release.yml

name: Release Zero

on:
  workflow_dispatch:
    inputs:
      mode:
        description: Release mode
        required: true
        type: choice
        options:
          - canary
          - stable
      release_branch:
        description: Branch to release from
        required: true
        type: string
        default: main
  # Pushes to main publish head npm and Docker releases without a git tag.
  push:
    branches: [main]

permissions: {}

concurrency:
  # Keep the active release and only the newest queued release per mode.
  group: zero-release-${{ inputs.release_branch || 'main' }}-${{ inputs.mode || 'head' }}
  cancel-in-progress: false

jobs:
  plan:
    name: Plan release
    # Releases publish from the public repo only. This file also exists in
    # rocicorp/mono-internal, where skipping this job skips every job that
    # needs it.
    if: github.repository == 'rocicorp/mono'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      mode: ${{ steps.plan.outputs.mode }}
      release_branch: ${{ steps.plan.outputs.release_branch }}
      version: ${{ steps.plan.outputs.version }}
      tag: ${{ steps.plan.outputs.tag }}
      source_sha: ${{ steps.plan.outputs.source_sha }}
      is_canary: ${{ steps.plan.outputs.is_canary }}
    steps:
      - name: Checkout workflow repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: main
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x

      - name: Plan release
        id: plan
        env:
          MODE: ${{ github.event_name == 'push' && 'head' || inputs.mode }}
          RELEASE_BRANCH: ${{ github.event_name == 'push' && 'main' || inputs.release_branch }}
          WORKFLOW_REF_NAME: ${{ github.ref_name }}
          # Release the commit that triggered the push, even if the run was queued.
          SOURCE_SHA: ${{ github.event_name == 'push' && github.sha || '' }}
        run: node scripts/src/release-plan.ts

  archive-cloudzero-source:
    name: Archive source for Cloud Zero (${{ matrix.stage }})
    runs-on: ubuntu-latest
    needs: plan
    environment: ${{ matrix.stage }}-source-archive
    strategy:
      fail-fast: false
      matrix:
        include:
          - stage: staging
            account_id: '946232032425'
          - stage: production
            account_id: '360831509486'
    permissions:
      contents: read
      id-token: write # For AWS OIDC.
    steps:
      - name: Checkout release source
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ needs.plan.outputs.source_sha }}
          persist-credentials: false

      - name: Configure archive credentials
        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
        with:
          role-to-assume: arn:aws:iam::${{ matrix.account_id }}:role/github-archive-zero-source
          role-session-name: archive-zero-source-${{ github.run_id }}
          aws-region: us-east-1
          mask-aws-account-id: true
          unset-current-credentials: true

      - name: Archive source revision
        env:
          SOURCE_ARCHIVE_BUCKET: cloudzero-source-archives-${{ matrix.account_id }}
          SOURCE_REPOSITORY: rocicorp/mono
          SOURCE_REVISION: ${{ needs.plan.outputs.source_sha }}
        run: |
          set -euo pipefail
          revision=$(git rev-parse --verify "${SOURCE_REVISION}^{commit}")
          if [[ ! "$revision" =~ ^[0-9a-f]{40}$ ]] || [ "$revision" != "$SOURCE_REVISION" ]; then
            echo "Expected exact commit SHA, got $SOURCE_REVISION -> $revision" >&2
            exit 1
          fi
          archive="$RUNNER_TEMP/source.tar.gz"
          git archive --format=tar "$revision" | gzip -n > "$archive"
          key="repositories/$SOURCE_REPOSITORY/$revision/source.tar.gz"
          if aws s3api head-object --bucket "$SOURCE_ARCHIVE_BUCKET" --key "$key" >/dev/null 2>&1; then
            echo "Already archived $SOURCE_REPOSITORY@$revision"
          else
            aws s3api put-object \
              --bucket "$SOURCE_ARCHIVE_BUCKET" \
              --key "$key" \
              --body "$archive" \
              --content-type application/gzip \
              --checksum-algorithm SHA256 >/dev/null
          fi

  build:
    name: Build package
    runs-on: ubuntu-latest
    needs: plan
    permissions:
      contents: read
    outputs:
      tarball_name: ${{ steps.pack.outputs.filename }}
    env:
      SCRIPTS: ${{ github.workspace }}/ci/scripts/src
      VERSION: ${{ needs.plan.outputs.version }}
    steps:
      - name: Checkout workflow scripts
        # Run release tooling from main, not the selected release branch.
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: main
          path: ci
          persist-credentials: false
          sparse-checkout: scripts

