release-linux.yml

name: Release Linux

# A linux-vX.Y.Z tag publishes the Linux release: the source and vendor
# tarballs on GitHub Releases, the signed Debian source package for each
# Ubuntu series to the Launchpad PPA, which builds and publishes the .deb,
# and the tag to the COPR project's custom webhook, which builds the
# Fedora packages from the release (linux/build-aux/rpm/copr-sources.sh).
# A pre-release tag such as linux-v0.2.0-rc.1 publishes a GitHub
# pre-release and skips the PPA and COPR.
#
# Run by hand on a branch, it uploads a published release to the PPA again
# as X.Y.Z-0ppaN, from that release's tarballs with the branch's .deb
# packaging: a packaging fix that needs no new version. linux/docs/releasing.md
# has the steps.
#
# Environment linux-release, limited to linux-v* tags and the branch a
# packaging fix runs on, with a required reviewer, holds two secrets.
# LINUX_PPA_SIGNING_KEY: the ASCII-armored OpenPGP secret key, with no
# passphrase, that signs the uploads. Its public key is registered on a
# Launchpad account that may upload to the PPA.
# LINUX_COPR_WEBHOOK: the custom webhook URL from the COPR project's
# Integrations page, ending in the package name: .../<uuid>/tablepro/.
# Variable LINUX_PPA: the PPA, as owner/name.
# Variable LINUX_BRANCH: the branch a release tag must be on, main when unset.

on:
  push:
    tags: ["linux-v*"]
  workflow_dispatch:
    inputs:
      tag:
        description: The published release to upload again, such as linux-v0.1.0
        required: true
        type: string
      revision:
        description: The PPA upload number, 2 or more (X.Y.Z-0ppaN)
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: release-linux-${{ github.ref }}
  cancel-in-progress: false

jobs:
  verify:
    name: Tag, version and release notes
    if: github.event_name == 'push'
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    container:
      image: ubuntu:26.04
    outputs:
      prerelease: ${{ steps.check.outputs.prerelease }}
    steps:
      - name: Install git and meson
        run: |
          apt-get update
          apt-get install -y --no-install-recommends ca-certificates git meson python3
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: The tag, metainfo, spec and changelog name one version
        id: check
        working-directory: linux
        env:
          TAG: ${{ github.ref_name }}
          LINUX_BRANCH: ${{ vars.LINUX_BRANCH || 'main' }}
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          if ! git merge-base --is-ancestor HEAD "origin/$LINUX_BRANCH"; then
            echo "::error::$GITHUB_SHA is not on $LINUX_BRANCH"
            exit 1
          fi
          version="$(meson introspect --projectinfo meson.build \
            | python3 -c 'import json, sys; print(json.load(sys.stdin)["version"])')"
          tag_date="$(TZ=UTC git log -1 --date=format-local:%Y-%m-%d --format=%cd)"
          python3 build-aux/packaging/check_packaging.py --source-root . \
            --version "$version" --tag "$TAG" --tag-date "$tag_date"
          case "$version" in
            *-*) echo "prerelease=true" >> "$GITHUB_OUTPUT" ;;
            *) echo "prerelease=false" >> "$GITHUB_OUTPUT" ;;
          esac

  packages:
    name: Packages
    needs: verify
    uses: ./.github/workflows/linux-packages.yml
    with:
      deb-runners: '["ubuntu-24.04", "ubuntu-24.04-arm"]'
      rpm-runners: '["ubuntu-24.04", "ubuntu-24.04-arm"]'

  github-release:
    name: GitHub release
    needs: [verify, packages]
    runs-on: ubuntu-24.04
    environment: linux-release
    timeout-minutes: 15
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: linux-sources
          path: release
      # A pre-release has no CHANGELOG.md section; its notes are a draft of the fragments at the tag.
      - name: Install towncrier
        if: needs.verify.outputs.prerelease == 'true'
        run: |
          python3 -m venv "$RUNNER_TEMP/release-venv"
          "$RUNNER_TEMP/release-venv/bin/pip" install --quiet --disable-pip-version-check --require-hashes \
            -r scripts/release/requirements.txt
      - name: Publish the release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
          PRERELEASE: ${{ needs.verify.outputs.prerelease }}
        run: |
          version="${TAG#linux-v}"
          (cd release && sha256sum -- * > SHA256SUMS)
          if [ "$PRERELEASE" = true ]; then
            python3 linux/build-aux/packaging/check_packaging.py --source-root linux \
              --version "$version" --tag "$TAG"
            "$RUNNER_TEMP/release-venv/bin/towncrier" build --draft --dir linux --version "$version" > draft.md
            sed 1d draft.md > notes.md
            set -- --prerelease
          else
            python3 linux/build-aux/packaging/check_packaging.py --source-root linux \
              --version "$version" --tag "$TAG" --notes notes.md
          fi
          # The repository's latest release stays the macOS one.
          gh release create "$TAG" release/* --repo "$GITHUB_REPOSITORY" --verify-tag --latest=false \
            --title "TablePro for Linux $version" --notes-file notes.md "$@"

