release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      run:
        description: 'The Package workflow run to release'
        required: true
      dry-run:
        description: 'If true, the workflow only indicates which artifacts would be uploaded'
        required: true
        type: boolean
        default: true
  workflow_call:
    inputs:
      dispatch:
        description: "Marker to indicate that the workflow was dispatched via workflow_call"
        type: string
        required: false
        default: "workflow_call"
      dry-run:
        description: 'If true, the workflow only indicates which artifacts would be uploaded'
        required: true
        type: boolean
        default: true

concurrency: gateway-release

jobs:
  preflight:
    name: Preflight
    runs-on: ubuntu-20.04
    outputs:
      run: ${{ steps.get-run.outputs.run }}
      version: ${{ steps.get-version.outputs.version }}
      skip-publishing: ${{ steps.check-release.outputs.skip-publishing }}

    steps:
      ## workflow_dispatch: The run_id is read from the inputs
      ## workflow_call:     The run_id is the current run_id
      - name: Get run
        id: get-run
        shell: pwsh
        run: |
          if ('${{ github.event.inputs.run }}') {
            echo "run=${{ github.event.inputs.run }}" >> $Env:GITHUB_OUTPUT
          } else {
            echo "run=${{ github.run_id }}" >> $Env:GITHUB_OUTPUT
          }

      - name: Get dry run
        id: get-dry-run
        shell: pwsh
        run: |
          $DryRun = "false"
          if ('${{ inputs.dry-run }}') {
            $DryRun = "${{ inputs.dry-run }}"
          }

          if ([System.Convert]::ToBoolean($DryRun)) {
            echo "::notice::This is a dry run; publishing will be skipped"
          } else {
            echo "::warning::This is not a dry run, release will be published!"
          }

      - name: Download version
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh run download ${{ steps.get-run.outputs.run }} -n version --repo $Env:GITHUB_REPOSITORY

      - name: Get version
        id: get-version
        shell: pwsh
        run: |
          $Version = Get-Content VERSION -TotalCount 1
          echo "version=$Version" >> $Env:GITHUB_OUTPUT
          echo "::notice::Releasing artifacts for version $Version from run ${{ steps.get-run.outputs.run }}"

      ## If we already released this version to GitHub, publishing will be skipped
      - name: Check GitHub releases
        id: check-release
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          $Output = (gh release list --repo $Env:GITHUB_REPOSITORY) | Out-String
          $Releases = ( $Output -split '\r?\n' ).Trim()
          $Versions = ForEach($Release in $Releases) {
              $Version = ( $Release -Split '\s+' ).Trim()
              $Version = $Version.TrimStart("v")
              $Version[0]
          }

          $SkipPublishing = 'false'
          if ($Versions -Contains "${{ steps.get-version.outputs.version }}") {
            echo "::warning::GitHub already has a release version ${{ steps.get-version.outputs.version }}; publishing will be skipped"
            $SkipPublishing = 'true'
          }
          echo "skip-publishing=$SkipPublishing" >> $Env:GITHUB_OUTPUT

  containers:
    name: Containers [${{ matrix.os }} ${{ matrix.base-image }}]
    runs-on: ${{ matrix.runner }}
    environment: publish-prod
    needs: preflight
    if: needs.preflight.outputs.skip-publishing == 'false' || ${{ inputs.dry-run }}
    strategy:
      matrix:
        arch: [ x86_64 ]
        os: [ windows, linux ]
        base-image: [debian-bullseye-slim, windowsservercore-ltsc2022, lts-nanoserver-ltsc2022 ]

        include:
          - os: windows
            runner: windows-2022
          - os: linux
            runner: ubuntu-20.04
        exclude:
          - os: windows
            base-image: debian-bullseye-slim
          - os: linux
            base-image: windowsservercore-ltsc2022
          - os: linux
            base-image: lts-nanoserver-ltsc2022

    steps:
      - name: Download artifacts
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh run download ${{ needs.preflight.outputs.run }} -n webapp-client -n docker -n devolutions-gateway -n native-libs --repo $Env:GITHUB_REPOSITORY

      ## workflow_call: The same artifacts persist across the entire run, so the PowerShell/DevolutionsGateway directory will still exist from the CI workflow
      - name: Manage artifacts
        shell: pwsh
        run: Remove-Item (Join-Path devolutions-gateway PowerShell DevolutionsGateway) -Recurse -ErrorAction Ignore

