release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      version:
        description: Version number (with or without a v prefix)
        required: true
        type: string
      skip_github_release:
        description: Skip creating the GitHub release
        required: false
        default: false
        type: boolean

env:
  CONTROLLER_IMAGE: ghcr.io/${{ github.repository_owner }}/agentdesktop-controller
  CHART_REGISTRY: ghcr.io/${{ github.repository_owner }}/charts

jobs:
  setup:
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - name: Set canonical version
        id: version
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          RELEASE_REF: ${{ github.ref }}
          VERSION_INPUT: ${{ inputs.version || github.ref_name }}
        run: |
          if [[ "${EVENT_NAME}" == "workflow_dispatch" && "${RELEASE_REF}" != "refs/heads/main" ]]; then
            case "${RELEASE_REF}" in
              refs/tags/v*.*.*) ;;
              *)
                echo "Manual releases must run from main or an existing v*.*.* tag" >&2
                exit 1
                ;;
            esac
          fi

          VERSION="${VERSION_INPUT}"
          VERSION="${VERSION#v}"
          if [[ ! "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
            echo "Version must be SemVer (for example, 1.2.3 or v1.2.3)" >&2
            exit 1
          fi
          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"

  linux:
    needs: setup
    permissions:
      contents: read
      packages: write
      id-token: write
    uses: ./.github/workflows/release-linux.yml
    with:
      version: ${{ needs.setup.outputs.version }}

  macos:
    needs: setup
    permissions:
      contents: read
    uses: ./.github/workflows/release-macos.yml
    with:
      version: ${{ needs.setup.outputs.version }}
    secrets:
      APPLE_APPLICATION_CERTIFICATE: ${{ secrets.APPLE_APPLICATION_CERTIFICATE }}
      APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}

  windows:
    needs: setup
    permissions:
      contents: read
      id-token: write
    uses: ./.github/workflows/release-windows.yml
    with:
      version: ${{ needs.setup.outputs.version }}

  release:
    if: github.event_name == 'push' || !inputs.skip_github_release
    needs:
      - setup
      - linux
      - macos
      - windows
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - name: Download binaries
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: release
          pattern: release-binary-*
          merge-multiple: true

      - name: Download signed Windows installers
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: release
          pattern: signed-windows-installer-*
          merge-multiple: true

      - name: Create GitHub release
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          files: release/agentdesktop-*
          tag_name: v${{ needs.setup.outputs.version }}
          target_commitish: ${{ github.sha }}
          generate_release_notes: true
          body: |
            ## Artifacts

            - Controller image: `${{ env.CONTROLLER_IMAGE }}:v${{ needs.setup.outputs.version }}`
            - Helm chart: `oci://${{ env.CHART_REGISTRY }}/agentdesktop-controller:${{ needs.setup.outputs.version }}`
            - Agentdesktop binaries for amd64 and arm64 on Linux, macOS, and Windows are attached below.
            - Signed Windows MSI installers for amd64 and arm64 are attached below.
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}