packaging.yaml

name: packaging

permissions:
  contents: read

on:
  push:
    branches:
      - 'release/**'
  workflow_dispatch:

jobs:
  package:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        target:
          - aarch64-unknown-linux-gnu
          - armv7-unknown-linux-gnueabihf
          - x86_64-unknown-linux-gnu
          - i686-unknown-linux-gnu
    steps:
      - name: Setup packaging tools for cross compiled artifacts
        uses: awalsh128/cache-apt-pkgs-action@a6c3917cc929dd0345bfb2d3feaf9101823370ad # v1.4.2
        with:
          packages: qemu-user-static crossbuild-essential-armhf crossbuild-essential-arm64 crossbuild-essential-i386
          version: 1

      - name: Install toolchain
        uses: dtolnay/rust-toolchain@315e265cd78dad1e1dcf3a5074f6d6c47029d5aa
        with:
          toolchain: "stable"
          components: "llvm-tools"

      - name: Install cross, cargo-deb and cargo-generate-rpm
        uses: taiki-e/install-action@acf70b3a1ed953bccebc8c5d80cfdb16ec8ccc36
        with:
          tool: cross, cargo-deb, cargo-generate-rpm@0.14.0

      - name: Checkout sources
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Build the release binaries
        run: RELEASE_TARGETS="${{ matrix.target }}" utils/build-release.sh

      - name: Upload artifacts
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: release-binaries-${{ matrix.target }}
          path: target/pkg/
          if-no-files-found: error

  gather:
    needs: package
    runs-on: ubuntu-latest
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          pattern: release-binaries-*
          path: target/pkg/
          merge-multiple: true
      - name: Create a SHA256SUMS file
        run: |
          cd target/pkg/
          rm -rf SHA256SUMS
          sha256sum -b * > SHA256SUMS
      - name: Upload artifacts
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: release-binaries
          path: target/pkg/
          if-no-files-found: error

  checks:
    uses: './.github/workflows/checks.yaml'

  release:
    needs: [gather, checks]
    runs-on: ubuntu-latest
    if: ${{ startsWith(github.ref, 'refs/heads/release/') }}
    permissions:
      # This part of the release pipeline needs to create a tag and a release
      contents: write
    steps:
      - name: Checkout sources
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Download artifacts
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: release-binaries
          path: target/pkg/

      - name: Install toolchain
        uses: dtolnay/rust-toolchain@315e265cd78dad1e1dcf3a5074f6d6c47029d5aa
        with:
          toolchain: "stable"
          components: "llvm-tools"

      - name: Check that the release commit is verified
        run: |
          commit_url="${{ github.api_url }}/repos/${{ github.repository }}/commits/${{ github.sha }}"
          json_accept_header="Accept: application/vnd.github+json"
          auth_bearer_header="Authorization: Bearer ${{ github.token }}"
          test "$(curl -sf -H "$json_accept_header" -H "$auth_bearer_header" "$commit_url" | jq .commit.verification.verified)" == "true"

      - name: Read the version from the manifest file
        run: echo "release_version=$(cargo read-manifest --manifest-path ntpd/Cargo.toml | jq -r .version)" >> "$GITHUB_ENV"

      - name: Version in Cargo.toml must match the branch name
        run: test "release/$release_version" == "${{ github.ref_name }}"

      - name: Ensure there is not already a released tag with a non-draft release
        run: test "$(gh release view "v$release_version" --json isDraft --jq .isDraft 2>/dev/null || echo "true")" == "true"

      - name: Verify that the changelog top most entry concerns this release
        run: |
          release_notes="$(awk '/^## / && !found { found=1; print; next } /^## / && found { exit } found { print }' CHANGELOG.md)"
          release_notes_header="$(echo "$release_notes" | head -1)"
          echo "Found release notes for '$release_notes_header'"
          release_notes_body="$(echo "$release_notes" | tail +2)"
          release_notes_body="${release_notes_body#"${release_notes_body%%[![:space:]]*}"}"
          release_notes_body="${release_notes_body%"${release_notes_body##*[![:space:]]}"}"
          release_notes_version="$(echo "$release_notes_header" | cut -d' ' -f2 | sed 's/[][]//g')"
          echo "Found version '$release_notes_version' in release notes"
          test "$release_notes_version" == "${{ env.release_version }}"
          {
            echo "release_notes_body<<RELEASE_NOTES_EOF"
            echo "$release_notes_body"
            echo RELEASE_NOTES_EOF
          } >> "$GITHUB_ENV"

      - name: Create a draft release
        uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0
        with:
          draft: true
          fail_on_unmatched_files: true
          tag_name: "v${{ env.release_version }}"
          target_commitish: "${{ github.sha }}"
          name: "Version ${{ env.release_version }}"
          files: target/pkg/*
          body: "${{ env.release_notes_body }}"