release.yml

# *******************************************************************************
# Copyright (c) 2026 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made available under the
# terms of the Apache License Version 2.0 which is available at
# https://www.apache.org/licenses/LICENSE-2.0
#
# SPDX-License-Identifier: Apache-2.0
# *******************************************************************************

name: Release
run-name: Release ${{ inputs.tag }}

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (e.g., v1.0.0)'
        required: true
        type: string

# Prevent concurrent release runs to avoid conflicts and race conditions
concurrency:
  group: release

jobs:
  # Build, test, generate coverage, and so on to avoid creating a broken release.
  # The following job depends on the coverage-html artifact being created.
  pr:
    name: PR
    uses: ./.github/workflows/on-pr.yml
    permissions:
      pull-requests: write
      contents: read

  pr-target:
    name: PR Target
    uses: ./.github/workflows/on-pr-target.yml
    secrets: inherit
    permissions:
      contents: write
      pages: write
      pull-requests: write
      id-token: write
      actions: read
      issues: write

  codeql:
    name: CodeQL
    uses: ./.github/workflows/_codeql.yml
    permissions:
      contents: read
      actions: write
      security-events: write

  create-release:
    name: Create release
    needs:
      - pr
      - pr-target
      - codeql
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      COVERAGE_ARCHIVE: ${{ github.event.repository.name }}-${{ inputs.tag }}-coverage
      CODEQL_ARCHIVE: ${{ github.event.repository.name }}-${{ inputs.tag }}-codeql
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Get previous tag
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          PREVIOUS_RELEASE_TAG="$(gh release view --json tagName --jq '.tagName' 2>/dev/null || echo "N/A")"
          echo "PREVIOUS_RELEASE_TAG=$PREVIOUS_RELEASE_TAG" >> "$GITHUB_ENV"

      - name: Get current date
        run: |
          RELEASE_DATE="$(date --rfc-3339=date)"
          echo "RELEASE_DATE=$RELEASE_DATE" >> "$GITHUB_ENV"

      - name: Insert release metadata
        env:
          RELEASE_TAG: ${{ inputs.tag }}
          COMMIT_SHA: ${{ github.sha }}
          ACTION_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          envsubst '$RELEASE_TAG $PREVIOUS_RELEASE_TAG $COMMIT_SHA $RELEASE_DATE $ACTION_RUN_URL' < .github/RELEASE_TEMPLATE.md > release_body.md

      - name: Find release notes
        # Searches docs/release/release_note_v_X_Y_Z.rst files
        # Sorts versions numerically, returns the highest version found
        run: |
          LATEST=$(
            for f in docs/release/release_note_v_*.rst; do
              [ -e "$f" ] || continue
              ver=$(basename "$f" .rst | sed 's/release_note_v_//' | tr '_' '.')
              echo "$ver $f"
            done | sort -t '.' -k1,1n -k2,2n -k3,3n | tail -1 | awk '{print $2}'
          )
          echo "LATEST_RELEASE_NOTE=${LATEST:--}" >> "$GITHUB_ENV"

      - name: Convert release notes to Markdown
        # Extracts release note sections from .rst file and converts to .md format
        if: env.LATEST_RELEASE_NOTE != '-'
        run: ./scripts/prepare_release_notes.sh release_body.md "${{ env.LATEST_RELEASE_NOTE }}"

      - name: Download coverage report
        uses: actions/download-artifact@v8
        with:
          name: coverage-html
          path: ${{ env.COVERAGE_ARCHIVE }}

      - name: Compress coverage report
        # Reproducible flags: sorted names, fixed ownership (0:0), fixed timestamps
        run: |
          tar --sort=name --owner=0 --group=0 --numeric-owner \
            -cJf "$COVERAGE_ARCHIVE.tar.xz" "$COVERAGE_ARCHIVE"

      - name: Download CodeQL results
        uses: actions/download-artifact@v8
        with:
          pattern: codeql-*
          path: ${{ env.CODEQL_ARCHIVE }}

      - name: Compress CodeQL results
        run: |
          tar --sort=name --owner=0 --group=0 --numeric-owner \
            -cJf "$CODEQL_ARCHIVE.tar.xz" "$CODEQL_ARCHIVE"

      - name: Create draft release
        uses: softprops/action-gh-release@v3
        id: draft_release
        with:
          tag_name: ${{ inputs.tag }}
          body_path: release_body.md
          draft: true
          generate_release_notes: false
          target_commitish: ${{ github.sha }}
          files: |
            ${{ env.COVERAGE_ARCHIVE }}.tar.xz
            ${{ env.CODEQL_ARCHIVE }}.tar.xz

      - name: Link to release in workflow summary
        run: |
          echo "[A draft release was created.](${{ steps.draft_release.outputs.url }})" >> "$GITHUB_STEP_SUMMARY"