions-file:
        type: string
        default: bazel/versions.bzl
      committer-email:
        type: string
        required: true
      committer-name:
        type: string
        required: true
      dry-run:
        description: Dry run (no PR created)
        type: boolean
        default: false
      glibc-versions:
        type: string
        default: |
          ["2.28", "2.31"]
      glint-version:
        # TODO: think of a better solution for this
        type: string
        default: 0.1.0
      prepare-args:
        type: string
        default:
      release-version:
        description: Release version (overrides version.next if set)
        type: string
        default:
      python-find-versions:
        type: string
        default: |
          _OUTPUT=()
          for version_file in py/*/VERSION; do
              if [[ -f "$version_file" ]]; then
                  package_dir=$(dirname "$version_file")
                  package_name=$(basename "$package_dir")
                  version=$(cat "$version_file")
                  _OUTPUT+=("$package_name $version")
              fi
          done
          OUTPUT=$(printf '%s\n' "${_OUTPUT[@]}")
      stdcc-versions:
        type: string
        default: |
          ["base", "13"]
      template-version-update:
        type: string
        default: |
          echo \"\(.release_version)\" > \"\(.version_file)\"
      type:
        description: Release type
        required: true
        type: string
      warn-on-error:
        description: Only warn for release issues
        default: false
        type: boolean


jobs:
  release:
    name: ${{ inputs.action }}
    runs-on: ubuntu-24.04
    steps:
    - uses: envoyproxy/toolshed/actions/appauth@5e0c5734ee7fc8a30629bd3f54fc910f92285bbe
      id: appauth
      name: Appauth
      if: >-
        ! inputs.dry-run
      with:
        app_id: ${{ secrets.app-id }}
        key: ${{ secrets.app-key }}
    - id: checkout
      name: Checkout the repository
      uses: envoyproxy/toolshed/actions/github/checkout@5e0c5734ee7fc8a30629bd3f54fc910f92285bbe
      with:
        branch: main
        committer-name: ${{ inputs.committer-name }}
        committer-email: ${{ inputs.committer-email }}
        pr: ${{ github.event.pull_request.number || '' }}
        token: ${{ steps.appauth.outputs.token }}
    - name: Get version file
      id: version-file
      uses: envoyproxy/toolshed/actions/jq@5e0c5734ee7fc8a30629bd3f54fc910f92285bbe
      with:
        input: |
          actions: actions/VERSION.txt
          bins: BINS_VERSION.txt
          bazel: bazel/VERSION.txt
          python: py/VERSION.txt
        input-format: yaml
        options: -r
        filter: .["${{ inputs.type }}"]
    - name: Get version info
      id: version
      uses: envoyproxy/toolshed/actions/version@5e0c5734ee7fc8a30629bd3f54fc910f92285bbe
      with:
        version-file: ${{ steps.version-file.outputs.value }}
    - name: Update version file
      uses: envoyproxy/toolshed/actions/bson@5e0c5734ee7fc8a30629bd3f54fc910f92285bbe
      if: >-
        inputs.action != 'prepare'
      with:
        input: |
          version: ${{ steps.version.outputs.version }}
          version_file: ${{ steps.version-file.outputs.value }}
          release_version: ${{ inputs.release-version || fromJSON(steps.version.outputs.version).next }}
        filter: |
          if .version.is_dev then
            "${{ inputs.template-version-update }}"
          else ":" end

    # ACTIONS ONLY
    - name: Prepare actions
      if: >-
        inputs.type == 'actions'
        && inputs.action != 'release-no-prepare'
      run: |
        HEAD=$(git rev-parse HEAD)
        OUTDATED=()
        while read -r hash; do
            if [[ "$hash" != "$HEAD" ]]; then
                OUTDATED+=("$hash")
                git grep "${hash}" actions/ \
                    | cut -d: -f1 \
                    | sort -u \
                    | xargs sed -i s/${hash}/${HEAD}/g
            fi
        done < <(git grep toolshed/actions/ actions/ | grep @ | grep -v VERSION | cut -d@ -f2 | sort -u)

