release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
    branches:
      - 'feat/release-pipeline**'
  workflow_dispatch:
    inputs:
      version_override:
        description: 'Version override (leave empty to auto-detect from latest tag)'
        type: string
        default: ''

env:
  PRODUCTION_RELEASE_TAGS: '5.0,7,8'
  DOCKER_REPO_ROLLING: owncloud/ocis-rolling
  DOCKER_REPO_PRODUCTION: owncloud/ocis
  NODE_VERSION: '24'
  PNPM_VERSION: '10.28.1'
  GOLANG_BUILD_IMAGE: 'golang:1.26.8-alpine3.23@sha256:a8fa79c5bd40d880b52bd3b6d7669ecdcfd00e85facdd427d279efb5ddd79cb1'

jobs:
  determine-release-type:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    outputs:
      version:       ${{ steps.info.outputs.version }}
      is_production: ${{ steps.info.outputs.is_production }}
      is_prerelease: ${{ steps.info.outputs.is_prerelease }}
      docker_repos:  ${{ steps.info.outputs.docker_repos }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        if: ${{ github.ref_type == 'branch' || (github.event_name == 'workflow_dispatch' && inputs.version_override == '') }}
        with:
          fetch-depth: 0
          fetch-tags: true

      - id: info
        env:
          VERSION_OVERRIDE: ${{ inputs.version_override }}
        run: |
          next_dev() {
            # If latest tag is already a pre-release (e.g. v8.0.2-dev.1), reuse its base
            # version (8.0.2-dev.1) so repeated branch runs don't bump the patch counter.
            # If latest tag is a production release (e.g. v8.0.1), increment patch (8.0.2-dev.1).
            local tag=$(git tag --sort=-version:refname | grep -m1 '^v' || echo "v0.0.0")
            local ver="${tag#v}"
            if [[ "$ver" == *"-"* ]]; then
              echo "${ver%%-*}-dev.1"
            else
              IFS='.' read -r M m p <<< "$ver"
              echo "${M}.${m}.$((p + 1))-dev.1"
            fi
          }

          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            VERSION="$VERSION_OVERRIDE"
            [[ -z "$VERSION" ]] && VERSION=$(next_dev)
          elif [[ "${{ github.ref_type }}" == "branch" ]]; then
            VERSION=$(next_dev)
          else
            VERSION="${GITHUB_REF#refs/tags/v}"
          fi

          # `version` below is read back by nine `run:` blocks in this file (thirteen
          # interpolations) as ${{ needs.determine-release-type.outputs.version }}, and each
          # of those is substituted into the script text before bash sees it. Refusing
          # anything that is not a version token here is what keeps those nine safe, instead
          # of nine more env: blocks -- and a release version that is not a version token is
          # a bug in its own right.
          if [[ ! "$VERSION" =~ ^[0-9A-Za-z][0-9A-Za-z.+-]*$ ]]; then
            echo "::error title=Invalid release version::'$VERSION' is not a version string (expected ^[0-9A-Za-z][0-9A-Za-z.+-]*$)"
            exit 1
          fi

          IS_PRODUCTION=false
          for TAG in ${PRODUCTION_RELEASE_TAGS//,/ }; do
            [[ "$VERSION" == "$TAG"* ]] && IS_PRODUCTION=true && break
          done

          [[ "$VERSION" == *"-"* ]] && IS_PRERELEASE=true || IS_PRERELEASE=false

          if [[ "$IS_PRODUCTION" == "true" && "$IS_PRERELEASE" == "false" ]]; then
            REPOS=[\"$DOCKER_REPO_ROLLING\",\"$DOCKER_REPO_PRODUCTION\"]
          else
            REPOS=[\"$DOCKER_REPO_ROLLING\"]
          fi

          echo "version=$VERSION"             >> $GITHUB_OUTPUT
          echo "is_production=$IS_PRODUCTION" >> $GITHUB_OUTPUT
          echo "is_prerelease=$IS_PRERELEASE" >> $GITHUB_OUTPUT
          echo "docker_repos=$REPOS"          >> $GITHUB_OUTPUT

