release.yml

name: "Continuous Deployment"

on:
  push:
    tags:
      - "**"

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    strategy:
      matrix:
        dependencies:
          - locked

    env:
      PHAR: "build/phar/captainhook.phar"
      PHAR_SIGNATURE: "build/phar/captainhook.phar.asc"
      GPG_KEYS: "build/captainhook-signing-keys.asc"
      GPG_KEYS_ENCRYPTED: "build/captainhook-signing-keys.asc.gpg"

    steps:
      - name: Checkout
        uses: actions/checkout@v2.0.0
        with:
          ref: main
          fetch-depth: 0

      - name: Install PHP with extensions
        uses: shivammathur/setup-php@v2
        with:
          coverage: none
          extensions: mbstring
          php-version: 8.0

      - name: Install dependencies
        run: composer install --prefer-dist --no-dev --no-interaction --no-progress

      - name: Install tooling
        run: "GITHUB_AUTH_TOKEN=${{ secrets.GITHUB_TOKEN }} tools/phive --no-progress --home ./.phive install --force-accept-unsigned --trust-gpg-keys 51C67305FFC2E5C0,4AA394086372C20A,31C7E470E2138192,8E730BA25823D8B5,CF1A108D0E7AE720,2DF45277AEF09A2F"

      - name: Validate configuration for humbug/box
        run: tools/box validate box.json

      - name: Force install Symfony 5
        if: ${{ matrix.buildphar }}
        run: COMPOSER=composer.phar.json composer update

      - name: Compile phar with humbug/box
        run: tools/box compile

      - name: Show info about generated phar with humbug/box
        run: tools/box info ${{ env.PHAR }}

      - name: Run phar
        run: ${{ env.PHAR }} --help

      - name: Show gpg version
        run: gpg --version

      - name: Decrypt signing key with gpg
        run: "gpg --batch --output ${{ env.GPG_KEYS }} --passphrase \"${{ secrets.GPG_DECRYPT_PASSPHRASE }}\" --yes --ignore-mdc-error --decrypt ${{ env.GPG_KEYS_ENCRYPTED }}"

      - name: Import keys with gpg
        run: "gpg --batch --import ${{ env.GPG_KEYS }}"

      - name: Sign phar with gpg
        run: "gpg --armor --local-user \"${{ secrets.GPG_KEY_EMAIL }}\" --output ${{ env.PHAR_SIGNATURE }} --passphrase \"${{ secrets.GPG_KEY_PASSPHRASE }}\" --pinentry-mode loopback --yes --detach-sig ${{ env.PHAR }}"

      - name: Verify signature with gpg
        run: "gpg --verify ${{ env.PHAR_SIGNATURE }} ${{ env.PHAR }}"

      - name: Remove decrypted keys
        run: "rm ${{ env.GPG_KEYS }}"

      - name: Determine tag
        id:  determine-tag
        run: "echo \"::set-output name=tag::${GITHUB_REF#refs/tags/}\""

      - name: Fetch all
        run: git fetch --all && git fetch --tags --force

      - name: Determine previous tag
        id: determine-prev-tag
        run: echo "##[set-output name=tag;]$(git describe --abbrev=0 ${{ steps.determine-tag.outputs.tag }})^"

      - name: Prepare release notes
        id: changelog
        run: |
          changelog=$(php build/release-notes)
          echo $changelog
          changelog="${changelog//'%'/'%25'}"
          changelog="${changelog//$'\n'/'%0A'}"
          changelog="${changelog//$'\r'/'%0D'}"
          echo "::set-output name=changelog::$changelog"

      - name: Check release notes
        run: "echo \"${{ steps.changelog.outputs.changelog }}\""

      - name: Create release
        id: create-release
        uses: actions/create-release@master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          draft: false
          prerelease: false
          tag_name: "${{ steps.determine-tag.outputs.tag }}"
          release_name: "${{ steps.determine-tag.outputs.tag }}"
          body: "${{ steps.changelog.outputs.changelog }}"

      - name: Upload captainhook.phar
        uses: actions/upload-release-asset@v1.0.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          asset_content_type: application/octet-stream
          asset_name: captainhook.phar
          asset_path: "${{ env.PHAR }}"
          upload_url: "${{ steps.create-release.outputs.upload_url }}"

      - name: Upload captainhook.phar.asc
        uses: actions/upload-release-asset@v1.0.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          asset_content_type: text/plain
          asset_name: captainhook.phar.asc
          asset_path: "${{ env.PHAR_SIGNATURE }}"
          upload_url: "${{ steps.create-release.outputs.upload_url }}"

      - name: Check out the phar repo
        uses: actions/checkout@v2
        with:
          repository: captainhookphp/captainhook-phar
          token: ${{ secrets.PAT_SF }}
          path: phar-repo

      - name: Tag and push the phar repo
        run: |
          cd phar-repo
          git config user.name "Sebastian Feldmann"
          git config user.email sebastianfeldmann@users.noreply.github.com
          git tag ${{ steps.determine-tag.outputs.tag }}
          git push --tags