beta-release.yml

name: Beta Release

on:
  push:
    branches: [main]

permissions:
  contents: write

jobs:
  # ── Stage 1: Test & Build Validation ──────────────────────────────
  validate:
    name: Test & Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.25"

      - name: Download dependencies
        run: go mod download

      - name: Vet
        run: go vet ./...

      - name: Test
        run: go test ./... -v -race

      - name: Build (sanity check)
        run: go build -o /dev/null ./cmd/routatic-proxy

  # ── Stage 2: Package & Verify RPMs (Linux runner) ─────────────────
  # RPMs are built here rather than in the release job because rpm(8) — and so
  # any real introspection of what we are about to publish — only exists on
  # Linux. The finished .rpm files travel to the release job as a workflow
  # artifact so every asset still goes into one atomic `gh release create`
  # (this repo publishes immutable releases, which reject later uploads).
  rpm:
    name: Package & Verify RPMs
    needs: validate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.25"
          cache: true

      - name: Get versions
        id: version
        run: |
          # Same derivation as the release job (fetch-depth: 0 above is required
          # — the script reads tags from origin/releases) so the version baked
          # into the packaged binary matches the published raw binaries exactly.
          chmod +x .github/scripts/get-versions.sh
          VERSIONS_JSON=$(.github/scripts/get-versions.sh)
          BETA_VERSION=$(echo "$VERSIONS_JSON" | jq -r '.beta_version')

          echo "version=${BETA_VERSION#v}" >> "$GITHUB_OUTPUT"
          echo "Beta tag: ${BETA_VERSION}"

      - name: Ensure rpm tooling
        run: |
          set -euo pipefail
          # ubuntu-latest ships rpm/rpm2cpio/cpio today; install rather than
          # assume, so a runner image change turns into a slower job and not a
          # silently skipped verification.
          MISSING=""
          for TOOL in rpm rpm2cpio cpio; do
            command -v "$TOOL" >/dev/null 2>&1 || MISSING="$MISSING $TOOL"
          done
          if [ -n "$MISSING" ]; then
            echo "Installing missing tooling:$MISSING"
            sudo apt-get update
            sudo apt-get install -y rpm cpio
          fi
          rpm --version

      - name: Build RPM packages
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: bash .github/scripts/build-rpms.sh

      - name: Verify RPM packages
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          set -euo pipefail
          # nfpm's semver schema rewrites 0.6.4-beta.1 -> 0.6.4~beta.1.
          RPM_VERSION="$(printf '%s' "$VERSION" | tr '-' '~')"
          bash .github/scripts/verify-rpm.sh \
            "dist/routatic-proxy-${RPM_VERSION}-1.x86_64.rpm" "$VERSION" x86_64 3e00
          bash .github/scripts/verify-rpm.sh \
            "dist/routatic-proxy-${RPM_VERSION}-1.aarch64.rpm" "$VERSION" aarch64 b700

      - name: Upload RPM packages
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: rpm-packages
          path: dist/*.rpm
          if-no-files-found: error
          retention-days: 7

  # ── Stage 3: Build & Release (macOS runner for DMG support) ──────
  release:
    name: Build & Release
    needs: [validate, rpm]
    runs-on: macos-latest
    outputs:
      beta_tag: ${{ steps.version.outputs.beta_tag }}
      prod_version: ${{ steps.version.outputs.prod_version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.25"
          cache: true

      - name: Check signing availability
        id: signing
        env:
          USE_SIGNPATH: ${{ vars.USE_SIGNPATH }}
        run: echo "enabled=$([ "$USE_SIGNPATH" = "true" ] && echo true || echo false)" >> "$GITHUB_OUTPUT"

      - name: Get versions
        id: version
        run: |
          # Make script executable and run it
          chmod +x .github/scripts/get-versions.sh

          # Run script and capture JSON output
          VERSIONS_JSON=$(.github/scripts/get-versions.sh)

          # Extract values using jq
          PROD_VERSION=$(echo "$VERSIONS_JSON" | jq -r '.prod_version')
          BETA_VERSION=$(echo "$VERSIONS_JSON" | jq -r '.beta_version')

          echo "prod_version=${PROD_VERSION}" >> "$GITHUB_OUTPUT"
          echo "beta_tag=${BETA_VERSION}" >> "$GITHUB_OUTPUT"
          echo "version=${BETA_VERSION#v}" >> "$GITHUB_OUTPUT"

          echo "Production version: ${PROD_VERSION}"
          echo "Beta tag: ${BETA_VERSION}"