      - name: Checkout release source
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          path: source
          ref: ${{ needs.plan.outputs.source_sha }}
          persist-credentials: false

      - name: Set up pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: 11.11.0

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
          cache-dependency-path: source/pnpm-lock.yaml

      - name: Set release version
        working-directory: source
        run: node "$SCRIPTS/release-set-version.ts" "$VERSION"

      - name: Install dependencies
        working-directory: source
        run: pnpm install --frozen-lockfile

      - name: Build Zero
        working-directory: source
        run: pnpm --filter @rocicorp/zero run build

      - name: Pack Zero
        id: pack
        working-directory: source/packages/zero
        env:
          PACK_DEST: ${{ runner.temp }}/npm
        run: node "$SCRIPTS/release-pack.ts"

      - name: Verify npm tarball
        working-directory: source
        env:
          TARBALL: ${{ runner.temp }}/npm/${{ steps.pack.outputs.filename }}
        run: node "$SCRIPTS/release-verify-tarball.ts" "$TARBALL" "$VERSION"

      - name: Upload npm package artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: zero-npm-${{ needs.plan.outputs.version }}
          if-no-files-found: error
          retention-days: 7
          path: ${{ runner.temp }}/npm/${{ steps.pack.outputs.filename }}

  build-docker:
    name: Build Docker image (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    needs: [plan, build]
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            platform: linux/amd64
            runner: ubuntu-24.04
          - arch: arm64
            platform: linux/arm64
            runner: ubuntu-24.04-arm
    permissions:
      contents: read
    env:
      ARCH: ${{ matrix.arch }}
      PLATFORM: ${{ matrix.platform }}
      SOURCE_SHA: ${{ needs.plan.outputs.source_sha }}
      TARBALL: ${{ needs.build.outputs.tarball_name }}
      VERSION: ${{ needs.plan.outputs.version }}
    steps:
      - name: Checkout release source
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          path: source
          ref: ${{ needs.plan.outputs.source_sha }}
          persist-credentials: false

      - name: Download npm package artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: zero-npm-${{ needs.plan.outputs.version }}
          path: ${{ runner.temp }}/npm

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Build Docker image archive
        env:
          IMAGE_ARCHIVE: ${{ runner.temp }}/docker/zero-image-${{ matrix.arch }}.tar
          IMAGE_DIGEST: ${{ runner.temp }}/docker/zero-image-${{ matrix.arch }}.digest
          IMAGE_METADATA: ${{ runner.temp }}/docker/zero-image-${{ matrix.arch }}.json
          TARBALL_PATH: ${{ runner.temp }}/npm/${{ needs.build.outputs.tarball_name }}
        run: |
          set -euo pipefail
          mkdir -p source/packages/zero/pkgs "$(dirname "$IMAGE_ARCHIVE")"
          cp "$TARBALL_PATH" "source/packages/zero/pkgs/$TARBALL"
          # Older maintenance branches (1.10) build vfs-query from go/, which
          # their Dockerfile reads from the named build context `monogo`.
          build_contexts=()
          if grep -q -- '--from=monogo' source/packages/zero/Dockerfile; then
            build_contexts+=(--build-context monogo=source/go)
          fi
          docker buildx build \
            --platform "$PLATFORM" \
            "${build_contexts[@]}" \
            --build-arg ZERO_VERSION="$VERSION" \
            --build-arg ZERO_PACKAGE="$TARBALL" \
            --label org.opencontainers.image.revision="$SOURCE_SHA" \
            --label org.opencontainers.image.version="$VERSION" \
            --metadata-file "$IMAGE_METADATA" \
            --sbom=true \
            --provenance=mode=max \
            --output=type=oci,dest="$IMAGE_ARCHIVE" \
            source/packages/zero
          digest=$(jq -r '."containerimage.digest"' "$IMAGE_METADATA")
          if [[ ! "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "Invalid $ARCH image digest: $digest" >&2
            exit 1
          fi
          printf '%s\n' "$digest" > "$IMAGE_DIGEST"

      - name: Upload Docker image artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: zero-docker-${{ needs.plan.outputs.version }}-${{ matrix.arch }}
          if-no-files-found: error
          retention-days: 7
          path: |
            ${{ runner.temp }}/docker/zero-image-${{ matrix.arch }}.tar
            ${{ runner.temp }}/docker/zero-image-${{ matrix.arch }}.digest

  publish-npm:
    name: Publish npm package
    runs-on: ubuntu-latest
    needs: [plan, build, build-docker]
    environment:
      name: zero-release-npm
    permissions:
      contents: read
      id-token: write # For npm trusted publishing.
    env:
      MODE: ${{ needs.plan.outputs.mode }}
      SCRIPTS: ${{ github.workspace }}/ci/scripts/src
      VERSION: ${{ needs.plan.outputs.version }}
      TARBALL_NAME: ${{ needs.build.outputs.tarball_name }}
    steps:
      - name: Checkout workflow scripts
        # Only load release tooling from main in this credentialed job.
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: main
          path: ci
          persist-credentials: false
          sparse-checkout: scripts