  generate-code:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    needs: [determine-release-type]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: npm install --silent -g yarn npx --force
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v4
        with:
          version: ${{ env.PNPM_VERSION }}
      - run: pnpm config set store-dir ./.pnpm-store && make ci-node-generate
        env:
          CHROMEDRIVER_SKIP_DOWNLOAD: 'true'
      - run: make ci-go-generate
        env:
          BUF_TOKEN: ${{ secrets.BUF_API_TOKEN }}
      - name: bump LatestTag
        run: |
          VERSION="${{ needs.determine-release-type.outputs.version }}"
          sed -i "s/LatestTag = \".*\"/LatestTag = \"$VERSION\"/" ocis-pkg/version/version.go
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: generated-code
          path: |
            .
            !.git
            !web
          retention-days: 1

  docker-build:
    if: false
    name: docker-build (${{ matrix.arch }}, ${{ matrix.repo }})
    runs-on: ${{ matrix.arch == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
    timeout-minutes: 120
    needs: [determine-release-type, generate-code, security-scan-trivy]
    strategy:
      matrix:
        arch: [amd64, arm64]
        repo: ${{ fromJSON(needs.determine-release-type.outputs.docker_repos) }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: generated-code
          path: .
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - id: goversion
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - run: |
          ALPINE_VERSION=$(grep '^FROM.*alpine:' ocis/docker/Dockerfile.linux.${{ matrix.arch }} | grep -o 'alpine:[0-9.]*' | cut -d: -f2 | cut -d. -f1,2)
          docker run --rm \
            -v "${{ github.workspace }}:/workspace" \
            -w /workspace \
            "golang:${{ steps.goversion.outputs.go-version }}-alpine${ALPINE_VERSION}" \
            sh -c "apk add --no-cache bash gcc musl-dev vips-dev make git && \
                   git config --global --add safe.directory /workspace && \
                   CGO_ENABLED=1 ENABLE_VIPS=true VERSION=${{ needs.determine-release-type.outputs.version }} \
                   make -C ocis release-linux-docker-${{ matrix.arch }}"
      - id: tags
        run: |
          VERSION="${{ needs.determine-release-type.outputs.version }}"
          REPO="${{ matrix.repo }}"
          ARCH="${{ matrix.arch }}"
          printf "tags<<EOF\n%s\nEOF\n" \
            "${REPO}:${VERSION}-linux-${ARCH}" >> $GITHUB_OUTPUT
      - id: build
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: ocis
          file: ocis/docker/Dockerfile.linux.${{ matrix.arch }}
          platforms: linux/${{ matrix.arch }}
          load: true
          push: false
          provenance: false
          build-args: |
            REVISION=${{ github.sha }}
            VERSION=${{ needs.determine-release-type.outputs.version }}
          tags: ${{ steps.tags.outputs.tags }}
      - id: trivy
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        continue-on-error: true
        with:
          image-ref: ${{ steps.tags.outputs.tags }}
          format: table
          exit-code: 1
          severity: HIGH,CRITICAL
          ignore-unfixed: true
          skip-files: /usr/bin/gomplate,/usr/bin/wait-for
          hide-progress: true
        env:
          TRIVY_IGNOREFILE: .trivyignore
      - name: Block on vulnerabilities
        if: steps.trivy.outcome == 'failure'
        run: |
          echo "::error title=Security scan blocked release::Image ${{ steps.tags.outputs.tags }} has HIGH or CRITICAL vulnerabilities (see Trivy report above). Fix all findings before releasing."
          exit 1
      - name: push
        if: steps.trivy.outcome == 'success'
        run: docker push ${{ steps.tags.outputs.tags }}

  docker-scan:
    name: docker-scan (${{ matrix.arch }}, ${{ matrix.repo }})
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: [determine-release-type, docker-build]
    strategy:
      matrix:
        arch: [amd64]
        repo: ${{ fromJSON(needs.determine-release-type.outputs.docker_repos) }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        id: trivy
        continue-on-error: true
        with:
          image-ref: ${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}-linux-${{ matrix.arch }}
          format: table
          exit-code: 1
          severity: HIGH,CRITICAL
          ignore-unfixed: true
          skip-files: /usr/bin/gomplate,/usr/bin/wait-for
          hide-progress: true
        env:
          TRIVY_IGNOREFILE: .trivyignore

