release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  packages: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  GO_VERSION: '1.19'
  PLATFORM: linux/amd64

jobs:
  release:
    runs-on: ubuntu-22.04

    steps:
      - name: Check out release tag
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Validate release version
        id: version
        shell: bash
        run: |
          set -euo pipefail
          version="${GITHUB_REF_NAME}"
          if [[ ! "${version}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "invalid release tag: ${version}" >&2
            exit 1
          fi
          echo "version=${version}" >> "${GITHUB_OUTPUT}"
          echo "revision=${GITHUB_SHA}" >> "${GITHUB_OUTPUT}"

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Install git2go
        shell: bash
        run: |
          set -euo pipefail
          git2go_path="$(go env GOPATH)/src/github.com/libgit2/git2go"
          go mod edit -replace "github.com/libgit2/git2go/v33=${git2go_path}"
          git clone --recurse-submodules \
            --branch v33.0.4 \
            https://github.com/libgit2/git2go \
            "${git2go_path}"
          go get -d github.com/libgit2/git2go/v33
          cd "${git2go_path}"
          USE_CHROMIUM_ZLIB=ON ./script/build-libgit2-static.sh

      - name: Download dependencies
        run: go get -tags=static -t -v ./...

      - name: Test runner
        run: go test -tags=static ./cmd/omegaup-runner ./runner/...

      - name: Build release binaries
        env:
          VERSION: ${{ steps.version.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p artifacts/backend/usr/bin artifacts/runner/usr/bin docker/bin

          go build -o artifacts/backend/usr/bin/omegaup-grader \
            -ldflags "-X main.ProgramVersion=${VERSION}" \
            -tags=static \
            github.com/omegaup/quark/cmd/omegaup-grader
          go build -o artifacts/backend/usr/bin/omegaup-broadcaster \
            -ldflags "-X main.ProgramVersion=${VERSION}" \
            -tags=static \
            github.com/omegaup/quark/cmd/omegaup-broadcaster
          go build -o artifacts/runner/usr/bin/omegaup-runner \
            -ldflags "-linkmode external -extldflags '-static' -X main.ProgramVersion=${VERSION}" \
            -tags=static \
            github.com/omegaup/quark/cmd/omegaup-runner

          if ldd artifacts/runner/usr/bin/omegaup-runner; then
            echo 'omegaup-runner must be statically linked' >&2
            exit 1
          fi
          cp artifacts/runner/usr/bin/omegaup-runner docker/bin/omegaup-runner
          test "$(artifacts/runner/usr/bin/omegaup-runner -version)" = \
            "omegaup-runner ${VERSION}"

      - name: Package release assets
        run: |
          tar -cJf omegaup-backend.tar.xz \
            --owner=root:0 --group=root:0 -C artifacts/backend/ .
          tar -cJf omegaup-runner.tar.xz \
            --owner=root:0 --group=root:0 -C artifacts/runner/ .

      - name: Create or update GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.version.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          if gh release view "${VERSION}" >/dev/null 2>&1; then
            gh release upload "${VERSION}" \
              omegaup-backend.tar.xz omegaup-runner.tar.xz --clobber
          else
            gh release create "${VERSION}" \
              omegaup-backend.tar.xz omegaup-runner.tar.xz \
              --verify-tag \
              --generate-notes \
              --title "${VERSION}"
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Check Docker Hub credentials are configured
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        shell: bash
        run: |
          set -euo pipefail
          test -n "${DOCKER_USERNAME}" || {
            echo 'DOCKER_USERNAME is not configured' >&2
            exit 1
          }
          test -n "${DOCKER_PASSWORD}" || {
            echo 'DOCKER_PASSWORD is not configured' >&2
            exit 1
          }

      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          registry: docker.io
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build backend image
        uses: docker/build-push-action@v7
        with:
          context: docker
          file: docker/Dockerfile.backend
          platforms: ${{ env.PLATFORM }}
          load: true
          build-args: |
            RELEASE=${{ steps.version.outputs.version }}
          tags: omegaup/backend:${{ steps.version.outputs.version }}
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ steps.version.outputs.revision }}
            org.opencontainers.image.version=${{ steps.version.outputs.version }}

      - name: Build runner sandbox image
        uses: docker/build-push-action@v7
        with:
          context: docker
          file: docker/Dockerfile
          platforms: ${{ env.PLATFORM }}
          load: true
          tags: omegaup/runner-ci:${{ steps.version.outputs.version }}
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ steps.version.outputs.revision }}
            org.opencontainers.image.version=${{ steps.version.outputs.version }}

      - name: Build runner image
        uses: docker/build-push-action@v7
        with:
          context: docker
          file: docker/Dockerfile.runner
          platforms: ${{ env.PLATFORM }}
          load: true
          tags: omegaup/runner:${{ steps.version.outputs.version }}
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ steps.version.outputs.revision }}
            org.opencontainers.image.version=${{ steps.version.outputs.version }}

      - name: Verify runner image
        env:
          VERSION: ${{ steps.version.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          image="omegaup/runner:${VERSION}"
          test "$(docker run --rm --platform linux/amd64 "${image}" \
            /usr/bin/omegaup-runner -version)" = \
            "omegaup-runner ${VERSION}"
          test "$(docker image inspect "${image}" --format '{{.Architecture}}')" = amd64
          test "$(docker run --rm --platform linux/amd64 \
            "omegaup/runner-ci:${VERSION}" -version)" = \
            "omegaup-runner ${VERSION}"
          test "$(docker image inspect "omegaup/runner-ci:${VERSION}" \
              --format '{{.Architecture}}')" = amd64

      - name: Verify backend image
        env:
          VERSION: ${{ steps.version.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          image="omegaup/backend:${VERSION}"
          test "$(docker run --rm --platform linux/amd64 "${image}" \
            /usr/bin/omegaup-grader -version)" = \
            "omegaup-grader ${VERSION}"
          test "$(docker run --rm --platform linux/amd64 "${image}" \
            /usr/bin/omegaup-broadcaster -version)" = \
            "omegaup-broadcaster ${VERSION}"
          test "$(docker image inspect "${image}" --format '{{.Architecture}}')" = amd64

      - name: Publish verified images
        env:
          VERSION: ${{ steps.version.outputs.version }}
          REVISION: ${{ steps.version.outputs.revision }}
        shell: bash
        run: |
          set -euo pipefail
          for image in backend runner runner-ci; do
            source_image="omegaup/${image}:${VERSION}"
            docker push "${source_image}"
            for target_image in \
              "omegaup/${image}:sha-${REVISION}" \
              "ghcr.io/${{ github.repository_owner }}/${image}:${VERSION}" \
              "ghcr.io/${{ github.repository_owner }}/${image}:sha-${REVISION}"; do
              docker tag "${source_image}" "${target_image}"
              docker push "${target_image}"
            done
          done