      - name: Generate Windows resource files
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          go install github.com/tc-hib/go-winres@v0.3.3

          # Parse version components (e.g., "0.5.3-beta.1" → "0.5.3.0")
          CLEAN_VER=$(echo "$VERSION" | sed 's/-.*//')
          MAJOR=$(echo "$CLEAN_VER" | cut -d. -f1)
          MINOR=$(echo "$CLEAN_VER" | cut -d. -f2)
          PATCH=$(echo "$CLEAN_VER" | cut -d. -f3)
          FILE_VER="${MAJOR:-0}.${MINOR:-0}.${PATCH:-0}.0"

          # Update version in winres.json
          cd cmd/routatic-proxy
          sed -i.bak "s/\"file_version\": \"0.0.0.0\"/\"file_version\": \"${FILE_VER}\"/" winres/winres.json
          sed -i.bak "s/\"product_version\": \"0.0.0.0\"/\"product_version\": \"${FILE_VER}\"/" winres/winres.json
          sed -i.bak "s/\"FileVersion\": \"0.0.0.0\"/\"FileVersion\": \"${VERSION}\"/" winres/winres.json
          sed -i.bak "s/\"ProductVersion\": \"0.0.0.0\"/\"ProductVersion\": \"${VERSION}\"/" winres/winres.json
          rm -f winres/winres.json.bak

          # Generate .syso files for both Windows architectures
          go-winres make --arch amd64 --out rsrc_windows_amd64.syso
          go-winres make --arch arm64 --out rsrc_windows_arm64.syso
          cd ../..

      - name: Build cross-platform binaries
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          mkdir -p dist

          LDFLAGS="-X main.version=${VERSION}"

          # Define target platforms (bash 3 compatible — macOS default)
          TARGETS="darwin-amd64:darwin/amd64 darwin-arm64:darwin/arm64 linux-amd64:linux/amd64 linux-arm64:linux/arm64 windows-amd64:windows/amd64 windows-arm64:windows/arm64"

          for TARGET in $TARGETS; do
            NAME="${TARGET%%:*}"
            PAIR="${TARGET##*:}"
            GOOS="${PAIR%/*}"
            GOARCH="${PAIR#*/}"
            EXT=""
            [ "$GOOS" = "windows" ] && EXT=".exe"

            echo "Building ${NAME}..."
            CGO_ENABLED=0 GOOS="$GOOS" GOARCH="$GOARCH" \
              go build -ldflags "$LDFLAGS -s -w" \
                -o "dist/routatic-proxy_${NAME}${EXT}" \
                ./cmd/routatic-proxy
          done

          echo ""
          echo "Built binaries:"
          ls -lh dist/

      # Guards the raw linux-amd64/linux-arm64 binaries that this job publishes
      # directly as release assets. The RPM job verifies its own copies; this
      # check is independent, because a bad cross-compile here would ship to
      # users via the plain downloads and the Homebrew formula.
      - name: Verify Linux binaries
        run: |
          set -euo pipefail

          # Read the ELF header directly instead of grepping `file` output:
          # macOS and Linux word it differently, and a guard that silently
          # always passes is worse than no guard.
          #   bytes 0-3  magic  7f 45 4c 46
          #   byte  4    class  02 = 64-bit
          #   byte  5    data   01 = little-endian
          #   bytes 18-19 e_machine (LE): 3e00 = x86-64, b700 = AArch64
          check() {
            BIN="dist/routatic-proxy_linux-$1"
            EXPECT_MACHINE="$2"

            if [ ! -f "$BIN" ]; then
              echo "::error::Missing $BIN — the cross-compile step did not produce it"
              exit 1
            fi
            if [ ! -x "$BIN" ]; then
              echo "::error::$BIN is not executable"
              exit 1
            fi

            HEADER=$(dd if="$BIN" bs=1 count=20 2>/dev/null | od -An -tx1 | tr -d ' \n')
            MAGIC="${HEADER:0:8}"
            CLASS="${HEADER:8:2}"
            MACHINE="${HEADER:36:4}"

            if [ "$MAGIC" != "7f454c46" ]; then
              echo "::error::$BIN is not an ELF binary (magic=$MAGIC)"
              exit 1
            fi
            if [ "$CLASS" != "02" ]; then
              echo "::error::$BIN is not 64-bit ELF (class=$CLASS)"
              exit 1
            fi
            if [ "$MACHINE" != "$EXPECT_MACHINE" ]; then
              echo "::error::$BIN has wrong ELF machine: got $MACHINE, want $EXPECT_MACHINE"
              exit 1
            fi

            echo "$1: ok (ELF64, e_machine=$MACHINE)"
          }

          check amd64 3e00
          check arm64 b700

      - name: Stage Windows binaries for signing
        if: ${{ steps.signing.outputs.enabled == 'true' }}
        run: |
          mkdir -p signing
          cp dist/routatic-proxy_windows-amd64.exe signing/
          cp dist/routatic-proxy_windows-arm64.exe signing/

