release-cli.yml

name: release-cli

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: Release tag to publish (for example, v0.1.0).
        required: true
        type: string
      prerelease:
        description: Publish as prerelease.
        required: false
        default: false
        type: boolean

permissions:
  contents: write

jobs:
  package:
    name: Package CLI Assets
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build CLI packages
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $out = Join-Path $env:RUNNER_TEMP 'cli-release'
          & pwsh -NoProfile -File ./scripts/Invoke-CdevCli.ps1 release package --output-root $out
          if ($LASTEXITCODE -ne 0) { throw 'release package command failed.' }

      - name: Upload packaged assets
        uses: actions/upload-artifact@v4
        with:
          name: cdev-cli-release-${{ github.run_id }}
          path: |
            ${{ runner.temp }}/cli-release/cdev-cli-win-x64.zip
            ${{ runner.temp }}/cli-release/cdev-cli-win-x64.zip.sha256
            ${{ runner.temp }}/cli-release/cdev-cli-linux-x64.tar.gz
            ${{ runner.temp }}/cli-release/cdev-cli-linux-x64.tar.gz.sha256
            ${{ runner.temp }}/cli-release/cdev-cli.spdx.json
            ${{ runner.temp }}/cli-release/cdev-cli.slsa.json
          if-no-files-found: error

  publish:
    name: Publish CLI Release
    runs-on: ubuntu-latest
    needs: [package]
    permissions:
      contents: write
    steps:
      - name: Download packaged assets
        uses: actions/download-artifact@v4
        with:
          name: cdev-cli-release-${{ github.run_id }}
          path: ${{ runner.temp }}/cli-release

      - name: Create/update release and upload assets
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
          TARGET_REPOSITORY: ${{ github.repository }}
          RELEASE_TAG: ${{ inputs.release_tag }}
          PRERELEASE: ${{ inputs.prerelease }}
        run: |
          $ErrorActionPreference = 'Stop'

          $tag = [string]$env:RELEASE_TAG
          if ($tag -notmatch '^v[0-9]+\.[0-9]+\.[0-9]+$') {
            throw "Invalid release tag '$tag'. Expected semantic version like v0.1.0"
          }

          $artifactRoot = Join-Path $env:RUNNER_TEMP 'cli-release'
          $assets = @(
            (Join-Path $artifactRoot 'cdev-cli-win-x64.zip'),
            (Join-Path $artifactRoot 'cdev-cli-win-x64.zip.sha256'),
            (Join-Path $artifactRoot 'cdev-cli-linux-x64.tar.gz'),
            (Join-Path $artifactRoot 'cdev-cli-linux-x64.tar.gz.sha256'),
            (Join-Path $artifactRoot 'cdev-cli.spdx.json'),
            (Join-Path $artifactRoot 'cdev-cli.slsa.json')
          )
          foreach ($asset in $assets) {
            if (-not (Test-Path -LiteralPath $asset -PathType Leaf)) {
              throw "Missing asset: $asset"
            }
          }

          $releaseNotesPath = Join-Path $env:RUNNER_TEMP "release-notes-$tag.md"
          @(
            "# cdev CLI $tag",
            "",
            "Assets:",
            "- cdev-cli-win-x64.zip",
            "- cdev-cli-linux-x64.tar.gz",
            "- cdev-cli.spdx.json",
            "- cdev-cli.slsa.json"
          ) | Set-Content -LiteralPath $releaseNotesPath -Encoding utf8

          $repo = [string]$env:TARGET_REPOSITORY
          $isPre = [System.Convert]::ToBoolean($env:PRERELEASE)

          & gh release view $tag -R $repo *> $null
          $exists = ($LASTEXITCODE -eq 0)

          if (-not $exists) {
            if ($isPre) {
              & gh release create $tag -R $repo --title "cdev CLI $tag" --notes-file $releaseNotesPath --prerelease
            } else {
              & gh release create $tag -R $repo --title "cdev CLI $tag" --notes-file $releaseNotesPath
            }
            if ($LASTEXITCODE -ne 0) { throw 'Failed to create release.' }
          }

          & gh release upload $tag $assets -R $repo --clobber
          if ($LASTEXITCODE -ne 0) { throw 'Failed to upload release assets.' }