# A release: pushing a tag v<version> builds that commit exactly as the nightly does -- the
# acceptance protocol, the proofs, the board images -- and the documents, and publishes both to
# starshipos-releases at that version:
#
#   org.starship:kernelImage:<version>     classifiers pc, pc-stick, raspi5, milkv, logs (nightly.yml)
#   org.starship:documentation:<version>   classifiers book, vol1, vol2, vol3, api (nightly-docs.yml)
#
# and makes the tag a Gitea release -- a pre-release for v<x.y.z>-alpha.N and the like -- with the
# images, SHA256SUMS, the documents and the StarshipOS Root CA's certificate attached, for anyone
# to download (#126; scripts/nightly.sh gitea-release). Needs the secret RELEASE_TOKEN: a token
# that may write the repository.
#
# The tag must name the version the tree says it is: v<LITHOS_VERSION> (kernel/Makefile). A tag
# that does not is refused before anything is built. A release repository takes a version once.
name: Release

on:
  push:
    tags: ['v*']

concurrency:
  group: qemu                     # every workflow shares this one group: one run at a time,
                                  # a runner-image rebuild included (Captain Bob, 2026-11-07)
  cancel-in-progress: false

jobs:
  release:
    name: Release ${{ github.ref_name }}
    runs-on: ubuntu-latest
    container:
      image: gitea.starshipos-f18.org/rajames/lithosananke-runner:4f675c8b75b2   # ci/runner-image (#120)
      credentials:                # the registry refuses anonymous pulls
        username: rajames
        password: ${{ secrets.PACKAGES_TOKEN }}
    timeout-minutes: 240
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          lfs: false

      - name: The capsule-signing key
        env:
          KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
        run: |                    # ci/pki/make-ca.sh; kernel/Makefile signs with SIGN_KEY
          if [ -n "$KEY" ]; then
            f="${RUNNER_TEMP:-/tmp}/capsule-signing.key"
            (umask 077; printf '%s\n' "$KEY" > "$f")
            echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
          else
            echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
          fi

      - name: The tag names the tree's version
        run: |
          tree="v$(sed -n 's/^LITHOS_VERSION *?= *//p' kernel/Makefile)"
          echo "tag ${{ github.ref_name }}, kernel/Makefile LITHOS_VERSION -> $tree"
          [ "${{ github.ref_name }}" = "$tree" ] || { echo "The tag must be $tree, or LITHOS_VERSION changed first."; exit 1; }
          echo "NIGHTLY_VERSION=${tree#v}" >> "$GITHUB_ENV"

      - name: Install the dependencies
        # INIT_PROOFS=0: the image's Isabelle has HOL-Library prebuilt; a full init would fetch a fresh
        # Isabelle into the workspace and point isabelle at it, and the proofs would build HOL-Library
        # from scratch -- killed (release run 196, v4.0.0-alpha.1)
        run: make ARCH=amd64,aarch64,riscv64 init INIT_PROOFS=0   # the image has all but the documents' packages

      - name: Acceptance amd64
        run: scripts/nightly.sh accept amd64
      - name: Acceptance aarch64
        run: scripts/nightly.sh accept aarch64
      - name: Acceptance riscv64
        run: scripts/nightly.sh accept riscv64
      - name: Acceptance PC stick loaded high
        run: scripts/nightly.sh accept stick-high
      - name: Acceptance 32-bit build
        run: scripts/nightly.sh test-32
      - name: Isabelle/HOL proofs
        run: scripts/nightly.sh proofs
      - name: Images
        run: scripts/nightly.sh images
      - name: Documents
        run: scripts/nightly.sh docs

      - name: Publish to Nexus
        env:
          NEXUS_USER: ci-publisher
          NEXUS_PASSWORD: ${{ secrets.NEXUS_CI_PASSWORD }}
        run: |
          scripts/nightly.sh publish https://nexus.starshipos-f18.org/repository/starshipos-releases
          scripts/nightly.sh publish-docs https://nexus.starshipos-f18.org/repository/starshipos-releases

      - name: Gitea release              # the downloads anyone can fetch (#126): no Nexus login
        env:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}   # a token that may write the repository
        run: scripts/nightly.sh gitea-release "${{ github.ref_name }}"

      - name: Keep the release
        uses: actions/upload-artifact@v3
        with:
          name: release-${{ github.ref_name }}
          path: |
            build/nightly/
            build/nightly-docs/

      - name: Keep the logs and DoE CSVs
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: release-logs-${{ github.ref_name }}
          path: |
            logs/
            experiments/bare_metal/runs/