      - name: Prepare artifacts
        id: prepare-artifacts
        shell: pwsh
        run: |
          $PkgDir = Join-Path docker $Env:RUNNER_OS # RUNNER_OS is camelcase
          echo "package-path=$PkgDir" >> $Env:GITHUB_OUTPUT

          $SourceFileName = "DevolutionsGateway_$($Env:RUNNER_OS)_${{ needs.preflight.outputs.version }}_${{ matrix.arch }}"

          if ($Env:RUNNER_OS -eq "Windows") {
            $SourceFileName = "$($SourceFileName).exe"
            $TargetFileName = "DevolutionsGateway.exe"
          } else {
            $TargetFileName = "devolutions-gateway"
          }

          $SourcePath = Get-ChildItem -Recurse -Filter $SourceFileName -File -Path devolutions-gateway
          $TargetPath = Join-Path $PkgDir $TargetFileName
          Copy-Item $SourcePath $TargetPath

          if ($Env:RUNNER_OS -eq "Linux") {
            Invoke-Expression "chmod +x $TargetPath"
          }

          $XmfFileName = "libxmf.so"

          if ($Env:RUNNER_OS -eq "Windows") {
            $XmfFileName = "xmf.dll"
          }

          $XmfSourcePath = Get-ChildItem -Recurse -Filter $XmfFileName -File -Path native-libs
          $XmfTargetPath = Join-Path $PkgDir $XmfFileName
          Copy-Item $XmfSourcePath $XmfTargetPath

          $WebAppArchive = Get-ChildItem -Recurse -Filter "devolutions_gateway_webapp_*.tar.gz" | Select-Object -First 1
          $TargetPath = Join-Path $PkgDir "webapp" "client"
          New-Item -ItemType Directory -Path $TargetPath
          tar -xvzf $WebAppArchive.FullName -C $TargetPath --strip-components=1

          $PowerShellArchive = Get-ChildItem -Recurse -Filter "Devolutionsgateway-ps-*.zip" | Select-Object -First 1
          Expand-Archive $PowerShellArchive -DestinationPath "$PkgDir"

      - name: Build container
        id: build-container
        shell: pwsh
        working-directory: ${{ steps.prepare-artifacts.outputs.package-path }}
        run: |
          $ImageName = "devolutions/devolutions-gateway:${{ needs.preflight.outputs.version }}-${{ matrix.base-image }}"
          if ("${{ matrix.base-image }}" -Eq "lts-nanoserver-ltsc2022") {
            docker build --build-arg FROM_IMAGE=mcr.microsoft.com/powershell:lts-nanoserver-ltsc2022 -t "$ImageName" .
          } else {
            docker build -t "$ImageName" .
          }
          echo "image-name=$ImageName" >> $Env:GITHUB_OUTPUT
          Get-ChildItem -Recurse

      - name: Push container
        shell: pwsh
        working-directory: ${{ steps.prepare-artifacts.outputs.package-path }}
        run: |
          echo ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }} | docker login -u devolutionsbot --password-stdin
          $DockerPushCmd = 'docker push ${{ steps.build-container.outputs.image-name }}'
          Write-Host $DockerPushCmd

          $DryRun = [System.Convert]::ToBoolean('${{ inputs.dry-run }}')
          if (-Not $DryRun) {
            Invoke-Expression $DockerPushCmd
          }

  github-release:
    name: GitHub release
    runs-on: ubuntu-20.04
    environment: publish-prod
    needs: preflight
    if: needs.preflight.outputs.skip-publishing == 'false' || ${{ inputs.dry-run }}

    steps:
      - name: Configure runner
        run: cargo install parse-changelog

      - name: Download artifacts
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh run download ${{ needs.preflight.outputs.run }} -n jetsocat -n devolutions-gateway -n devolutions-agent -n webapp-client -n changelog --repo $Env:GITHUB_REPOSITORY

      - name: Manage artifacts
        shell: pwsh
        run: |
          # workflow_call: The same artifacts persist across the entire run, so the PowerShell/DevolutionsGateway directory will still exist from the CI workflow
          Remove-Item (Join-Path devolutions-gateway PowerShell DevolutionsGateway) -Recurse -ErrorAction Ignore