      - name: Block on vulnerabilities
        if: steps.trivy.outcome == 'failure'
        run: |
          echo "::error title=Security scan blocked release::Image ${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}-linux-${{ matrix.arch }} has HIGH or CRITICAL vulnerabilities (see Trivy report above). Fix all findings before releasing."
          exit 1

  docker-manifest:
    if: false
    name: docker-manifest (${{ matrix.repo }})
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [determine-release-type, docker-build, docker-scan]
    strategy:
      matrix:
        repo: ${{ fromJSON(needs.determine-release-type.outputs.docker_repos) }}
    steps:
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - if: ${{ contains(matrix.repo, 'rolling') }}
        run: |
          docker buildx imagetools create \
            -t "${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}" \
            "${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}-linux-amd64" \
            "${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}-linux-arm64"
      - if: ${{ !contains(matrix.repo, 'rolling') }}
        run: |
          docker buildx imagetools create \
            -t "${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}" \
            "${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}-linux-amd64" \
            "${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}-linux-arm64"

  docker-readme:
    if: false
    name: docker-readme (${{ matrix.repo }})
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [determine-release-type, docker-manifest]
    strategy:
      matrix:
        repo: ${{ fromJSON(needs.determine-release-type.outputs.docker_repos) }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          repository: ${{ matrix.repo }}
          readme-filepath: ocis/README.md

  build-binaries:
    name: build-binaries (${{ matrix.os }})
    runs-on: ubuntu-latest
    timeout-minutes: 120
    needs: [determine-release-type, generate-code]
    strategy:
      matrix:
        os: [linux, darwin]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: generated-code
          path: .
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - run: |
          make -C ocis release-${{ matrix.os }} OUTPUT=${{ needs.determine-release-type.outputs.version }}
          make -C ocis release-finish
          if [[ "${{ matrix.os }}" == "linux" ]]; then
            cp assets/End-User-License-Agreement-for-ownCloud-Infinite-Scale.pdf ocis/dist/release/
          fi
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: binaries-${{ matrix.os }}
          path: ocis/dist/release/*
          retention-days: 1

  security-scan-trivy:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          scan-type: fs
          format: table
          exit-code: 1
          severity: CRITICAL,HIGH
          trivy-config: .trivy.yaml

  license-check:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    needs: [determine-release-type, generate-code]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: generated-code
          path: .
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - run: npm install --silent -g yarn npx "pnpm@$PNPM_VERSION" --force
      # web is excluded from the generated-code artifact (see generate-code) to
      # avoid OOM on upload, so its node_modules — which provides the
      # license-checker-rseidelsohn binary — must be reinstalled here.
      - run: cd web && pnpm install
      - run: make ci-node-check-licenses && make ci-node-save-licenses
      - run: make ci-go-check-licenses && make ci-go-save-licenses
      - run: tar -czf third-party-licenses.tar.gz -C third-party-licenses .
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: third-party-licenses
          path: third-party-licenses.tar.gz
          retention-days: 1

  generate-changelog:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [determine-release-type]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - run: |
          make changelog CHANGELOG_VERSION=$(echo "${{ needs.determine-release-type.outputs.version }}" | cut -d'-' -f1)
          # calens produces empty output when no versioned changelog directory exists (e.g. dev builds).
          # Fall back to a pointer to the unreleased entries.
          if [[ $(wc -l < ocis/dist/CHANGELOG.md) -lt 5 ]]; then
            echo "Development release — no release notes yet. See [unreleased changes](https://github.com/owncloud/ocis/tree/master/changelog/unreleased/)." > ocis/dist/CHANGELOG.md
          fi
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: changelog
          path: ocis/dist/CHANGELOG.md
          retention-days: 1

  create-github-release:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: [determine-release-type, build-binaries, license-check, generate-changelog, security-scan-trivy]
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: binaries-linux
          path: release-assets
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: binaries-darwin
          path: release-assets
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: third-party-licenses
          path: release-assets
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: changelog
          path: .
      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          tag_name: v${{ needs.determine-release-type.outputs.version }}
          name: v${{ needs.determine-release-type.outputs.version }}
          body_path: CHANGELOG.md
          prerelease: ${{ needs.determine-release-type.outputs.is_prerelease == 'true' }}
          files: release-assets/*

  audit-release:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs:
      - determine-release-type
      - generate-code
      - build-binaries
      - security-scan-trivy
      - license-check
      - generate-changelog
      - create-github-release
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: binaries-linux
          path: release-assets
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: binaries-darwin
          path: release-assets
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: third-party-licenses
          path: release-assets
      - run: |
          python3 scripts/audit-release.py \
            --version "${{ needs.determine-release-type.outputs.version }}" \
            --dir release-assets/ \
            --github-release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}