release.yml

# thinRoot Release build
# yamllint disable rule:truthy
---
name: Release Build

on:
  workflow_dispatch:
    inputs:
      release_date:
        description: 'Release date override (YYYYMMDD)'
        required: true
        default: "YYYYMMDD"
      skip_build:
        description: 'Skip build (for testing workflow)?'
        required: true
        default: "true"

# default read-only permission
permissions:
  contents: read

jobs:
  release_draft:
    permissions:
      contents: write  # ncipollo/release-action
    name: Release draft
    runs-on: ubuntu-24.04
    outputs:
      upload_url: ${{ steps.release_drafter.outputs.upload_url }}
      version: ${{ steps.env.outputs.version }}
      date: ${{ steps.env.outputs.date }}
      tag: ${{ steps.env.outputs.tag }}

    steps:
      - name: Checkout Code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Setup Environment
        id: env
        shell: bash
        run: |
          if [[ "${{ github.event.inputs.release_date }}" == "YYYYMMDD" ]]; then
            BUILD_DATE=$(date +%Y%m%d)
          else
            BUILD_DATE=${{ github.event.inputs.release_date }}
          fi
          echo "version=${BUILD_DATE}" >> $GITHUB_OUTPUT
          echo "date=${BUILD_DATE}" >> $GITHUB_OUTPUT
          if [[ "${{ github.event.inputs.skip_build }}" == "true" ]]; then
            echo "tag=${BUILD_DATE}-draft" >> $GITHUB_OUTPUT
          else
            echo "tag=${BUILD_DATE}" >> $GITHUB_OUTPUT
          fi

      - name: Get previous tag
        id: previoustag
        uses: WyriHaximus/github-action-get-previous-tag@v2.0

      - name: Generate changelog
        id: changelog
        uses: metcalfc/changelog-generator@v4.8.0
        with:
          myToken: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate release notes
        shell: bash
        run: |
          FILTER="(snapshot bump \[|Merge branch '|Update .*\.md$|Bump .* from .* to .*)"
          export CHANGELOG="$(cat <<'EOF' | egrep -v  "${FILTER}"
          ${{ steps.changelog.outputs.changelog }}
          EOF
          )"
          export VERSION=${{ steps.env.outputs.version }}
          export PREVIOUS_TAG=${{ steps.previoustag.outputs.tag }}
          envsubst <.github/release-template.md >/tmp/release-template.md

      - name: Create release draft
        id: release_drafter
        uses: ncipollo/release-action@v1.21.0
        with:
          tag: ${{ steps.env.outputs.tag }}
          name: 'thinRoot ${{ steps.env.outputs.version }}'
          bodyFile: /tmp/release-template.md
          draft: true
          prerelease: false
          allowUpdates: true
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload release-template.md artifact
        uses: actions/upload-artifact@v7
        with:
          path: /tmp/release-template.md
          name: release-template.md

  build:
    permissions:
      contents: write  # shogo82148/actions-upload-release-asset
    name: Release build [${{ matrix.platform }}]
    if: github.repository == 'jens-maus/thinRoot'
    runs-on: self-hosted
    timeout-minutes: 300
    needs: release_draft
    outputs:
      build_datetime: ${{ steps.env.outputs.build_datetime }}

    strategy:
      fail-fast: false
      matrix:
        platform: [generic-x86_64, rpi3, rpi4, rpi5, tinkerboard]

    steps:
      - name: Checkout Code
        uses: actions/checkout@v7

      - name: Install Dependencies
        run: |
          if ! dpkg-query -l wget bc cpio rsync zip python3 file >/dev/null 2>&1; then
            apt update
            apt install -y --no-install-recommends wget bc cpio rsync zip python3 file
          fi
          if ! getent group | grep -q ^builder:; then groupadd -g 48 builder; fi
          if ! getent passwd | grep -q ^builder:; then useradd -m -u 1003 -g 48 -G sudo builder; fi
          if ! grep -q ^builder; then echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/etc/sudoers; fi
          chown -R builder:builder /home/builder

      - name: Setup Environment
        id: env
        run: |
          JLEVEL=0
          if [[ -f /sys/fs/cgroup/cpu.max ]]; then # cgroups v2
            CPU_QUOTA=$(cut -d ' ' -f1 /sys/fs/cgroup/cpu.max)
            if [[ "${CPU_QUOTA}" != "max" ]]; then
              CPU_PERIOD=$(cut -d ' ' -f2 /sys/fs/cgroup/cpu.max)
              JLEVEL=$((CPU_QUOTA / CPU_PERIOD + 1))
            fi
          elif [[ -f /sys/fs/cgroup/cpu/cpu.cfs_quota_us ]]; then # cgroups v1
            CPU_QUOTA=$(cat /sys/fs/cgroup/cpu/cpu.cfs_quota_us)
            if [[ "${CPU_QUOTA}" != "-1" ]]; then
              CPU_PERIOD=$(cat /sys/fs/cgroup/cpu/cpu.cfs_period_us)
              JLEVEL=$((CPU_QUOTA / CPU_PERIOD + 1))
            fi
          fi
          echo "JLEVEL=${JLEVEL}" >> $GITHUB_ENV
          echo "FAKE_BUILD=${{ github.event.inputs.skip_build }}" >> $GITHUB_ENV
          echo "build_datetime=$(date +'%Y-%m-%d %H:%M:%S')" >> $GITHUB_OUTPUT

