nuntius/.gitea/workflows/release.yml

# Release — Go binaries. Runs on version tags (v1.2.3) pushed to main.
# Builds the platform matrix, creates the Gitea release, uploads binaries.
name: Release

on:
  push:
    tags: ["v*"]

jobs:
  build:
    runs-on: fedora
    strategy:
      fail-fast: false
      matrix:
        include:
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64
          - goos: linux
            goarch: riscv64
          - goos: linux
            goarch: loong64
          - goos: freebsd
            goarch: amd64
          - goos: freebsd
            goarch: arm64
          - goos: freebsd
            goarch: riscv64
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-go@v6
        with:
          go-version: "1.26"

      - name: Download dependencies
        run: go mod download

      - name: Validate tag and build
        id: build
        env:
          VERSION: ${{ gitea.ref_name }}
        run: |
          set -euo pipefail

          if ! echo "$VERSION" | grep -qE '^v[0-9]+(\.[0-9]+){0,2}([-+].*)?$'; then
            echo "ERROR: expected a semver tag like v1.2.3, got: '$VERSION'"
            exit 1
          fi

          VERSION_NO_V="${VERSION#v}"
          echo "version_no_v=${VERSION_NO_V}" >> "$GITEA_OUTPUT"

          # The tag is the source of truth — inject it into the binary.
          LDFLAGS="-s -w -X sourcedock.dev/petrbalvin/nuntius/internal/version.Version=${VERSION_NO_V}"
          mkdir -p bin
          GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} CGO_ENABLED=0 \
            go build -ldflags "$LDFLAGS" \
              -o "bin/nuntius-${VERSION_NO_V}-${{ matrix.goos }}-${{ matrix.goarch }}" \
              ./cmd/server

      # Artifacts stay on v3 — v4 detects Gitea as GHES and aborts.
      - name: Upload artifact
        uses: actions/upload-artifact@v3
        with:
          name: nuntius-${{ matrix.goos }}-${{ matrix.goarch }}
          path: bin/nuntius-${{ steps.build.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }}
          if-no-files-found: error

      # Only binaries matching the runner can be smoke-tested.
      - name: Smoke test
        if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
        run: |
          chmod +x bin/nuntius-${{ steps.build.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }}
          ./bin/nuntius-${{ steps.build.outputs.version_no_v }}-${{ matrix.goos }}-${{ matrix.goarch }} --version

  release:
    runs-on: fedora
    needs: build
    permissions:
      releases: write
    steps:
      - uses: actions/checkout@v7

      - name: Download all artifacts
        uses: actions/download-artifact@v3
        with:
          path: dist

      - name: Extract CHANGELOG section
        env:
          VERSION: ${{ gitea.ref_name }}
        run: |
          set -euo pipefail
          VERSION_NO_V="${VERSION#v}"
          echo "Looking for CHANGELOG section: ${VERSION_NO_V}"

          sed -n "/^## \[${VERSION_NO_V}\] /,/^## \[/p" CHANGELOG.md \
            | sed '$d' \
            | tail -n +2 \
            > release-body.md

          if [ ! -s release-body.md ]; then
            echo "ERROR: no CHANGELOG section found for ${VERSION_NO_V}"
            echo "Expected a heading like: ## [${VERSION_NO_V}] — YYYY-MM-DD"
            exit 1
          fi

          echo "Release body preview:"
          head -n 20 release-body.md

      - name: Create release
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          GITEA_SERVER_URL: ${{ gitea.server_url }}
          GITEA_REPOSITORY: ${{ gitea.repository }}
          GITEA_REF_NAME: ${{ gitea.ref_name }}
        run: |
          set -euo pipefail
          BODY=$(sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\t/\\t/g' -e 's/\r//g' release-body.md | sed ':a;N;$!ba;s/\n/\\n/g')
          BODY="\"${BODY}\""

          response=$(curl -sS -w '\n%{http_code}' \
            -H "Authorization: token ${GITEA_TOKEN}" \
            -H "Content-Type: application/json" \
            -X POST \
            "${GITEA_SERVER_URL}/api/v1/repos/${GITEA_REPOSITORY}/releases" \
            -d "{\"tag_name\":\"${GITEA_REF_NAME}\",\"name\":\"${GITEA_REF_NAME}\",\"body\":${BODY},\"draft\":false,\"prerelease\":false}")

          http_code=$(echo "$response" | tail -1)
          payload=$(echo "$response" | sed '$d')

          echo "HTTP ${http_code}"
          if [ "$http_code" != "201" ]; then
            echo "Failed to create release: ${payload}"
            exit 1
          fi

          RELEASE_ID=$(echo "$payload" | grep -oE '"id"[[:space:]]*:[[:space:]]*[0-9]+' | head -1 | grep -oE '[0-9]+')
          echo "Created release ID=${RELEASE_ID}"
          printf '%s' "${RELEASE_ID}" > release-id.txt

      - name: Upload assets
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          GITEA_SERVER_URL: ${{ gitea.server_url }}
          GITEA_REPOSITORY: ${{ gitea.repository }}
          GITEA_REF_NAME: ${{ gitea.ref_name }}
        run: |
          set -euo pipefail
          RELEASE_ID=$(cat release-id.txt)
          echo "Release ID: ${RELEASE_ID}"

          for binary in dist/nuntius-*/nuntius-*; do
            [ -f "$binary" ] || continue
            fname=$(basename "$binary")
            echo "Uploading ${fname}..."
            http_code=$(curl -sS -o /dev/null -w '%{http_code}' \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/octet-stream" \
              -X POST \
              --data-binary "@${binary}" \
              "${GITEA_SERVER_URL}/api/v1/repos/${GITEA_REPOSITORY}/releases/${RELEASE_ID}/assets?name=${fname}")
            echo "  HTTP ${http_code}"
            if [ "$http_code" != "201" ]; then
              echo "Failed to upload ${fname}"
              exit 1
            fi
          done

          echo
          echo "Release ${GITEA_REF_NAME} is live with the following assets:"
          ls -lh dist/nuntius-*/