      - name: Set up pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: 11.11.0

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          registry-url: 'https://registry.npmjs.org'

      - name: Download npm package artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: zero-npm-${{ needs.plan.outputs.version }}
          path: dist/npm

      - name: Verify npm tarball
        run: node "$SCRIPTS/release-verify-tarball.ts" "dist/npm/$TARBALL_NAME" "$VERSION"

      - name: Publish npm package
        run: |
          set -euo pipefail
          if [ "$MODE" = 'stable' ]; then
            pnpm stage publish "dist/npm/$TARBALL_NAME" --provenance --tag staging --access public --no-git-checks --json
          else
            # Canary and head publish directly to their matching dist-tags.
            pnpm publish "dist/npm/$TARBALL_NAME" --provenance --tag "$MODE" --access public --no-git-checks
          fi

      - name: Summarize npm release
        run: |
          {
            printf '## npm\n\n'
            printf 'Package: `%s`\n\n' "@rocicorp/zero@$VERSION"
            if [ "$MODE" = 'stable' ]; then
              printf 'Stable release was staged. Approve it with `pnpm stage approve <stage-id>` or in the NPM Web UI, then run the Promote Zero Release workflow.\n'
            else
              printf '%s release was published with the `%s` dist-tag.\n' "$MODE" "$MODE"
            fi
          } >> "$GITHUB_STEP_SUMMARY"

  publish-docker:
    name: Publish Docker images
    runs-on: ubuntu-latest
    needs: [plan, build-docker, archive-cloudzero-source]
    environment:
      name: zero-release-docker
    permissions:
      id-token: write # For Docker Hub OIDC and cosign.
      packages: write # For GHCR pushes.
    env:
      MODE: ${{ needs.plan.outputs.mode }}
      VERSION: ${{ needs.plan.outputs.version }}
    steps:
      - name: Download amd64 Docker image artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: zero-docker-${{ needs.plan.outputs.version }}-amd64
          path: dist/docker

      - name: Download arm64 Docker image artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: zero-docker-${{ needs.plan.outputs.version }}-arm64
          path: dist/docker

      - name: Read Docker image digests
        id: digests
        run: |
          set -euo pipefail
          for arch in amd64 arm64; do
            digest=$(<"dist/docker/zero-image-$arch.digest")
            if [[ ! "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]; then
              echo "Invalid $arch image digest: $digest" >&2
              exit 1
            fi
            echo "$arch=$digest" >> "$GITHUB_OUTPUT"
          done

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Login to GHCR
        # Share both registry logins with Skopeo and cosign.
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        env:
          DOCKER_CONFIG: ${{ runner.temp }}/docker-auth
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        env:
          DOCKER_CONFIG: ${{ runner.temp }}/docker-auth
          DOCKERHUB_OIDC_CONNECTIONID: 2b3442aa-9cf7-4a13-afce-535dece25f7a
        with:
          username: rocicorp

      - name: Push GHCR amd64 image by digest
        uses: docker://quay.io/containers/skopeo:v1.22.2-immutable@sha256:ca4fd94dba8cab15cf79c4c156bfc26d28e2265411294e9bba87756942e739ad
        env:
          REGISTRY_AUTH_FILE: ${{ runner.temp }}/docker-auth/config.json
        with:
          args: >-
            copy --all --preserve-digests
            oci-archive:dist/docker/zero-image-amd64.tar
            docker://ghcr.io/rocicorp/zero@${{ steps.digests.outputs.amd64 }}

      - name: Push GHCR arm64 image by digest
        uses: docker://quay.io/containers/skopeo:v1.22.2-immutable@sha256:ca4fd94dba8cab15cf79c4c156bfc26d28e2265411294e9bba87756942e739ad
        env:
          REGISTRY_AUTH_FILE: ${{ runner.temp }}/docker-auth/config.json
        with:
          args: >-
            copy --all --preserve-digests
            oci-archive:dist/docker/zero-image-arm64.tar
            docker://ghcr.io/rocicorp/zero@${{ steps.digests.outputs.arm64 }}