      - name: Create GitHub release
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          $Version = "${{ needs.preflight.outputs.version }}"
          $HashPath = 'checksums'
          $Files = Get-ChildItem -Recurse -File -Exclude 'CHANGELOG.md' | % { Get-FileHash -Algorithm SHA256 $_.FullName }
          $Files | % { "$($_.Hash)  $(Split-Path $_.Path -leaf)" } | Out-File -FilePath $HashPath -Append -Encoding ASCII

          echo "::group::checksums"
          Get-Content $HashPath
          echo "::endgroup::"

          $ChangesPath = 'changes'
          parse-changelog $(Join-Path changelog CHANGELOG.md) $Version | Out-File -Encoding UTF8NoBOM $ChangesPath

          echo "::group::changes"
          Get-Content $ChangesPath
          echo "::endgroup::"

          $GhCmd = $(@('gh', 'release', 'create', "v$Version", "--repo", $Env:GITHUB_REPOSITORY, "--notes-file", $ChangesPath, $HashPath) + $Files.Path) -Join ' '
          Write-Host $GhCmd

          $DryRun =  [System.Convert]::ToBoolean('${{ inputs.dry-run }}')
          if (-Not $DryRun) {
            Invoke-Expression $GhCmd
          }

  psgallery-release:
    name: PowerShell release
    runs-on: ubuntu-20.04
    environment: publish-prod
    needs: preflight
    if: needs.preflight.outputs.skip-publishing == 'false' || ${{ inputs.dry-run }}

    steps:
      - name: Download artifacts
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh run download ${{ needs.preflight.outputs.run }} -n devolutions-gateway --repo $Env:GITHUB_REPOSITORY

      ## workflow_call: The same artifacts persist across the entire run, so the PowerShell/DevolutionsGateway directory will still exist from the CI workflow
      - name: Manage artifacts
        shell: pwsh
        run: Remove-Item (Join-Path PowerShell DevolutionsGateway) -Recurse -ErrorAction Ignore

      - name: Publish PowerShell module
        shell: pwsh
        run: |
          $Archive = Get-ChildItem -Recurse -Filter "*-ps-*.zip" -File
          Expand-Archive -Path $Archive -DestinationPath 'PowerShell'

          $PublishCmd = @('Publish-Module', '-Force', '-Path', (Join-Path PowerShell DevolutionsGateway), '-NugetApiKey', '${{ secrets.PS_GALLERY_NUGET_API_KEY }}')

          $DryRun = [System.Convert]::ToBoolean('${{ inputs.dry-run }}')
          if ($DryRun) {
            $PublishCmd += '-WhatIf'
          }
          $PublishCmd = $PublishCmd -Join ' '
          Write-Host $PublishCmd

          try {
            Invoke-Expression $PublishCmd
          }
          catch {
            if ($_.Exception.Message -ilike "*cannot be published as the current version*is already available in the repository*") {
              echo "::warning::PowerShell module not published; this version is already listed on PSGallery"
            } else {
              Write-Error $_
              exit 1
            }
          }

  onedrive-gateway:
    name: OneDrive (Devolutions Gateway)
    runs-on: ubuntu-20.04
    needs: preflight
    if: needs.preflight.outputs.skip-publishing == 'false' || ${{ inputs.dry-run }}

    steps:
      - name: Check out Devolutions/actions
        uses: actions/checkout@v4
        with:
          repository: Devolutions/actions
          ref: v1
          token: ${{ secrets.DEVOLUTIONSBOT_TOKEN }}
          path: ./.github/workflows

      ## Devolutions Toolbox is required for OneDrive uploading

      - name: Install Devolutions Toolbox
        uses: ./.github/workflows/toolbox-install
        with:
          github_token: ${{ secrets.DEVOLUTIONSBOT_TOKEN }}

      - name: Download artifacts
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh run download ${{ needs.preflight.outputs.run }} -n devolutions-gateway --repo $Env:GITHUB_REPOSITORY

      - name: Prepare upload
        id: prepare
        shell: pwsh
        run: |
          $destinationFolder = "${{ runner.temp }}/artifacts"
          $version="${{ needs.preflight.outputs.version }}"
          # Note that ".0" is appended here (required by release tooling downstream)
          $versionFull="$version.0"

          echo "version=${versionFull}" >> $Env:GITHUB_OUTPUT
          echo "files-to-upload=$destinationFolder" >> $Env:GITHUB_OUTPUT

          New-Item -Path "$destinationFolder" -ItemType "directory"