      - name: Upload unsigned Windows binaries
        id: upload-unsigned
        if: ${{ steps.signing.outputs.enabled == 'true' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: windows-binaries-unsigned
          path: signing/

      - name: Sign Windows binaries (SignPath)
        if: ${{ steps.signing.outputs.enabled == 'true' }}
        uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
        with:
          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
          organization-id: '5c4d4e48-c428-4e10-ab07-8db7f46cbec9'
          project-slug: 'routatic-proxy'
          signing-policy-slug: 'release-signing'
          artifact-configuration-slug: 'windows-exe'
          github-artifact-id: '${{ steps.upload-unsigned.outputs.artifact-id }}'
          wait-for-completion: true
          output-artifact-directory: 'signed'
          wait-for-completion-timeout-in-seconds: 300

      - name: Replace with signed Windows binaries
        if: ${{ steps.signing.outputs.enabled == 'true' }}
        run: |
          cp signed/routatic-proxy_windows-amd64.exe dist/routatic-proxy_windows-amd64.exe
          cp signed/routatic-proxy_windows-arm64.exe dist/routatic-proxy_windows-arm64.exe
          rm -rf signing signed

      # The RPMs were built and introspected on Linux (see the rpm job). Passing
      # them through an artifact is safe: the executable bit lives inside the
      # RPM payload, not on the .rpm file itself.
      - name: Download RPM packages
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: rpm-packages
          path: dist

      - name: Verify RPM packages arrived
        run: |
          set -euo pipefail
          COUNT=$(find dist -maxdepth 1 -name 'routatic-proxy-*.rpm' | wc -l | tr -d ' ')
          if [ "$COUNT" -ne 2 ]; then
            echo "::error::Expected 2 RPMs from the rpm job artifact, found ${COUNT}"
            ls -la dist
            exit 1
          fi
          ls -lh dist/*.rpm

      - name: Generate checksums
        run: |
          cd dist
          # Covers the raw binaries (routatic-proxy_*) and the RPMs
          # (routatic-proxy-<version>-<rel>.<arch>.rpm) in one pass. Neither
          # glob can match checksums.txt itself.
          sha256sum routatic-proxy_* routatic-proxy-*.rpm > checksums.txt
          cat checksums.txt

      - name: Build CGO-enabled binary (for DMG)
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          CGO_ENABLED=1 go build -tags darwin -ldflags "-X main.version=${VERSION}" -o bin/routatic-proxy ./cmd/routatic-proxy

      - name: Build macOS DMG
        env:
          VERSION: ${{ steps.version.outputs.beta_tag }}
        run: |
          brew install create-dmg
          make dmg VERSION=${{ env.VERSION }}

      - name: Generate AI Changelog
        id: changelog
        env:
          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
          OPENROUTER_MODEL: ${{ secrets.OPENROUTER_MODEL }}
          OPENROUTER_TEMPERATURE: ${{ secrets.OPENROUTER_TEMPERATURE }}
          OPENROUTER_MAX_TOKENS: ${{ secrets.OPENROUTER_MAX_TOKENS }}
        run: |
          brew install jq

          # Configuration with defaults
          MODEL="${OPENROUTER_MODEL:-openai/gpt-4o-mini}"
          TEMP="${OPENROUTER_TEMPERATURE:-0.3}"
          TOKENS="${OPENROUTER_MAX_TOKENS:-2000}"

          echo "Using OpenRouter model: $MODEL"

          # Generate changelog for commits since previous beta tag or prod tag
          PREVIOUS_TAG=$(git describe --tags --abbrev=0 --match "v*-*" 2>/dev/null || git describe --tags --abbrev=0 --match "v[0-9]*.[0-9]*.[0-9]*" 2>/dev/null || echo "")

          if [ -n "$PREVIOUS_TAG" ]; then
            echo "Generating AI changelog from $PREVIOUS_TAG to ${{ steps.version.outputs.beta_tag }}"

            COMMITS=$(git log "${PREVIOUS_TAG}..HEAD" --pretty=format:"%H%n%s%n%b%n---COMMIT_SEP---")
            FILE_CHANGES=$(git diff --stat "${PREVIOUS_TAG}..HEAD")

            PROMPT="You are a technical writer generating release notes for a Go proxy server project (routatic-proxy).

