pre-release.yml

name: Pre-release Snapshot

# Creates a pre-release snapshot build on every merge to main.
# These builds are tagged as "snapshot" and are considered unstable.

on:
  push:
    branches:
      - main

permissions:
  contents: write
  packages: write

env:
  GOPRIVATE: github.com/GoCodeAlone/*
  GONOSUMCHECK: github.com/GoCodeAlone/*

jobs:
  test:
    name: Pre-release Tests
    runs-on: ubuntu-latest
    steps:
    - name: Check out code
      uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: '1.26'
        cache: true

    - name: Set up Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '20'
        registry-url: 'https://npm.pkg.github.com'
        cache: 'npm'
        cache-dependency-path: ui/package-lock.json

    - name: Build UI assets (required for Go embed)
      run: |
        cd ui && npm ci && npm run build
        cd .. && mkdir -p module/ui_dist && cp -r ui/dist/* module/ui_dist/
      env:
        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Run tests
      run: go test -race ./...

  snapshot:
    name: Build Snapshot Release
    runs-on: ubuntu-latest
    needs: test

    steps:
    - name: Check out code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: '1.26'
        cache: true

    - name: Set up Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '20'
        registry-url: 'https://npm.pkg.github.com'
        cache: 'npm'
        cache-dependency-path: ui/package-lock.json

    - name: Build UI assets (required for Go embed)
      run: |
        cd ui && npm ci && npm run build
        cd .. && mkdir -p module/ui_dist && cp -r ui/dist/* module/ui_dist/
      env:
        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Determine snapshot version
      id: version
      run: |
        SHORT_SHA=$(git rev-parse --short HEAD)
        SNAPSHOT_VERSION="snapshot-${SHORT_SHA}"
        echo "VERSION=${SNAPSHOT_VERSION}" >> "$GITHUB_ENV"
        echo "version=${SNAPSHOT_VERSION}" >> "$GITHUB_OUTPUT"

    - name: Build binaries
      run: |
        mkdir -p dist
        LDFLAGS="-s -w -X main.version=${VERSION}"

        GOOS=linux   GOARCH=amd64 go build -ldflags="${LDFLAGS}" -o dist/workflow-linux-amd64    ./cmd/server
        GOOS=linux   GOARCH=arm64 go build -ldflags="${LDFLAGS}" -o dist/workflow-linux-arm64    ./cmd/server
        GOOS=darwin  GOARCH=amd64 go build -ldflags="${LDFLAGS}" -o dist/workflow-darwin-amd64   ./cmd/server
        GOOS=darwin  GOARCH=arm64 go build -ldflags="${LDFLAGS}" -o dist/workflow-darwin-arm64   ./cmd/server
        GOOS=windows GOARCH=amd64 go build -ldflags="${LDFLAGS}" -o dist/workflow-windows-amd64.exe ./cmd/server

    - name: Package admin UI
      run: |
        tar -czf "dist/workflow-admin-ui-${VERSION}.tar.gz" -C ui dist

    - name: Create checksums
      run: |
        cd dist
        sha256sum * > checksums.txt

    - name: Clean up old snapshot releases
      run: |
        # Delete all previous snapshot-* releases (keep only latest)
        gh release list --limit 50 | grep '^snapshot-' | awk '{print $1}' | while read tag; do
          gh release delete "$tag" --yes --cleanup-tag || true
        done
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Create snapshot release
      run: |
        TAG="snapshot-$(git rev-parse --short HEAD)"
        gh release create "$TAG" \
          --title "Snapshot (${{ steps.version.outputs.version }})" \
          --notes "Automated pre-release snapshot built from the latest commit on \`main\`.

        **Commit**: ${{ github.sha }}
        **Build**: ${{ steps.version.outputs.version }}

        > **Warning**: This is an unstable development build. Use tagged releases for production." \
          --target main \
          --prerelease \
          dist/*
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  docker-snapshot:
    name: Build & Push Snapshot Image (ko)
    runs-on: ubuntu-latest
    needs: test
    permissions:
      contents: read
      packages: write

    steps:
    - name: Check out code
      uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: '1.26'
        cache: true

    - name: Set up ko
      uses: ko-build/setup-ko@v0.9

    - name: Log in to GitHub Container Registry
      run: echo "${{ secrets.GITHUB_TOKEN }}" | ko login ghcr.io --username ${{ github.actor }} --password-stdin

    - name: Build and push snapshot
      env:
        KO_DOCKER_REPO: ghcr.io/gocodealone/workflow
        GOPRIVATE: github.com/GoCodeAlone/*
        GONOSUMCHECK: github.com/GoCodeAlone/*
        GOFLAGS: -mod=mod
      run: |
        SHA_SHORT="${GITHUB_SHA:0:7}"

        ko build ./cmd/server \
          --bare \
          --platform=linux/amd64,linux/arm64 \
          --tags="snapshot,main-sha-${SHA_SHORT}" \
          --sbom=spdx