release.yml

# NOTE: This name appears in GitHub's Checks API and in workflow's status badge.
name: release

# Trigger the workflow when:
on:
  # A push occurs to one of the matched tags.
  push:
    tags:
      # Pattern that roughly matches Oasis Core's version tags.
      # For more details on GitHub Actions' pattern match syntax, see:
      # https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#patterns-to-match-branches-and-tags.
      - "v[0-9]+.[0-9]+*"

# Global environment variables.
env:
  CURL_CMD: curl --proto =https --tlsv1.2 --location --silent --show-error --fail
  GORELEASER_URL_PREFIX: https://github.com/goreleaser/goreleaser/releases/download/
  GORELEASER_VERSION: 0.152.0
  JEMALLOC_URL_PREFIX: https://github.com/jemalloc/jemalloc/releases/download/
  JEMALLOC_VERSION: 5.2.1
  JEMALLOC_CHECKSUM: 34330e5ce276099e2e8950d9335db5a875689a4c6a56751ef3b1d8c537f887f6

jobs:
  prepare-release:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          # Fetch all history as the recommended way to fetch all tags and
          # branches of the project.
          # This allows the release helpers in common.mk to determine the
          # project's version from git correctly.
          # For more info, see:
          # https://github.com/actions/checkout#fetch-all-history-for-all-tags-and-branches
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.23.2"

      - name: Set up Rust
        run: rustup show

      - name: Install Oasis Node prerequisites
        run: |
          sudo apt-get update
          sudo apt-get install make libseccomp-dev protobuf-compiler

      - name: Install jemalloc
        run: |
          cd $(mktemp --directory /tmp/jemalloc.XXXXX)
          ${CURL_CMD} ${JEMALLOC_URL_PREFIX}/${JEMALLOC_VERSION}/jemalloc-${JEMALLOC_VERSION}.tar.bz2 \
            --output ${JEMALLOC_TARBALL}
          echo "${JEMALLOC_CHECKSUM} ${JEMALLOC_TARBALL}" | sha256sum --check
          tar -xf ${JEMALLOC_TARBALL}
          cd jemalloc-${JEMALLOC_VERSION}
          # Ensure reproducible jemalloc build.
          # https://reproducible-builds.org/docs/build-path/
          EXTRA_CXXFLAGS=-ffile-prefix-map=$(pwd -L)=. \
            EXTRA_CFLAGS=-ffile-prefix-map=$(pwd -L)=. \
            ./configure --with-jemalloc-prefix='je_' --with-malloc-conf='background_thread:true,metadata_thp:auto'
          make
          sudo make install
        env:
          JEMALLOC_TARBALL: jemalloc.tar.bz2

      - name: Install GoReleaser
        run: |
          cd $(mktemp --directory /tmp/goreleaser.XXXXX)
          ${CURL_CMD} ${GORELEASER_URL_PREFIX}/v${GORELEASER_VERSION}/${GORELEASER_TARBALL} \
            --output ${GORELEASER_TARBALL}
          ${CURL_CMD} ${GORELEASER_URL_PREFIX}/v${GORELEASER_VERSION}/goreleaser_checksums.txt \
            --output CHECKSUMS
          sha256sum --check --ignore-missing CHECKSUMS
          tar -xf ${GORELEASER_TARBALL}
          sudo mv goreleaser /usr/local/bin
        env:
          GORELEASER_TARBALL: goreleaser_Linux_x86_64.tar.gz

      - name: Set RELEASE_BRANCH name for stable/bugfix releases
        run: |
          GIT_VERSION=${GITHUB_REF#refs/tags/v}
          if [[ ! ${GIT_VERSION} =~ ^[0-9]+\.[0-9]+$ ]]; then
            echo "RELEASE_BRANCH=stable/${GIT_VERSION%.*}.x" >> $GITHUB_ENV
          fi

      - name: Build and publish the next release
        run: |
          make release-build
        env:
          # Make sure OpenSSL is built statically.
          OPENSSL_LIB_DIR: /usr/lib/x86_64-linux-gnu
          OPENSSL_INCLUDE_DIR: /usr/include
          OPENSSL_STATIC: yes
          # Instruct Make to create a real release.
          OASIS_CORE_REAL_RELEASE: "true"
          # Pass automatically created GitHub App installation token to the action.
          # For more info, see:
          # https://help.github.com/en/actions/automating-your-workflow-with-github-actions/authenticating-with-the-github_token.
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}