release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: 'Existing tag to build and publish, for example v3.0.1'
        required: true
        type: string
      source_ref:
        description: 'Optional commit or ref to build instead of the release tag'
        required: false
        type: string
  workflow_call:
    inputs:
      release_tag:
        description: 'Release tag to publish, for example v3.0.1'
        required: true
        type: string
      source_ref:
        description: 'Commit or ref containing the validated source to build'
        required: true
        type: string

permissions:
  contents: write

concurrency:
  # Reusable and manual invocations for the same version share one lane.
  group: release-${{ inputs.release_tag || github.ref_name || github.run_id }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      VERSION: ${{ inputs.release_tag || github.ref_name }}
      SOURCE_REF: ${{ inputs.source_ref || inputs.release_tag || github.ref }}
    steps:
      - name: Checkout release source
        uses: actions/checkout@v5
        with:
          ref: ${{ inputs.source_ref || inputs.release_tag || github.ref }}
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Build frontend
        working-directory: frontend
        env:
          VITE_APP_VERSION: ${{ inputs.release_tag || github.ref_name }}
        run: |
          npm ci
          npm run build

      - name: Build release assets
        shell: bash
        run: |
          set -euo pipefail

          version="${VERSION#v}"
          mkdir -p dist build

          build_target() {
            local goos="$1"
            local goarch="$2"
            local archive_base="codex2api_${version}_${goos}_${goarch}"
            local workdir="build/${goos}_${goarch}"
            local binary_name="codex2api"

            rm -rf "$workdir"
            mkdir -p "$workdir"

            if [[ "$goos" == "windows" ]]; then
              binary_name="codex2api.exe"
            fi

            CGO_ENABLED=0 GOOS="$goos" GOARCH="$goarch" go build -trimpath -ldflags="-s -w -X github.com/codex2api/internal/version.Version=${VERSION}" -o "$workdir/$binary_name" .

            cp .env.example "$workdir/.env.example"
            cp README.md "$workdir/README.md"

            if [[ "$goos" == "windows" ]]; then
              (
                cd "$workdir"
                zip -r "../../dist/${archive_base}.zip" .
              )
            else
              tar -C "$workdir" -czf "dist/${archive_base}.tar.gz" .
            fi
          }

          build_target linux amd64
          build_target linux arm64
          build_target darwin amd64
          build_target darwin arm64
          build_target windows amd64

          (
            cd dist
            sha256sum * > SHA256SUMS.txt
          )

      - name: Prepare release notes
        shell: bash
        run: |
          set -euo pipefail

          notes_file="$RUNNER_TEMP/codex2api-release-notes.md"
          # main carries upstream's README, which has no fork maintenance
          # section. The notes live on the custom commit being released.
          maintenance_file="docs/custom-maintenance.md"
          version="$VERSION"
          previous_tag="$(git tag --sort=-version:refname \
            | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
            | grep -Fxv "$version" \
            | head -n 1 || true)"

          if [[ ! -f "$maintenance_file" ]]; then
            # Tags cut before this file existed must still be rebuildable.
            # A present file with a missing heading is a broken custom tree
            # and still fails the release.
            echo "Release source has no ${maintenance_file}; publishing without fork maintenance notes." >&2
            printf '%s\n' \
              '## Custom maintenance' \
              '' \
              '_This release commit has no docs/custom-maintenance.md._' \
              '' \
              '## 自定义维护内容' \
              '' \
              '_该发布提交没有 docs/custom-maintenance.md。_' \
              > "$notes_file"
          else
            awk '
              /^## Custom maintenance$/ { in_section=1 }
              in_section && /^## / && $0 != "## Custom maintenance" { exit }
              in_section { print }
            ' "$maintenance_file" > "$notes_file"

            printf '\n---\n\n' >> "$notes_file"
            awk '
              /^## 自定义维护内容$/ { in_section=1 }
              in_section && /^## / && $0 != "## 自定义维护内容" { exit }
              in_section { print }
            ' "$maintenance_file" >> "$notes_file"

            if ! grep -q '^## Custom maintenance$' "$notes_file" \
              || ! grep -q '^## 自定义维护内容$' "$notes_file"; then
              echo "Custom maintenance sections were empty in ${maintenance_file}." >&2
              exit 1
            fi
          fi

          printf '\n## Custom changes in this release\n\n' >> "$notes_file"
          custom_commits=""
          if [[ -n "$previous_tag" ]]; then
            custom_commits="$(git log --first-parent --format='- %s' \
              "$previous_tag..$SOURCE_REF" -- \
              ':!CHANGELOG.md' ':!docs/**' ':!.github/**' \
              | grep -Ev '^- (Merge pull request|chore: sync upstream release|ci:)' || true)"
          fi
          if [[ -n "$custom_commits" ]]; then
            printf '%s\n' "$custom_commits" >> "$notes_file"
          else
            printf '%s\n' '- No additional custom code changes were recorded for this release.' >> "$notes_file"
          fi

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.release_tag || github.ref_name }}
          target_commitish: ${{ inputs.source_ref || github.sha }}
          body_path: ${{ runner.temp }}/codex2api-release-notes.md
          generate_release_notes: true
          files: |
            dist/*.tar.gz
            dist/*.zip
            dist/SHA256SUMS.txt