      # - name: remote debug tmate session
      #   uses: mxschmitt/action-tmate@v1
      #   if: matrix.platform == 'generic-x86_64'

      # major build step
      - name: Build
        timeout-minutes: 300
        run: |
          rm -rf release/thinroot-* buildroot-????.*
          sudo -H -E -u builder nice -n 19 make DATE=${{ needs.release_draft.outputs.date }} BR2_DL_DIR=/mnt/download BR2_CCACHE_DIR=/mnt/ccache/${{ matrix.platform }} BR2_JLEVEL=${{ env.JLEVEL }} clean-all ${{ matrix.platform }}-release

      #######################
      # release uploads
      - name: Upload release image [generic-x86_64, rpi3, rpi4, rpi5, tinkerboard]
        uses: shogo82148/actions-upload-release-asset@v1
        with:
          upload_url: ${{ needs.release_draft.outputs.upload_url }}
          asset_path: release/thinroot-${{ needs.release_draft.outputs.version }}-${{ matrix.platform }}.img
          asset_content_type: application/octet-stream

      - name: Upload release image checksum [generic-x86_64, rpi3, rpi4, rpi5, tinkerboard]
        uses: shogo82148/actions-upload-release-asset@v1
        with:
          upload_url: ${{ needs.release_draft.outputs.upload_url }}
          asset_path: release/thinroot-${{ needs.release_draft.outputs.version }}-${{ matrix.platform }}.img.sha256
          asset_content_type: text/plain

      - name: Upload release sdcard image [rpi3, rpi4, rpi5, tinkerboard]
        if: matrix.platform == 'rpi3' || matrix.platform == 'rpi4' || matrix.platform == 'rpi5' || matrix.platform == 'tinkerboard'
        uses: shogo82148/actions-upload-release-asset@v1
        with:
          upload_url: ${{ needs.release_draft.outputs.upload_url }}
          asset_path: release/thinroot-${{ needs.release_draft.outputs.version }}-${{ matrix.platform }}-sdcard.img
          asset_content_type: application/octet-stream

      - name: Upload release sdcard image checksum [rpi3, rpi4, rpi5, tinkerboard]
        if: matrix.platform == 'rpi3' || matrix.platform == 'rpi4' || matrix.platform == 'rpi5' || matrix.platform == 'tinkerboard'
        uses: shogo82148/actions-upload-release-asset@v1
        with:
          upload_url: ${{ needs.release_draft.outputs.upload_url }}
          asset_path: release/thinroot-${{ needs.release_draft.outputs.version }}-${{ matrix.platform }}-sdcard.img.sha256
          asset_content_type: text/plain

      - name: Upload release kernel image [rpi3, rpi4, rpi5, tinkerboard]
        if: matrix.platform == 'rpi3' || matrix.platform == 'rpi4' || matrix.platform == 'rpi5' || matrix.platform == 'tinkerboard'
        uses: shogo82148/actions-upload-release-asset@v1
        with:
          upload_url: ${{ needs.release_draft.outputs.upload_url }}
          asset_path: release/thinroot-${{ needs.release_draft.outputs.version }}-${{ matrix.platform }}-kernel.img
          asset_content_type: application/octet-stream

      - name: Upload release kernel image checksum [rpi3, rpi4, rpi5, tinkerboard]
        if: matrix.platform == 'rpi3' || matrix.platform == 'rpi4' || matrix.platform == 'rpi5' || matrix.platform == 'tinkerboard'
        uses: shogo82148/actions-upload-release-asset@v1
        with:
          upload_url: ${{ needs.release_draft.outputs.upload_url }}
          asset_path: release/thinroot-${{ needs.release_draft.outputs.version }}-${{ matrix.platform }}-kernel.img.sha256
          asset_content_type: text/plain

      #######################
      # manifest file artifact upload
      - name: Upload manifest artifact
        uses: actions/upload-artifact@v7
        with:
          path: release/thinroot-${{ needs.release_draft.outputs.version }}-${{ matrix.platform }}.mf
          name: thinroot-${{ needs.release_draft.outputs.version }}-${{ matrix.platform }}.mf

      # cleanup
      - name: Cleanup
        run: |
          make clean-all
          rm -rf release/thinroot-* buildroot-????.*

  ##########################################
  # Update checksums in release draft
  update-checksums:
    permissions:
      contents: write  # ncipollo/release-action
    name: Update checksums
    runs-on: ubuntu-24.04
    needs: [release_draft, build]

    steps:
      - uses: actions/checkout@v7

      # download all artifact files
      - name: Download all workflow artifacts
        uses: actions/download-artifact@v8

      - name: Patch release draft
        shell: bash
        run: |
          for f in */*.mf; do
            while read -r line; do
              NEEDLE=$(echo "${line}" | awk '{print $3}' | cut -d'-' -f3-)
              SHACKS=$(echo "${line}" | awk '{print $2}')
              sed -i "s/XSHA${NEEDLE}X/${SHACKS}/" release-template.md/release-template.md
            done < <(cat ${f})
          done

      - name: Update release draft
        uses: ncipollo/release-action@v1.21.0
        with:
          tag: ${{ needs.release_draft.outputs.tag }}
          bodyFile: release-template.md/release-template.md
          allowUpdates: true
          draft: true
          prerelease: false
          omitNameDuringUpdate: true
          omitPrereleaseDuringUpdate: true
          token: ${{ secrets.GITHUB_TOKEN }}