      - name: Push Docker Hub amd64 image by digest
        uses: docker://quay.io/containers/skopeo:v1.22.2-immutable@sha256:ca4fd94dba8cab15cf79c4c156bfc26d28e2265411294e9bba87756942e739ad
        env:
          REGISTRY_AUTH_FILE: ${{ runner.temp }}/docker-auth/config.json
        with:
          args: >-
            copy --all --preserve-digests
            oci-archive:dist/docker/zero-image-amd64.tar
            docker://docker.io/rocicorp/zero@${{ steps.digests.outputs.amd64 }}

      - name: Push Docker Hub arm64 image by digest
        uses: docker://quay.io/containers/skopeo:v1.22.2-immutable@sha256:ca4fd94dba8cab15cf79c4c156bfc26d28e2265411294e9bba87756942e739ad
        env:
          REGISTRY_AUTH_FILE: ${{ runner.temp }}/docker-auth/config.json
        with:
          args: >-
            copy --all --preserve-digests
            oci-archive:dist/docker/zero-image-arm64.tar
            docker://docker.io/rocicorp/zero@${{ steps.digests.outputs.arm64 }}

      - name: Create multi-platform Docker image tags
        env:
          AMD64_DIGEST: ${{ steps.digests.outputs.amd64 }}
          ARM64_DIGEST: ${{ steps.digests.outputs.arm64 }}
          DOCKER_CONFIG: ${{ runner.temp }}/docker-auth
        run: |
          set -euo pipefail
          for image in ghcr.io/rocicorp/zero docker.io/rocicorp/zero; do
            tags=(--tag "$image:$VERSION")
            if [ "$MODE" = 'head' ]; then
              # The version signature covers head because both use one digest.
              tags+=(--tag "$image:head")
            fi
            docker buildx imagetools create \
              "${tags[@]}" \
              "$image@$AMD64_DIGEST" \
              "$image@$ARM64_DIGEST"
          done

      - name: Verify multi-platform Docker image tags
        env:
          DOCKER_CONFIG: ${{ runner.temp }}/docker-auth
        run: |
          set -euo pipefail
          for image in \
            "ghcr.io/rocicorp/zero:$VERSION" \
            "docker.io/rocicorp/zero:$VERSION"; do
            platforms=$(docker buildx imagetools inspect "$image" --raw |
              jq -r '.manifests[].platform | select(.os == "linux") | .architecture' |
              sort -u | paste -sd, -)
            if [ "$platforms" != 'amd64,arm64' ]; then
              echo "Expected $image to contain linux/amd64 and linux/arm64, got: $platforms" >&2
              exit 1
            fi
          done

      - name: Sign Docker images
        env:
          DOCKER_CONFIG: ${{ runner.temp }}/docker-auth
        run: |
          cosign sign --yes "ghcr.io/rocicorp/zero:$VERSION"
          cosign sign --yes "docker.io/rocicorp/zero:$VERSION"

      - name: Summarize Docker release
        run: |
          {
            printf '## Docker\n\n'
            printf 'Docker Hub: `%s`\n\n' "rocicorp/zero:$VERSION"
            printf 'GHCR: `%s`\n' "ghcr.io/rocicorp/zero:$VERSION"
            if [ "$MODE" = 'head' ]; then
              printf 'Docker Hub tag: `%s`\n\n' "rocicorp/zero:head"
              printf 'GHCR tag: `%s`\n' "ghcr.io/rocicorp/zero:head"
            fi
          } >> "$GITHUB_STEP_SUMMARY"

  tag:
    name: Push git tag
    runs-on: ubuntu-latest
    needs: [plan, publish-npm, publish-docker]
    # Head versions and OCI labels identify commits without git tags.
    if: needs.plan.outputs.mode != 'head'
    permissions:
      contents: write # To push the release tag.
    env:
      MODE: ${{ needs.plan.outputs.mode }}
      SCRIPTS: ${{ github.workspace }}/ci/scripts/src
      SOURCE_SHA: ${{ needs.plan.outputs.source_sha }}
      TAG: ${{ needs.plan.outputs.tag }}
      VERSION: ${{ needs.plan.outputs.version }}
    steps:
      - name: Checkout workflow scripts
        # Use release tooling from main; the source checkout only supplies git objects.
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: main
          path: ci
          persist-credentials: false
          sparse-checkout: scripts

      - name: Checkout release source
        # zizmor: ignore[artipacked] Keep the token needed to push the tag.
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          path: source
          ref: ${{ needs.plan.outputs.source_sha }}
          persist-credentials: true

      - name: Create and push tag
        working-directory: source
        run: node "$SCRIPTS/release-create-tag.ts" "$MODE" "$VERSION" "$TAG" "$SOURCE_SHA"