goreleaser.yaml

name: goreleaser

on:
  push:
    tags:
      - '*'

jobs:
  goreleaser:
    permissions:
      contents: write
    runs-on:
      - self-hosted-ghr
      - size-l-x64
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          ref: ${{ github.ref }}
      - name: Derive release suffix from tag (if it exists)
        run: |
          # Strip the 'refs/tags/' prefix
          TAG_NAME=${GITHUB_REF#refs/tags/}

          # A release-branch tag is a semver core followed by everything after the
          # FIRST '-' (e.g. 'glamsterdam-devnet-7' from '0.0.1-glamsterdam-devnet-7',
          # 'dencun' from 'v1.0.0-dencun'). Anchoring on the semver core keeps
          # multi-word suffixes intact and leaves plain 'vX.Y.Z' tags unsuffixed.
          if [[ $TAG_NAME =~ ^v?[0-9]+\.[0-9]+\.[0-9]+-(.+)$ ]]; then
            RELEASE_SUFFIX="${BASH_REMATCH[1]}"
          else
            RELEASE_SUFFIX=""
          fi

          echo "RELEASE_SUFFIX=$RELEASE_SUFFIX" >> $GITHUB_ENV

          echo "Release suffix: $RELEASE_SUFFIX"

      - name: Set up Go
        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
        with:
          go-version-file: 'go.mod'
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        name: Set up Node
        with:
          node-version: 18
      - name: Run apt-get update
        run: sudo apt-get update
      - name: Install cross-compiler for linux/arm64
        run: sudo apt-get -y install gcc-aarch64-linux-gnu
      - name: Install make
        run: sudo apt-get -y install make
      - name: Set up QEMU
        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
      - name: Set up Docker Context for Buildx
        shell: bash
        id: buildx-context
        run: |
          docker context create builders
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
        with:
          endpoint: builders
      - name: Login to DockerHub
        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Update GoReleaser config
        run: |
          cp .goreleaser.yaml .goreleaser.yaml.new

          # If we have a RELEASE_SUFFIX, update the goreleaser config to not set
          # the release as the latest
          if [[ -n "$RELEASE_SUFFIX" ]]; then
            echo "release:" >> .goreleaser.yaml.new
            echo "  prerelease: true" >> .goreleaser.yaml.new
            echo "  make_latest: false" >> .goreleaser.yaml.new
          fi
      - name: Run GoReleaser in Docker
        run: |
          docker run --rm \
            -v ${{ github.workspace }}:/workspace \
            -w /workspace \
            -e GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} \
            -e DOCKER_USERNAME=${{ secrets.DOCKERHUB_USERNAME }} \
            -e DOCKER_PASSWORD=${{ secrets.DOCKERHUB_TOKEN }} \
            -v /var/run/docker.sock:/var/run/docker.sock \
            -e RELEASE_SUFFIX=${{ env.RELEASE_SUFFIX }} \
            goreleaser/goreleaser-cross:v1.26 release --clean --config .goreleaser.yaml.new

      # The xatu+cryo image is the EL-cannon variant: it bundles the cryo binary
      # alongside xatu. cryo is built from Rust source (./Dockerfile), so it does
      # not fit goreleaser's copy-the-prebuilt-binary docker flow — and building
      # it inside goreleaser would force every PR's test-build to compile cryo.
      # We build it here, release-only. The cryo ref is pinned in ./Dockerfile
      # (ARG CRYO_GIT_REF); that layer is cache-stable, so it only recompiles
      # when the pinned ref changes.
      #
      # Cache is a registry image (ethpandaops/xatu:cryo-buildcache), NOT GHA
      # cache: GHA cache is scoped per git ref, and releases are tag-triggered,
      # so a v1.18.2 run could not read the v1.18.1 run's cache (only its own
      # ref + the default branch). Registry cache is ref-agnostic, so every
      # release reuses the prior cryo-builder layer and skips the ~10 min Rust
      # compile until CRYO_GIT_REF changes (which invalidates that layer and
      # recompiles once, then re-warms the cache).
      #
      # amd64-only: EL cannon runs on amd64 servers, and compiling cryo for
      # arm64 under QEMU emulation takes 30-60+ min (it hung a release for
      # 35+ min). Native amd64 compiles in ~2-3 min. Add linux/arm64 back here
      # only if cannon ever needs to run on arm64.
      - name: Derive cryo image version
        run: |
          echo "CRYO_GIT_COMMIT=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
          # Match goreleaser's {{ .Version }} (tag with a single leading 'v' stripped).
          TAG_NAME=${GITHUB_REF#refs/tags/}
          echo "CRYO_IMAGE_VERSION=${TAG_NAME#v}" >> "$GITHUB_ENV"
      - name: Build and push xatu+cryo image
        uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
        with:
          context: .
          file: Dockerfile
          platforms: linux/amd64
          push: true
          provenance: false
          sbom: false
          build-args: |
            VERSION=${{ env.CRYO_IMAGE_VERSION }}
            GIT_COMMIT=${{ env.CRYO_GIT_COMMIT }}
          tags: |
            ethpandaops/xatu:${{ env.CRYO_IMAGE_VERSION }}-cryo
            ethpandaops/xatu:${{ env.RELEASE_SUFFIX && format('{0}-cryo', env.RELEASE_SUFFIX) || 'cryo-latest' }}
          cache-from: type=registry,ref=ethpandaops/xatu:cryo-buildcache
          cache-to: type=registry,ref=ethpandaops/xatu:cryo-buildcache,mode=max,ignore-error=true