ci.yaml

name: CI

on:
  push:
    branches:
      - main
    tags:
      - "*"
  pull_request:
    branches:
      - main

jobs:
  prepare:
    name: Prepare
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.set-version.outputs.version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set version
        id: set-version
        run: |
          if [[ $GITHUB_REF == refs/tags/* ]]; then
            VERSION=${GITHUB_REF#refs/tags/}
          else
            VERSION=$(git rev-parse HEAD)
          fi
          echo "version=$VERSION" >> $GITHUB_OUTPUT

  test:
    name: Test on ${{ matrix.os.name }}
    runs-on: ${{ matrix.os.runner }}
    strategy:
      matrix:
        os:
          - name: Linux
            runner: ubuntu-latest
          - name: Windows
            runner: windows-latest
          - name: macOS
            runner: macos-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Lint
        run: make lint

      - name: Build
        run: make build

      - name: Test
        run: make test

  publish-container-images:
    name: Publish container images
    runs-on: ubuntu-latest
    needs: [prepare, test]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/hathora/ci
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=ref,event=branch
            type=sha
          flavor: |
            latest=auto

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        uses: docker/bake-action@v4
        with:
          files: |
            ./docker-bake.hcl
            ${{ steps.meta.outputs.bake-file }}
          targets: default
          push: ${{ github.event_name != 'pull_request' }}
          set: |
            default.args.BUILD_VERSION=${{ needs.prepare.outputs.version }}

  publish-binaries:
    name: Publish binary for ${{ matrix.platform.os }} ${{ matrix.arch }}
    needs: [prepare, test]
    strategy:
      matrix:
        platform:
          [
            { os: "linux", runner: "ubuntu-latest" },
            { os: "darwin", runner: "macos-latest" },
            { os: "windows", runner: "windows-latest" },
          ]
        arch: [amd64, arm64]
    runs-on: ${{ matrix.platform.runner }}
    env:
      HAS_SECRET: ${{ secrets.SIGNING_CERTIFICATE_PFX }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Build binaries
        env:
          TARGETOS: ${{ matrix.platform.os }}
          TARGETARCH: ${{ matrix.arch }}
          BUILD_VERSION: ${{ needs.prepare.outputs.version }}
          BINARY_SUFFIX: ${{ matrix.platform.os == 'windows' && '.exe' || '' }}
        run: make build

      - name: Sign the Windows binary
        if: env.HAS_SECRET && github.repository_owner == 'hathora' && matrix.platform.os == 'windows'
        run: |
          $decodedCertificate = [System.Convert]::FromBase64String("${{ secrets.SIGNING_CERTIFICATE_PFX }}")
          [System.IO.File]::WriteAllBytes("certificate.pfx", $decodedCertificate)
          & "C:\Program Files (x86)\Windows Kits\10\App Certification Kit\signtool.exe" sign /debug /fd sha256 /f certificate.pfx /u 1.3.6.1.5.5.7.3.2 "bin\hathora-windows-${{ matrix.arch }}.exe"
          del certificate.pfx

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: hathora-${{ matrix.platform.os }}-${{ matrix.arch }}${{ matrix.platform.os == 'windows' && '.exe' || '' }}
          path: bin/hathora-*

  release:
    name: Release
    runs-on: ubuntu-latest
    needs: [publish-container-images, publish-binaries]
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download All Artifacts
        uses: actions/download-artifact@v4
        with:
          path: bin
          pattern: hathora-*
          merge-multiple: true

      - name: Release
        uses: softprops/action-gh-release@v2
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: bin/*
          generate_release_notes: true