release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release'
        required: false

jobs:
  verify:
    name: Verify Release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.extract.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Extract and verify version
        id: extract
        run: |
          TAG=${GITHUB_REF#refs/tags/}
          VERSION=${TAG#v}
          echo "version=$VERSION" >> $GITHUB_OUTPUT

          FILE_VERSION=$(cat VERSION)
          if [ "$VERSION" != "$FILE_VERSION" ]; then
            echo "ERROR: Tag version ($VERSION) doesn't match VERSION file ($FILE_VERSION)"
            exit 1
          fi
          echo "✓ Version verified: $VERSION"

  security-checks:
    name: Security Checks
    needs: verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run security scans
        run: |
          echo "Running security checks..."
          # shellcheck bootstrap.sh || true
          echo "✓ Security checks completed"

  build-assets:
    name: Build Release Assets
    needs: [verify, security-checks]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Generate checksums
        run: |
          sha256sum bootstrap.sh > bootstrap.sha256
          sha256sum scripts/install.sh > install.sha256
          ls -lh *.sha256

      - name: Create release notes
        run: |
          VERSION=${{ needs.verify.outputs.version }}
          if grep -q "## \[$VERSION\]" CHANGELOG.md; then
            sed -n "/## \[$VERSION\]/,/## \[/p" CHANGELOG.md | head -n -1 > RELEASE_NOTES.md
          else
            echo "## Release v$VERSION" > RELEASE_NOTES.md
          fi

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-assets
          path: |
            *.sha256
            RELEASE_NOTES.md

  publish-release:
    name: Publish Release
    needs: [verify, build-assets]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4

      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: release-assets

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v1
        with:
          tag_name: v${{ needs.verify.outputs.version }}
          body_path: RELEASE_NOTES.md
          files: |
            *.sha256
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # Verify tag and create release (OLD)
  create-release:
    name: Create Release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      changelog: ${{ steps.changelog.outputs.changelog }}
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Extract version from tag
      id: version
      run: |
        VERSION=${GITHUB_REF#refs/tags/}
        echo "version=${VERSION}" >> $GITHUB_OUTPUT
        echo "Version: ${VERSION}"

    - name: Generate changelog
      id: changelog
      run: |
        echo "changelog<<EOF" >> $GITHUB_OUTPUT
        echo "## Changes in ${{ steps.version.outputs.version }}" >> $GITHUB_OUTPUT
        echo "" >> $GITHUB_OUTPUT
        # Get commits since last tag
        PREV_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
        if [ -z "$PREV_TAG" ]; then
          git log --pretty=format:"- %h: %s" --no-decorate | head -20 >> $GITHUB_OUTPUT
        else
          git log ${PREV_TAG}..HEAD --pretty=format:"- %h: %s" --no-decorate >> $GITHUB_OUTPUT
        fi
        echo "EOF" >> $GITHUB_OUTPUT

    - name: Create GitHub Release
      uses: actions/create-release@v1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        tag_name: ${{ steps.version.outputs.version }}
        release_name: Devkit ${{ steps.version.outputs.version }}
        body: ${{ steps.changelog.outputs.changelog }}
        draft: false
        prerelease: false

  # Build and publish artifacts
  build-artifacts:
    name: Build Artifacts
    runs-on: ubuntu-latest
    needs: create-release
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Create distribution files
      run: |
        mkdir -p dist/
        cp bootstrap.sh dist/
        cp verify-setup.sh dist/
        cp README.md dist/
        cp LICENSE dist/

    - name: Create tarball
      run: |
        tar -czf dist/devkit-${{ needs.create-release.outputs.version }}.tar.gz dist/
        sha256sum dist/devkit-${{ needs.create-release.outputs.version }}.tar.gz > dist/CHECKSUMS.txt

    - name: Upload to release
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        upload_url: ${{ needs.create-release.outputs.upload_url }}
        asset_path: ./dist/devkit-${{ needs.create-release.outputs.version }}.tar.gz
        asset_name: devkit-${{ needs.create-release.outputs.version }}.tar.gz
        asset_content_type: application/gzip

    - name: Upload checksums
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        upload_url: ${{ needs.create-release.outputs.upload_url }}
        asset_path: ./dist/CHECKSUMS.txt
        asset_name: CHECKSUMS.txt
        asset_content_type: text/plain

  # Update documentation
  update-docs:
    name: Update Documentation
    runs-on: ubuntu-latest
    needs: [create-release, build-artifacts]
    if: success()
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Update CHANGELOG.md
      run: |
        VERSION=${{ needs.create-release.outputs.version }}
        DATE=$(date '+%Y-%m-%d')
        {
          echo "## [$VERSION] - $DATE"
          echo ""
          echo "${{ needs.create-release.outputs.changelog }}"
          echo ""
          tail -n +2 CHANGELOG.md
        } > CHANGELOG.md.tmp
        mv CHANGELOG.md.tmp CHANGELOG.md

    - name: Commit and push changelog update
      run: |
        git config user.name "GitHub Actions"
        git config user.email "actions@github.com"
        git add CHANGELOG.md
        git commit -m "chore: update changelog for ${{ needs.create-release.outputs.version }}" || true
        git push origin main || true

  # Release notifications
  notify-release:
    name: Notify Release
    runs-on: ubuntu-latest
    needs: [create-release, build-artifacts, update-docs]
    if: success()
    steps:
    - name: Print release info
      run: |
        echo "════════════════════════════════════════════════════"
        echo "Release Created Successfully!"
        echo "════════════════════════════════════════════════════"
        echo "Version: ${{ needs.create-release.outputs.version }}"
        echo "GitHub Release: https://github.com/vietcgi/devkit/releases/tag/${{ needs.create-release.outputs.version }}"
        echo ""
        echo "Installation:"
        echo "  git clone https://github.com/vietcgi/devkit.git"
        echo "  cd devkit"
        echo "  ./bootstrap.sh"
        echo ""
        echo "════════════════════════════════════════════════════"