release.yaml

---
name: Release

# Publish the version in config.yaml only after CI succeeds on the current
# default-branch head. Re-running this workflow is safe.
# yamllint disable-line rule:truthy
on:
  workflow_run:
    workflows: ["CI"]
    branches: [main]
    types:
      - completed

concurrency:
  group: release
  cancel-in-progress: false

permissions: {}

jobs:
  validate:
    name: Validate version from config.yaml
    if: >
      github.event.workflow_run.conclusion == 'success'
      && github.event.workflow_run.event == 'push'
      && github.event.workflow_run.head_branch
        == github.event.repository.default_branch
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      deploy: ${{ steps.candidate.outputs.deploy }}
      published: ${{ steps.candidate.outputs.publish }}
      tag: ${{ steps.candidate.outputs.tag }}
    env:
      DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
      REPOSITORY: ${{ github.repository }}
    steps:
      - name: ⤵️ Check out tested revision
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ env.HEAD_SHA }}

      - name: 🔎 Validate release candidate
        id: candidate
        shell: bash
        run: |
          set -Eeuo pipefail

          version_lines="$(grep -Ec '^version:[[:space:]]*[^[:space:]]+[[:space:]]*$' cloudflared/config.yaml || true)"
          if [[ "$version_lines" -ne 1 ]]; then
            echo "::error file=cloudflared/config.yaml::Expected exactly one unquoted top-level version value"
            exit 1
          fi

          version="$(sed -nE 's/^version:[[:space:]]*([^[:space:]]+)[[:space:]]*$/\1/p' cloudflared/config.yaml)"
          if [[ ! "$version" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
            echo "::error file=cloudflared/config.yaml::Version '$version' is not a stable SemVer value (X.Y.Z)"
            exit 1
          fi

          remote_sha="$(gh api "repos/$REPOSITORY/commits/$DEFAULT_BRANCH" --jq .sha)"
          if [[ "$HEAD_SHA" != "$remote_sha" ]]; then
            echo "::notice::Skipping stale CI revision $HEAD_SHA; current $DEFAULT_BRANCH is $remote_sha"
            echo "publish=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          latest_version="$(
            git tag --list 'v*' |
              sed -nE 's/^v((0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*))$/\1/p' |
              sort -V |
              tail -n 1
          )"

          tag="v$version"
          if [[ -n "$latest_version" && "$version" == "$latest_version" ]]; then
            release="$(gh api "repos/$REPOSITORY/releases/tags/$tag")"
            if [[ "$(jq -r .draft <<< "$release")" != "false" ]]; then
              echo "::error::Existing release $tag is unexpectedly still a draft"
              exit 1
            fi

            owner="${GITHUB_REPOSITORY_OWNER,,}"
            image="ghcr.io/$owner/cloudflared"
            if docker manifest inspect "$image:$version" >/dev/null 2>&1 \
              && docker manifest inspect "$image:stable" >/dev/null 2>&1; then
              echo "::notice::$tag and its stable container manifests already exist; nothing to publish"
              echo "deploy=false" >> "$GITHUB_OUTPUT"
              echo "publish=false" >> "$GITHUB_OUTPUT"
              exit 0
            fi

            echo "::warning::$tag exists, but its stable container manifests are missing; repairing deployment"
            echo "deploy=true" >> "$GITHUB_OUTPUT"
            echo "publish=false" >> "$GITHUB_OUTPUT"
            echo "tag=$tag" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          greatest_version="$(printf '%s\n%s\n' "$latest_version" "$version" | sort -V | tail -n 1)"
          if [[ -n "$latest_version" && "$greatest_version" != "$version" ]]; then
            echo "::error file=cloudflared/config.yaml::Version $version must be greater than v$latest_version"
            exit 1
          fi

          if git rev-parse --verify --quiet "refs/tags/$tag" >/dev/null; then
            echo "::error::$tag already exists"
            exit 1
          fi

          echo "deploy=true" >> "$GITHUB_OUTPUT"
          echo "publish=true" >> "$GITHUB_OUTPUT"
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          echo "Validated release candidate $tag at $HEAD_SHA"

  publish:
    name: Publish release
    needs: validate
    if: needs.validate.outputs.published == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
      REPOSITORY: ${{ github.repository }}
      TAG: ${{ needs.validate.outputs.tag }}
    steps:
      - name: 🚀 Publish release as latest
        shell: bash
        run: |
          set -Eeuo pipefail

          remote_sha="$(gh api "repos/$REPOSITORY/commits/$DEFAULT_BRANCH" --jq .sha)"
          if [[ "$HEAD_SHA" != "$remote_sha" ]]; then
            echo "::error::Default branch moved after validation; refusing to publish a stale revision"
            exit 1
          fi

          gh api --method POST "repos/$REPOSITORY/releases" \
            -f tag_name="$TAG" \
            -f target_commitish="$HEAD_SHA" \
            -f name="$TAG" \
            -F draft=false \
            -F prerelease=false \
            -F generate_release_notes=true \
            -f make_latest=true \
            --jq '"Published \(.html_url)"'

      - name: 📝 Summarize release
        env:
          TAG: ${{ needs.validate.outputs.tag }}
        run: |
          {
            echo "## Released $TAG"
            echo ""
            echo "Published the tested revision \`$HEAD_SHA\` as the latest release."
            echo "The stable container deployment follows this job directly."
          } >> "$GITHUB_STEP_SUMMARY"

  deploy:
    name: Deploy stable release
    needs:
      - validate
      - publish
    if: >
      always()
      && needs.validate.outputs.deploy == 'true'
      && (needs.publish.result == 'success' || needs.publish.result == 'skipped')
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/upstream-deploy.yaml
    with:
      event_name: release
      release_prerelease: false
      release_tag_name: ${{ needs.validate.outputs.tag }}