            Analyze the provided git commits and file changes, then generate a well-structured
            changelog in Markdown format. Follow these guidelines:

            1. Start with a brief summary paragraph (2-3 sentences) describing the overall theme of this beta release
            2. Group changes into sections with these exact headers:
               - **New Features** - New capabilities, enhancements, additions
               - **Bug Fixes** - Fixes for reported or discovered issues
               - **Improvements** - Performance, reliability, or code quality improvements
               - **Documentation** - README, docs, comments, config updates
               - **Chores** - Build, CI/CD, dependency updates, refactoring
            3. Each bullet should be concise but descriptive (one line)
            4. Mention breaking changes prominently with a warning emoji Breaking Changes section at the top
            5. Use present tense, imperative mood (e.g., Add feature not Added feature)
            6. Keep it technical but accessible - target audience is developers using this tool
            7. This is a beta release - include a note at the end about testing and feedback

            Format output as clean Markdown without any preamble or explanation. Do not wrap the entire response in a code block."

            USER_CONTENT="Git commits since ${PREVIOUS_TAG}:\n\n${COMMITS}\n\nFiles changed:\n\n${FILE_CHANGES}"

            # Truncate if too long (~4 chars per token)
            MAX_CHARS=12000
            if [ "${#USER_CONTENT}" -gt "$MAX_CHARS" ]; then
              USER_CONTENT="${USER_CONTENT:0:MAX_CHARS}\n\n[...truncated for length...]"
            fi

            RESPONSE=$(curl -s -L -X POST "https://openrouter.ai/api/v1/chat/completions" \
              -H "Authorization: Bearer ${OPENROUTER_API_KEY}" \
              -H "Content-Type: application/json" \
              -d "$(jq -n \
                --arg prompt "$PROMPT" \
                --arg user "$USER_CONTENT" \
                --arg model "$MODEL" \
                --arg temp "$TEMP" \
                --arg tokens "$TOKENS" \
                '{
                  model: $model,
                  messages: [
                    {role: "system", content: $prompt},
                    {role: "user", content: $user}
                  ],
                  temperature: ($temp | tonumber),
                  max_tokens: ($tokens | tonumber)
                }' \
              )" \
            )

            CHANGELOG=$(echo "$RESPONSE" | jq -r '.choices[0].message.content // empty')

            if [ -z "$CHANGELOG" ] || [ "$CHANGELOG" = "null" ]; then
              echo "Warning: AI changelog generation failed, using commit list instead" >&2
              echo "API response: $RESPONSE" >&2
              CHANGELOG="## Commits\n\n$(git log "${PREVIOUS_TAG}..HEAD" --pretty=format:'- %s')"
            fi
          else
            echo "No previous tag found, using commit list"
            CHANGELOG="## Commits\n\n$(git log --pretty=format:'- %s' -20)"
          fi

          echo "$CHANGELOG" > changelog.md
          cat changelog.md

      # GITHUB_TOKEN works here — same repo
      # Use gh release create for atomic asset upload (immutable release support)
      - name: Create GitHub Prerelease
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "${{ steps.version.outputs.beta_tag }}" \
            --title "Beta Release ${{ steps.version.outputs.beta_tag }}" \
            --notes-file changelog.md \
            --prerelease \
            dist/routatic-proxy_* \
            dist/routatic-proxy-*.rpm \
            dist/checksums.txt \
            bin/RoutaticProxy.dmg

  # ── Stage 3: Publish Docker Image ───────────────────────────────
  docker:
    name: Publish Docker Image
    needs: release
    permissions:
      contents: read
      packages: write
    if: github.repository == 'routatic/proxy'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0

      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0

      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=raw,value=${{ needs.release.outputs.beta_tag }}
            type=raw,value=beta-${{ needs.release.outputs.prod_version }}
            type=raw,value=beta

      - name: Strip v prefix from version
        id: version
        env:
          TAG: ${{ needs.release.outputs.beta_tag }}
        run: echo "value=${TAG#v}" >> "$GITHUB_OUTPUT"

      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: VERSION=${{ steps.version.outputs.value }}
          cache-from: type=gha
          cache-to: type=gha,mode=max