release.yml

name: Release
on:
  release:
    types:
      - published

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  # ── K8E server binary: linux/amd64 ───────────────────────────────────
  build-k8e:
    name: Build k8e
    runs-on: ubuntu-latest
    env:
      GOOS: linux
      GOARCH: amd64
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          check-latest: true
          cache-dependency-path: go.sum
      - name: Setup Zig
        uses: mlugg/setup-zig@v2
        with:
          version: 0.16.0
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y pkg-config build-essential libc6-dev zlib1g-dev libseccomp-dev
      - name: Generate resources
        run: |
          mkdir -p build/data build/static
          make deps
          zig build download
          make generate
      - name: Build k8e
        run: make k8e
      - name: Package CLI (data tarball)
        run: make package-cli
      - name: Package airgap image
        run: make package-airgap
      - name: Rename artifacts
        run: |
          mkdir -p release-artifacts
          cp dist/artifacts/k8e release-artifacts/k8e
          if [ -f dist/artifacts/k8e-airgap-images.tar.gz ]; then
            cp dist/artifacts/k8e-airgap-images.tar.gz release-artifacts/
          fi
      - name: Upload artifacts
        uses: actions/upload-artifact@v5
        with:
          name: k8e
          path: release-artifacts/

  # ── K8E server binary: linux/arm64 ──────────────────────────────────
  build-k8e-arm64:
    name: Build k8e (arm64)
    runs-on: ubuntu-24.04-arm
    env:
      GOOS: linux
      GOARCH: arm64
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          check-latest: true
          cache-dependency-path: go.sum
      - name: Setup Zig
        uses: mlugg/setup-zig@v2
        with:
          version: 0.16.0
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y pkg-config build-essential libc6-dev zlib1g-dev libseccomp-dev
      - name: Generate resources
        run: |
          mkdir -p build/data build/static
          make deps
          zig build download
          make generate
      - name: Build k8e
        run: make k8e
      - name: Package CLI (data tarball)
        run: make package-cli
      - name: Rename artifact
        run: |
          mkdir -p release-artifacts
          cp dist/artifacts/k8e-arm64 release-artifacts/k8e
      - name: Upload artifact
        uses: actions/upload-artifact@v5
        with:
          name: k8e-arm64
          path: release-artifacts/k8e

  # ── Sandbox CLI: cross-platform binaries ──────────────────────────────
  build-sandbox-cli:
    name: Build sandbox-cli
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          check-latest: true
          cache-dependency-path: go.sum
      - name: Setup Zig
        uses: mlugg/setup-zig@v2
        with:
          version: 0.16.0
      - name: Build sandbox-cli
        run: zig build sandboxcli
      - name: Upload linux-amd64
        uses: actions/upload-artifact@v5
        with:
          name: sandbox-cli-linux-amd64
          path: zig-out/bin/k8e-sandbox-cli-linux-amd64
      - name: Upload linux-arm64
        uses: actions/upload-artifact@v5
        with:
          name: sandbox-cli-linux-arm64
          path: zig-out/bin/k8e-sandbox-cli-linux-arm64
      - name: Upload darwin-amd64
        uses: actions/upload-artifact@v5
        with:
          name: sandbox-cli-darwin-amd64
          path: zig-out/bin/k8e-sandbox-cli-darwin-amd64
      - name: Upload darwin-arm64
        uses: actions/upload-artifact@v5
        with:
          name: sandbox-cli-darwin-arm64
          path: zig-out/bin/k8e-sandbox-cli-darwin-arm64
      - name: Upload windows-amd64
        uses: actions/upload-artifact@v5
        with:
          name: sandbox-cli-windows-amd64
          path: zig-out/bin/k8e-sandbox-cli-windows-amd64.exe

  # ── Sandbox container image ───────────────────────────────────────────
  build-sandbox-image:
    name: Build sandbox image
    runs-on: ubuntu-latest
    needs: build-k8e
    env:
      # docker/build-push-action uploads the exported build record as a run
      # artifact (*.dockerbuild) by default. Keep the run's artifacts limited
      # to what the publish job downloads by name/pattern.
      DOCKER_BUILD_RECORD_UPLOAD: false
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6
      - name: Setup Zig
        uses: mlugg/setup-zig@v2
        with:
          version: 0.16.0
      - name: Build sandboxd binaries
        run: cd sandboxd && zig build sandboxd
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Sanitize tag
        id: tag
        run: echo "value=$(echo '${{ github.ref_name }}' | tr '+' '-')" >> $GITHUB_OUTPUT
      - name: Build and push sandbox image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: sandbox/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ghcr.io/xiaods/k8e-sandbox:${{ steps.tag.outputs.value }}
            ghcr.io/xiaods/k8e-sandbox:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Verify sandbox image architecture
        run: |
          echo "Verifying sandbox image platforms..."
          docker buildx imagetools inspect ghcr.io/xiaods/k8e-sandbox:latest