          Move-Item -Path "./windows/x86_64/DevolutionsGateway-x86_64-${version}.msi" -Destination "$destinationFolder/DevolutionsGateway-x86_64-${versionFull}.msi"
          Move-Item -Path "./windows/x86_64/DevolutionsGateway_Windows_${version}_x86_64.pdb" -Destination "$destinationFolder/DevolutionsGateway-x86_64-${versionFull}.pdb"

          # Note that at this point the deb package is already named using the ".0" suffix.
          Move-Item -Path "./linux/x86_64/devolutions-gateway_${versionFull}_amd64.deb" -Destination "$destinationFolder/devolutions-gateway_${versionFull}_amd64.deb"

      - name: Upload to OneDrive
        uses: ./.github/workflows/onedrive-upload
        if: (needs.preflight.outputs.skip-publishing == 'false') && (inputs.dry-run == false)
        with:
          azure_client_id: ${{ secrets.ONEDRIVE_AUTOMATION_CLIENT_ID }}
          azure_client_secret: ${{ secrets.ONEDRIVE_AUTOMATION_CLIENT_SECRET }}
          conflict_behavior: fail
          destination_path: /Gateway/${{ steps.prepare.outputs.version }}
          remote: releases
          source_path: ${{ steps.prepare.outputs.files-to-upload }}

  onedrive-agent:
    name: OneDrive (Devolutions Agent)
    runs-on: ubuntu-20.04
    needs: preflight
    if: needs.preflight.outputs.skip-publishing == 'false' || ${{ inputs.dry-run }}

    steps:
      - name: Check out Devolutions/actions
        uses: actions/checkout@v4
        with:
          repository: Devolutions/actions
          ref: v1
          token: ${{ secrets.DEVOLUTIONSBOT_TOKEN }}
          path: ./.github/workflows

      ## Devolutions Toolbox is required for OneDrive uploading

      - name: Install Devolutions Toolbox
        uses: ./.github/workflows/toolbox-install
        with:
          github_token: ${{ secrets.DEVOLUTIONSBOT_TOKEN }}

      - name: Download artifacts
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh run download ${{ needs.preflight.outputs.run }} -n devolutions-agent --repo $Env:GITHUB_REPOSITORY

      - name: Prepare upload
        id: prepare
        shell: pwsh
        run: |
          $destinationFolder = "${{ runner.temp }}/artifacts"
          $version="${{ needs.preflight.outputs.version }}"
          # Note that ".0" is appended here (required by release tooling downstream)
          $versionFull="$version.0"

          echo "version=${versionFull}" >> $Env:GITHUB_OUTPUT
          echo "files-to-upload=$destinationFolder" >> $Env:GITHUB_OUTPUT

          New-Item -Path "$destinationFolder" -ItemType "directory"

          Move-Item -Path "./windows/x86_64/DevolutionsAgent-x86_64-${version}.msi" -Destination "$destinationFolder/DevolutionsAgent-x86_64-${versionFull}.msi"
          Move-Item -Path "./windows/x86_64/DevolutionsAgent-x86_64-${version}.symbols.zip" -Destination "$destinationFolder/DevolutionsAgent-x86_64-${versionFull}.symbols.zip"

          # Note that at this point the deb package is already named using the ".0" suffix.
          Move-Item -Path "./linux/x86_64/devolutions-agent_${versionFull}_amd64.deb" -Destination "$destinationFolder/devolutions-agent_${versionFull}_amd64.deb"

      - name: Upload to OneDrive
        uses: ./.github/workflows/onedrive-upload
        if: (needs.preflight.outputs.skip-publishing == 'false') && (inputs.dry-run == false)
        with:
          azure_client_id: ${{ secrets.ONEDRIVE_AUTOMATION_CLIENT_ID }}
          azure_client_secret: ${{ secrets.ONEDRIVE_AUTOMATION_CLIENT_SECRET }}
          conflict_behavior: fail
          destination_path: /Agent/${{ steps.prepare.outputs.version }}
          remote: releases
          source_path: ${{ steps.prepare.outputs.files-to-upload }}

  remove-labels:
    name: Remove release-required labels
    runs-on: ubuntu-latest
    if: needs.preflight.outputs.skip-publishing == 'false' || ${{ inputs.dry-run }}
    needs:
      - containers
      - github-release
      - psgallery-release
      - onedrive-gateway
      - onedrive-agent

    steps:
      - name: Check out ${{ github.repository }}
        uses: actions/checkout@v4

      - name: Remove labels
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: ./ci/remove-labels.ps1 -Label 'release-required'