    # BAZEL ONLY
    - name: Get latest bins release (for bazel)
      uses: envoyproxy/toolshed/actions/github/release/latest@5e0c5734ee7fc8a30629bd3f54fc910f92285bbe
      id: bins-version
      if: >-
        inputs.type == 'bazel'
        && inputs.action != 'release-no-prepare'
      with:
        pattern: ^bins-
    - name: Get SHAs for latest bins release (for bazel)
      uses: envoyproxy/toolshed/actions/github/release/shas@5e0c5734ee7fc8a30629bd3f54fc910f92285bbe
      id: bins-shas
      if: >-
        inputs.type == 'bazel'
        && inputs.action != 'release-no-prepare'
      with:
        tag: ${{ steps.bins-version.outputs.tag }}
    - name: Get current SHAs and version (for bazel)
      uses: envoyproxy/toolshed/actions/bson@5e0c5734ee7fc8a30629bd3f54fc910f92285bbe
      id: bins-deps
      if: >-
        inputs.type == 'bazel'
        && inputs.action != 'release-no-prepare'
      with:
        input: |
          cd bazel
          bazel build //:deps
          OUTPUT=$(cat bazel-bin/deps.json)
        input-format: text
        filter:
          bash::output
        options: -sRr
    - name: Update bins shas (for bazel)
      uses: envoyproxy/toolshed/actions/bson@5e0c5734ee7fc8a30629bd3f54fc910f92285bbe
      id: bins-updates
      if: >-
        inputs.type == 'bazel'
        && inputs.action != 'release-no-prepare'
      with:
        input: |
          bins_latest: ${{ steps.bins-version.outputs.tag }}
          current: ${{ steps.bins-deps.outputs.output }}
          shas: ${{ steps.bins-shas.outputs.shas }}
          glibc_versions: ${{ inputs.glibc-versions }}
          stdcc_versions: ${{ inputs.stdcc-versions }}
          arches: ${{ inputs.arches }}
          glint_version: ${{ inputs.glint-version }}
          versions_file: ${{ inputs.bazel-versions-file }}
          san:
          - msan
          - tsan
        input-format: yaml
        filter: |
          .
          | .shas as $shas
          | .current as $current
          | .glibc_versions as $glibc_versions
          | .arches as $arches
          | .stdcc_versions as $stdccs
          | .san as $san
          | .glint_version as $glint_version
          | .versions_file as $versions_file
          | (.bins_latest | split("-v") | .[1]) as $bins_latest
          | (if $current.bins_release != $bins_latest then
               ["sed -i 's/\"bins_release\": \"\($current.bins_release)\"/\"bins_release\": \"\($bins_latest)\"/g' \($versions_file)"]
             else [] end) as $bins_update
          | [$san[]
             | . as $san_type
             | $current["\($san_type)_libs_sha256"] as $current_sha
             | ($shas["\($san_type)-llvm18.1.8-x86_64.tar.xz"] | split(":") | .[1]) as $new_sha
             | if $current_sha != $new_sha then
                 "sed -i s/\($current_sha)/\($new_sha)/g \($versions_file)"
               else "" end] as $san_updates
          | [$arches[]
             | . as $arch
             | [($shas["glint-\($glint_version)-\($arch)"] | split(":") | .[1]) as $new_sha
                | $current["glint_sha256"][$arch] as $current_sha
                | if $current_sha != $new_sha then
                    "sed -i s/\($current_sha)/\($new_sha)/g \($versions_file)"
                  else "" end] as $glint_updates
             | [$glibc_versions[]
                | . as $glibc
                | $stdccs[]
                | . as $stdcc
                | (if $stdcc == "base" then ""
                   else "-libstdc++\($stdcc)"
                   end) as $stdcc_extra
                | "sysroot-glibc\($glibc)\($stdcc_extra)-\($arch).tar.xz" as $sysroot
                | ($shas[$sysroot]
                   | split(":")
                   | .[1]) as $new_sha
                | $current.sysroot_hashes[$glibc][$stdcc][$arch] as $current_sha
                | if $current_sha != $new_sha then
                    "sed -i s/\($current_sha)/\($new_sha)/g \($versions_file)"
                  else "" end] as $sysroot_updates
              | $glint_updates + $sysroot_updates] as $arch_updates
          | $bins_update + $san_updates + $arch_updates
          | [flatten[]
             | select(. != "")]
          | join("\n")
    - name: Update MODULE.bazel version (for bazel)
      if: >-
        inputs.type == 'bazel'
        && inputs.action != 'release-no-prepare'
      env:
        RELEASE_VERSION: ${{ inputs.release-version || fromJSON(steps.version.outputs.version).next }}
      run: |
        sed -i '/^module(/,/^)/s/version = "[^"]*"/version = "'"${RELEASE_VERSION}"'"/' bazel/MODULE.bazel
        echo "Updated bazel/MODULE.bazel to version ${RELEASE_VERSION}"
        git add bazel/MODULE.bazel
        git diff --cached bazel/MODULE.bazel