  # ── MCP adapter image ────────────────────────────────────────────────
  build-mcp-image:
    name: Build MCP image
    runs-on: ubuntu-latest
    env:
      # Same as build-sandbox-image: no *.dockerbuild build-record artifact.
      DOCKER_BUILD_RECORD_UPLOAD: false
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Sanitize tag
        id: tag
        run: echo "value=$(echo '${{ github.ref_name }}' | tr '+' '-')" >> $GITHUB_OUTPUT
      - name: Build and push MCP image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: manifests/sandbox-mcp/Dockerfile
          # Same arches as the sandbox image: the Deployment may run on arm64
          # nodes once the multi-node work in KIP-30 lands.
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ghcr.io/xiaods/k8e-mcp:${{ steps.tag.outputs.value }}
            ghcr.io/xiaods/k8e-mcp:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # ── Publish all artifacts on the GitHub Release ─────────────────────
  publish:
    name: Publish release assets
    runs-on: ubuntu-latest
    needs: [build-k8e, build-k8e-arm64, build-sandbox-cli]
    steps:
      # Select artifacts explicitly. Without name/artifact-ids/pattern the
      # step downloads every artifact in the run, including the *.dockerbuild
      # build records the image jobs would otherwise upload. The two k8e
      # artifacts both contain a file named "k8e", so they are downloaded into
      # separate paths; a single flat merge would make them clobber each other.
      - name: Download k8e amd64 artifact
        uses: actions/download-artifact@v8
        with:
          name: k8e
          path: release-artifacts
      - name: Download k8e arm64 artifact
        uses: actions/download-artifact@v8
        with:
          name: k8e-arm64
          path: tmp-k8e-arm64
      - name: Download sandbox-cli artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: sandbox-cli-*
          merge-multiple: true
          path: release-artifacts
      - name: Stage release assets
        run: |
          # download-artifact@v8 extracts a single named artifact flat into
          # its path, so the arm64 binary landed at tmp-k8e-arm64/k8e. Publish
          # it as k8e-arm64: contrib/install.sh on aarch64 requests exactly
          # that asset name.
          mv tmp-k8e-arm64/k8e release-artifacts/k8e-arm64
          rm -rf tmp-k8e-arm64
      - name: Generate unified SHA256SUMS
        run: |
          cd release-artifacts
          sha256sum * 2>/dev/null | sort > SHA256SUMS
          echo "--- SHA256SUMS ---"
          cat SHA256SUMS
      - name: Generate per-arch checksums for contrib/install.sh
        run: |
          cd release-artifacts
          # install.sh fetches sha256sum-<ARCH>.txt, greps the binary name for
          # that arch (k8e on amd64, k8e-arm64 on aarch64) and aborts the
          # install on a digest mismatch, so each file must carry that arch's
          # real digest.
          sha256sum k8e | awk '{print $1, $2}' > sha256sum-amd64.txt
          sha256sum k8e-arm64 | awk '{print $1, $2}' > sha256sum-arm64.txt
      - name: List artifacts
        run: ls -la release-artifacts/
      - name: Upload to release
        uses: softprops/action-gh-release@v2.6.1
        with:
          files: |
            release-artifacts/k8e
            release-artifacts/k8e-arm64
            release-artifacts/k8e-airgap-images.tar.gz
            release-artifacts/k8e-sandbox-cli-linux-amd64
            release-artifacts/k8e-sandbox-cli-linux-arm64
            release-artifacts/k8e-sandbox-cli-darwin-amd64
            release-artifacts/k8e-sandbox-cli-darwin-arm64
            release-artifacts/k8e-sandbox-cli-windows-amd64.exe
            release-artifacts/SHA256SUMS
            release-artifacts/sha256sum-amd64.txt
            release-artifacts/sha256sum-arm64.txt
          fail_on_unmatched_files: false