release.yml

name: release

on:
  workflow_dispatch:
  push:
    tags:
      - "*"

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  id-token: write
  contents: write
  packages: write

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Setup Bun
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: latest

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Login to GHCR
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Fetch tags
        run: git fetch --force --tags

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: ">=1.23.2"
          cache: true

      - name: Setup QEMU
        uses: docker/setup-qemu-action@v3

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Download Go modules
        run: go mod download

      - name: Install dependencies
        run: bun i --frozen-lockfile

      - name: TypeScript check
        run: cd platform && bun tsc --noEmit

      - name: Build platform
        run: ./platform/scripts/build
        env:
          DOCKER_PUSH: true

      - name: Setup uv
        uses: astral-sh/setup-uv@v4
        with:
          version: "latest"

      - name: Run Go tests
        run: go test -vet=all ./...

      - name: Release CLI
        uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser
          version: latest
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.SST_GITHUB_TOKEN }}
          AUR_KEY: ${{ secrets.AUR_KEY }}

      - name: Release JS SDK
        run: |
          cd sdk/js
          bun run release

      - name: Authenticate crates.io
        id: crates-auth
        uses: rust-lang/crates-io-auth-action@v1

      - name: Release Rust SDK
        run: |
          VERSION=$(jq -r .version dist/metadata.json)
          cd sdk/rust
          sed -i "s/^version = \".*\"/version = \"$VERSION\"/" Cargo.toml
          cargo publish --allow-dirty
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates-auth.outputs.token }}

      - name: Build Python SDK
        run: |
          VERSION=$(jq -r .version dist/metadata.json)
          cd sdk/python
          sed -i "s/^version = \".*\"/version = \"$VERSION\"/" pyproject.toml
          uv build

      - name: Publish Python SDK
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: sdk/python/dist/

      - name: Announce on Discord
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
          TAG: ${{ github.ref_name }}
        run: |
          RELEASE_URL="https://github.com/${{ github.repository }}/releases/tag/$TAG"
          NOTES=$(gh release view "$TAG" --json body --jq .body \
            | sed -E "s|\(#([0-9]+)\)|([#\1](https://github.com/${{ github.repository }}/pull/\1))|g" \
            | sed -E 's|^\* \[[a-f0-9]+\]\([^)]+\): ||' \
            | sed '/^## Changelog$/d' \
            | sed -E 's|^(.+)$|- \1|')
          CONTENT=$(printf '🏷️ [**Release - %s**](%s)\n%s' "$TAG" "$RELEASE_URL" "$NOTES")
          PAYLOAD=$(jq -n --arg c "$CONTENT" '{content:$c, flags:4}')
          curl -fsS -X POST -H "Content-Type: application/json" \
            -d "$PAYLOAD" "$DISCORD_WEBHOOK_URL"