release.yml

# Workflow for creating releases
#
# This workflow is triggered by the `version.yml` workflow when a version
# tag is created (one starting with `v`).
#
# It also has inputs to allow all, or some jobs, to be triggered manually via
# https://github.com/stencila/stencila/actions/workflows/release.yml.
# This is useful for fixing parts of the release without creating a new tag, or
# moving an existing tag.

name: Release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: The tag to create the release for e.g. v2.1.0
        type: string
        required: true
      create-release:
        description: Create release
        type: boolean
        default: true
      build-cli:
        description: Build CLI
        type: boolean
        default: true
      publish-ts:
        description: Publish @stencila/types
        type: boolean
        default: true
      build-node:
        description: Build Node.js SDK addons
        type: boolean
        default: true
      publish-node:
        description: Publish Node.js SDK
        type: boolean
        default: true
      build-python:
        description: Build Python SDK wheels
        type: boolean
        default: true
      publish-python:
        description: Publish Python SDK
        type: boolean
        default: true
      publish-docker:
        description: Build and Push Docker image
        type: boolean
        default: true
      publish-release:
        description: Publish release
        type: boolean
        default: true

env:
  RUST_VERSION: "1.76.0"
  NODE_VERSION: "20"
  PYTHON_VERSION: "3.11"

jobs:
  # Create a draft release
  create-release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout repository
        # Needed only because `gh` errors if not in a repo
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}

      - name: Create release
        # Put `if` here because all subsequent jobs `need` it so will not
        # run if this one does not
        if: ${{ inputs.create-release }}
        run: gh release create ${{ inputs.tag }} --title ${{ inputs.tag }} --draft
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # Build and upload CLI
  build-cli:
    if: ${{ inputs.build-cli }}
    needs: [create-release]
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            ext: tar.xz
          - os: macos-latest
            target: x86_64-apple-darwin
            ext: tar.xz
          - os: macos-latest
            target: aarch64-apple-darwin
            ext: tar.xz
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            ext: zip
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_VERSION }}
          targets: ${{ matrix.target }}

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Build and archive CLI
        run: make -C rust build archive -e TARGET=${{ matrix.target }}

      - name: Upload archive
        run: gh release upload ${{ inputs.tag }} target/cli-${{ inputs.tag }}-${{ matrix.target }}.${{ matrix.ext }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # Build and publish @stencila/types package
  publish-ts:
    if: ${{ inputs.publish-ts }}
    needs: [create-release]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}

      - name: Setup Node.js and NPM
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          registry-url: "https://registry.npmjs.org"

      - name: Publish @stencila/types
        run: make -C ts -B install publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  # Build and upload Node SDK binary addons
  build-node:
    if: ${{ inputs.build-node }}
    needs: [create-release]
    strategy:
      fail-fast: false
      matrix:
        # See `node/install.cjs` for the correct target to use
        include:
          - os: ubuntu-latest
            target: linux-x64-gnu
          - os: buildjet-8vcpu-ubuntu-2204-arm
            target: linux-arm64-gnu
          - os: macos-latest
            target: darwin-x64
          - os: macos-latest-xlarge
            target: darwin-arm64
          - os: windows-latest
            target: win32-x64-msvc
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_VERSION }}

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Setup Node.js and NPM
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          registry-url: "https://registry.npmjs.org"

      - name: Build package
        # This avoids various issues with doing just `npm install` here by
        # only installing `napi` (globally, so other deps are not installed).
        # Here be dragons; change with care.
        run: |
          npm install --global @napi-rs/cli
          cd node && npm run build:addon

      - name: Upload addon
        # Use `matrix.target` here instead of `*` glob because the latter does not work on Windows
        run: gh release upload ${{ inputs.tag }} node/stencila.${{ matrix.target }}.node.gz
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # Publish @stencila/node package
  publish-node:
    if: ${{ inputs.publish-node }}
    needs: [build-node]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}

      - name: Setup Node.js and NPM
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          registry-url: "https://registry.npmjs.org"

      - name: Publish @stencila/node
        run: make -C node -B publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  # Build Python SDK
  # Based on https://github.com/messense/py-dissimilar/blob/main/.github/workflows/CI.yml
  build-python:
    if: ${{ inputs.build-python }}
    needs: [create-release]
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-20.04
            architecture: x64
            target: x64
            interpreter: 3.8 3.9 3.10 3.11 3.12
          - os: ubuntu-latest
            architecture: x64
            target: x64
            interpreter: 3.8 3.9 3.10 3.11 3.12
          - os: macos-latest
            architecture: x64
            target: x64
            interpreter: 3.8 3.9 3.10 3.11 3.12
          - os: macos-latest-xlarge
            architecture: arm64
            target: aarch64
            interpreter: 3.8 3.9 3.10 3.11 3.12
          - os: windows-latest
            architecture: x64
            target: x64
            interpreter: 3.8 3.9 3.10 3.11 3.12
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_VERSION }}

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          architecture: ${{ matrix.architecture }}

      - name: Build wheel
        uses: PyO3/maturin-action@v1
        with:
          working-directory: python
          target: ${{ matrix.target }}
          # Test changes to these args using the `build` recipe in the `python/Makefile`
          args: --release --out dist --interpreter ${{ matrix.interpreter }}

      - name: Upload wheel
        uses: actions/upload-artifact@v4
        with:
          name: wheels
          path: python/dist

  # Publish Python SDK
  # This action should not checkout the repository because that adds other,
  # non-wheel files to the upload and thereby causes the upload to fail.
  publish-python:
    if: ${{ inputs.publish-python }}
    needs: [build-python]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: wheels

      - name: Publish to PyPI
        uses: PyO3/maturin-action@v1
        env:
          MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
        with:
          command: upload
          args: --skip-existing *

  # Build and push Docker image
  # Based on https://docs.github.com/en/actions/publishing-packages/publishing-docker-images
  publish-docker:
    if: ${{ inputs.publish-docker }}
    needs: [create-release]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Log in to the GitHub container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            stencila/stencila
            ghcr.io/${{ github.repository }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            stencila/stencila:latest
            stencila/stencila:${{ inputs.tag }}
          labels: ${{ steps.meta.outputs.labels }}

  # Publish the draft release
  # Wait for all packages to be published so that the `install.yml` workflow
  # that this triggers tests this release and not a previous version
  publish-release:
    if: ${{ inputs.publish-release }}
    needs: [build-cli, publish-ts, publish-node, publish-python, publish-docker]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      actions: write
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Checkout repository
        # Needed only because `gh` errors if not in a repo
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}

      - name: Mark release as non-draft
        run: gh release edit ${{ inputs.tag }} --draft=false

      - name: Trigger installation test workflow
        # Sleep for a while to allow last published assets (usually Python packages)
        # to be made available on package repositories before attempting to install them
        run: sleep 90 && gh workflow run install.yml