    # PYTHON ONLY
    - name: Get python package versions
      id: python-versions
      if: >-
        inputs.type == 'python'
        && inputs.action != 'release-no-prepare'
      uses: envoyproxy/toolshed/actions/bson@5e0c5734ee7fc8a30629bd3f54fc910f92285bbe
      with:
        input: |
          ${{ inputs.python-find-versions }}
        filter: bash::output
        input-format: text
        options: -sRr
        result-filter: |
          split("\n")
          | map(select(.  != ""))
          | map(split(" ") | {key: .[0], value: (.[1] | utils::version)})
          | from_entries
        result-filter-options: -sRc
    - if: >-
        inputs.type == 'python'
        && inputs.action != 'release-no-prepare'
      name: Update python release packages
      uses: envoyproxy/toolshed/actions/bson@5e0c5734ee7fc8a30629bd3f54fc910f92285bbe
      with:
        input: |
          args: >-
            ${{ inputs.prepare-args }}
          versions: ${{ steps.python-versions.outputs.output }}
        input-format: yaml
        filter: |
          .versions as $versions
          | .args // ""
          | [args::parse({"options": {"u": "array"}})
             | (.options.u // [])[]
             | split("=")
             | $versions[.[0]].version as $current
             | $versions[.[0]].next as $next
             | "sed -i s/\($current)/\(.[1] // $next)/ py/\(.[0])/VERSION"]
          | join("\n")
    - name: Get python release package versions
      id: python-updated-versions
      if: >-
        inputs.type == 'python'
        && inputs.action != 'release-no-prepare'
      uses: envoyproxy/toolshed/actions/bson@5e0c5734ee7fc8a30629bd3f54fc910f92285bbe
      with:
        input: |
          ${{ inputs.python-find-versions }}
        filter: bash::output
        input-format: text
        options: -sRr
        result-filter: |
          split("\n")
          | map(
              select(.  != "")
              | split(" ")
              | select(.[1] | endswith("-dev") | not)
              | {key: .[0], value: .[1]})
          | from_entries
        result-filter-options: -sRc
    - if: >-
        inputs.type == 'python'
        && inputs.action != 'release-no-prepare'
        && steps.python-updated-versions.outputs.output == '{}'
      name: Check python release packages
      run: |
        if [[ "${{ inputs.warn-on-error }}" == "true" ]]; then
            echo "::warning::No Python packages are set for release, this will create an empty release" >&2
        else
            echo "::error::No Python packages are set for release, this will create an empty release" >&2
            exit 1
        fi

    - name: Commit changes
      id: commit
      env:
        COMMIT_MESSAGE: >-
          ${{ inputs.type }}:
          ${{ inputs.action == 'prepare' && 'Prepare release' || 'Release' }}
          v${{ inputs.release-version || fromJSON(steps.version.outputs.version).next }}
      run: |
        if [[ -z "$(git status --porcelain)" ]]; then
            echo "changes=false" >> "$GITHUB_OUTPUT"
            exit
        fi
        git commit . -m "${COMMIT_MESSAGE}" --signoff
        git show
        echo "message=${COMMIT_MESSAGE}" >> "$GITHUB_OUTPUT"
        echo "changes=true" >> "$GITHUB_OUTPUT"
    - name: Create Pull Request
      uses: envoyproxy/toolshed/actions/github/pr@5e0c5734ee7fc8a30629bd3f54fc910f92285bbe
      if: fromJSON(steps.commit.outputs.changes)
      with:
        base: main
        branch: >-
          release/${{
            inputs.action == 'prepare'
            && 'prepare'
            || 'create'
          }}/${{ inputs.type }}/${{ inputs.release-version || fromJSON(steps.version.outputs.version).next }}
        commit: false
        title: >-
          ${{ steps.commit.outputs.message }}
        body: |
          Created by publish-envoy[bot] for @${{ github.actor }}
        dry-run: ${{ inputs.dry-run }}
        GITHUB_TOKEN: ${{ steps.appauth.outputs.token || github.token }}