release.yml

name: Release

on:
  workflow_dispatch:
  push:
    branches:
      - master
    tags:
      - v[0-9]+.[0-9]+.[0-9]+

env:
  RELEASE_BRANCH: master
  RELEASE_CANDIDATE_TAG_PATTERN: ^v[0-9]+.[0-9]+.[0-9]+-rc
  RELEASE_SIGNING_KEY_ID_SNAIPE: 75B0 21D9 64AD 8693 24CD  B74D DDD7 BCCD 44BB 9A9D
  RELEASE_SIGNING_KEY_ID_MRANNO: C43B F77A EC43 F382 F604  295E 1E7D F493 9E41 9342
  GITHUB_TOKEN: ${{ github.token }}

jobs:
  release-tag-verification:
    name: "Release tag verification"
    if: github.ref_type == 'tag'
    runs-on: ubuntu-latest
    steps:
      - name: Check out Criterion
        uses: actions/checkout@v3
        with:
          ref: ${{ github.ref }}
          fetch-depth: 0
      - name: Release tag verification
        run: |
          gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys "${RELEASE_SIGNING_KEY_ID_SNAIPE}"
          gpg --keyserver hkps://keys.openpgp.org --recv-keys "${RELEASE_SIGNING_KEY_ID_MRANNO}"
          if ! git tag --verify "$GITHUB_REF_NAME" > git-verify-tag.log 2>&1; then
            gh issue create --title "$GITHUB_REF_NAME tag verification failure" --body-file git-verify-tag.log
            exit 1
          fi

  tarball:
    name: "Source tarball"
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.detect-version.outputs.version }}

    steps:
      - name: Check out Criterion
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Configure git
        run: |
          git config user.name "github-actions"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Install dist dependencies
        run: sudo apt-get update && sudo apt-get install -y meson

      - name: Detect version
        id: detect-version
        run: |
          if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
            version="$GITHUB_REF_NAME"
          else
            version="$(git describe --long)"
            if [[ ! "${version}" =~ ${RELEASE_CANDIDATE_TAG_PATTERN} ]]; then
              printf "Pre-release requires an annotated tag with '-rc' suffix (actual: %s)\n" "${version}"
              exit 1
            fi
          fi
          version="${version:1}"
          echo "${version}"
          echo "version=${version}" >> $GITHUB_OUTPUT

      - name: Create source tarball
        env:
          version: ${{ steps.detect-version.outputs.version }}
        run: |
          meson rewrite kwargs set project / version "${version}"
          git commit --allow-empty -a -m "release: version bump to v${version}"
          meson setup -Dc_std=gnu11 --wrap-mode forcefallback build
          meson dist -C build --include-subprojects --formats xztar

      - name: Upload artifacts
        uses: actions/upload-artifact@v2
        with:
          name: source-tarball
          path: build/meson-dist/criterion-*.tar.xz
          if-no-files-found: error

  binaries:
    name: "Binaries"
    runs-on: ubuntu-latest
    # glibc v2.17 builder
    container: centos:7
    needs: [tarball]
    env:
      version: ${{ needs.tarball.outputs.version }}

    steps:
      - name: Install build dependencies
        run: |
          yum update -y
          yum install -y epel-release centos-release-scl
          yum install -y python3-pip ninja-build cmake3 pkgconfig gcc gcc-c++
          python3 -m pip install meson
          ln -s /usr/bin/cmake3 /usr/bin/cmake

      - name: Download source tarball
        uses: actions/download-artifact@v2
        with:
          name: source-tarball

      - name: Extract source tarball
        run: |
          tar -xf "criterion-${version}.tar.xz" && rm "criterion-${version}.tar.xz"

      - name: Build Criterion
        run: |
          meson setup -Dc_std=gnu11 --prefix /usr/local --libdir lib --buildtype plain \
            --force-fallback-for libffi --wrap-mode nodownload \
            build "criterion-${version}"
          meson compile -C build
          meson install -C build --skip-subprojects --destdir "$(realpath .)/binaries/criterion-${version}"

      - name: Create binary tarball
        run: |
          tar --create --xz --file "binaries/criterion-${version}-linux-x86_64.tar.xz" \
            --exclude='*.a' --transform="s,^\.,criterion-${version}," \
            -C "binaries/criterion-${version}/usr/local" .

      - name: Upload artifacts
        uses: actions/upload-artifact@v2
        with:
          name: binaries
          path: binaries/criterion-*.tar.xz
          if-no-files-found: error

  release:
    name: "Release"
    runs-on: ubuntu-latest
    needs: [tarball, binaries]
    env:
      version: ${{ needs.tarball.outputs.version }}

    steps:
      - name: Check out Criterion
        uses: actions/checkout@v3

      - name: Download source tarball
        uses: actions/download-artifact@v2
        with:
          name: source-tarball

      - name: Download binaries
        uses: actions/download-artifact@v2
        with:
          name: binaries

      - name: Create pre-release
        if: github.ref_type == 'branch'
        run: gh release create --prerelease --target "${RELEASE_BRANCH}" --title "v${version}" "v${version}" criterion-*.tar.xz

      - name: Create release draft
        if: github.ref_type == 'tag'
        run: gh release create --draft --target "${RELEASE_BRANCH}" --title "v${version}" "v${version}" criterion-*.tar.xz