release.yml

name: Release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      version:
        description: "Release version, for example v0.1.0"
        required: true

permissions:
  contents: write
  packages: write

env:
  NO_COLOR: "1"

jobs:
  config:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.meta.outputs.version }}
      image_matrix: ${{ steps.meta.outputs.image_matrix }}
      nango_image_uri: ${{ steps.meta.outputs.nango_image_uri }}
      brain_image_uri: ${{ steps.meta.outputs.brain_image_uri }}
      pg_backup_image_uri: ${{ steps.meta.outputs.pg_backup_image_uri }}
    steps:
      - uses: actions/checkout@v6

      - uses: ./.github/actions/prepare

      - id: meta
        run: |
          version="${{ inputs.version || github.ref_name }}"
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ github.ref_name }}" != "$version" ]; then
            echo "::error::Run the release workflow on the ${version} tag, or use the Create Release Tag workflow."
            exit 1
          fi
          bun cli/src/scripts/github-deploy-plan.ts verify-release-version "$version"
          bun cli/src/scripts/github-deploy-plan.ts release-outputs "$version" >> "$GITHUB_OUTPUT"

  images:
    needs: config
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        image: ${{ fromJSON(needs.config.outputs.image_matrix) }}
    steps:
      - name: Checkout (with submodules)
        uses: actions/checkout@v6
        with:
          submodules: recursive

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        uses: ./.github/actions/build-and-push-docker
        with:
          image-repository: ${{ matrix.image.repository }}
          image-tag: ${{ matrix.image.image_tag }}
          extra-tags: ${{ matrix.image.extra_tags }}
          context: ${{ matrix.image.context }}
          dockerfile: ${{ matrix.image.dockerfile }}
          cache-scope: ${{ matrix.image.cache_scope }}

  artifacts:
    needs: [config, images]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout (with submodules)
        uses: actions/checkout@v6
        with:
          submodules: recursive

      - name: Verify images are public
        run: |
          infra/deploy/verify_public_images.sh \
            ${{ needs.config.outputs.nango_image_uri }} \
            ${{ needs.config.outputs.brain_image_uri }} \
            ${{ needs.config.outputs.pg_backup_image_uri }}

      - uses: docker/setup-buildx-action@v3

      - uses: ./.github/actions/prepare

      - name: Resolve image digests
        id: image_refs
        env:
          NANGO_IMAGE_URI: ${{ needs.config.outputs.nango_image_uri }}
          BRAIN_IMAGE_URI: ${{ needs.config.outputs.brain_image_uri }}
          PG_BACKUP_IMAGE_URI: ${{ needs.config.outputs.pg_backup_image_uri }}
        run: |
          resolve_ref() {
            local ref="$1"
            local digest
            digest="$(docker buildx imagetools inspect "$ref" | awk '$1 == "Digest:" { print $2; exit }')"
            if [ -z "$digest" ]; then
              echo "::error::Could not resolve digest for $ref"
              exit 1
            fi
            printf '%s@%s' "$ref" "$digest"
          }

          echo "nango=$(resolve_ref "$NANGO_IMAGE_URI")" >> "$GITHUB_OUTPUT"
          echo "brain=$(resolve_ref "$BRAIN_IMAGE_URI")" >> "$GITHUB_OUTPUT"
          echo "pg_backup=$(resolve_ref "$PG_BACKUP_IMAGE_URI")" >> "$GITHUB_OUTPUT"

      - name: Package runtime and integrations
        run: |
          mkdir -p dist
          infra/deploy/package_runtime_bundle.sh dist/company-brain-runtime.tar.gz
          infra/deploy/package_integrations_bundle.sh dist/company-brain-integrations.tar.gz

      - name: Build CLI binaries
        run: |
          bun build --compile --target=bun-linux-x64 cli/src/main.ts --outfile dist/company-brain-linux-x64
          bun build --compile --target=bun-linux-arm64 cli/src/main.ts --outfile dist/company-brain-linux-arm64
          bun build --compile --target=bun-darwin-x64 cli/src/main.ts --outfile dist/company-brain-darwin-x64
          bun build --compile --target=bun-darwin-arm64 cli/src/main.ts --outfile dist/company-brain-darwin-arm64
          chmod 0755 dist/company-brain-*

      - name: Build release manifest and checksums
        env:
          VERSION: ${{ needs.config.outputs.version }}
          NANGO_IMAGE_URI: ${{ steps.image_refs.outputs.nango }}
          BRAIN_IMAGE_URI: ${{ steps.image_refs.outputs.brain }}
          PG_BACKUP_IMAGE_URI: ${{ steps.image_refs.outputs.pg_backup }}
        run: |
          runtime_sha=$(shasum -a 256 dist/company-brain-runtime.tar.gz | awk '{print $1}')
          integrations_sha=$(shasum -a 256 dist/company-brain-integrations.tar.gz | awk '{print $1}')
          RUNTIME_SHA256="$runtime_sha" \
          INTEGRATIONS_SHA256="$integrations_sha" \
            bun cli/src/scripts/github-deploy-plan.ts release-manifest > dist/company-brain-release.json
          shasum -a 256 dist/* > dist/SHA256SUMS

      - name: Refuse to overwrite an existing release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.config.outputs.version }}
        run: |
          if gh release view "$VERSION" >/dev/null 2>&1; then
            echo "::error::GitHub release $VERSION already exists. Release versions are immutable."
            exit 1
          fi

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.config.outputs.version }}
          files: dist/*