  revision:
    name: Release and revision to upload again
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: The tag is a published release, and the revision a new upload
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ inputs.tag }}
          REVISION: ${{ inputs.revision }}
        run: |
          version="${TAG#linux-v}"
          case "$version" in
            "$TAG" | "" | *[!0-9.]*)
              echo "::error::$TAG is not the tag of a Linux release; a pre-release is not on the PPA"
              exit 1
              ;;
          esac
          case "$REVISION" in
            "" | *[!0-9]* | 0* | 1)
              echo "::error::Revision $REVISION is not 2 or more; 1 was the release's own upload"
              exit 1
              ;;
          esac
          prerelease="$(gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json isPrerelease --jq .isPrerelease)"
          if [ "$prerelease" != false ]; then
            echo "::error::$TAG is not a published release"
            exit 1
          fi

  revision-packages:
    name: Packages
    needs: revision
    uses: ./.github/workflows/linux-packages.yml
    with:
      deb-runners: '["ubuntu-24.04", "ubuntu-24.04-arm"]'
      release-tag: ${{ inputs.tag }}
      revision: ${{ inputs.revision }}

  ppa:
    name: Upload to the Launchpad PPA
    needs: [verify, packages, revision-packages]
    if: >-
      !cancelled() && (
        (needs.packages.result == 'success' && needs.verify.outputs.prerelease == 'false') ||
        needs.revision-packages.result == 'success')
    runs-on: ubuntu-24.04
    environment: linux-release
    timeout-minutes: 30
    container:
      image: ubuntu:26.04
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: linux-source-package
          path: source
      # Launchpad takes an upload signed by a key registered on an account
      # with upload rights to the PPA, through dput's ppa: target.
      - name: Sign the source packages and upload them
        env:
          SIGNING_KEY: ${{ secrets.LINUX_PPA_SIGNING_KEY }}
          PPA: ${{ vars.LINUX_PPA }}
        run: |
          if [ -z "$SIGNING_KEY" ] || [ -z "$PPA" ]; then
            echo "::error::Set the LINUX_PPA_SIGNING_KEY secret and the LINUX_PPA variable to upload to the PPA"
            exit 1
          fi
          apt-get update
          apt-get install -y --no-install-recommends devscripts dput gpg gpg-agent
          GNUPGHOME="$(mktemp -d)"
          export GNUPGHOME
          trap 'gpgconf --kill all; rm -rf "$GNUPGHOME"' EXIT
          printf '%s\n' "$SIGNING_KEY" | gpg --batch --import
          key="$(gpg --batch --with-colons --list-secret-keys | awk -F: '$1 == "fpr" { print $10; exit }')"
          # dput checks the signatures before it uploads, and reports one
          # from a key with no trust as an error.
          echo "$key:6:" | gpg --batch --import-ownertrust
          for changes in source/*_source.changes; do
            debsign -k"$key" "$changes"
            dput "ppa:$PPA" "$changes"
          done

  copr:
    name: Start the COPR build
    needs: [verify, github-release]
    if: needs.verify.outputs.prerelease == 'false'
    runs-on: ubuntu-24.04
    environment: linux-release
    timeout-minutes: 5
    steps:
      # COPR answers with the build's id. The webhook's UUID is the
      # project's secret, which lasts until a maintainer regenerates it.
      - name: Post the tag to the COPR webhook
        env:
          WEBHOOK: ${{ secrets.LINUX_COPR_WEBHOOK }}
          TAG: ${{ github.ref_name }}
        run: |
          if [ -z "$WEBHOOK" ]; then
            echo "::error::Set the LINUX_COPR_WEBHOOK secret to build the Fedora packages"
            exit 1
          fi
          build="$(curl --fail-with-body --silent --show-error --proto '=https' --request POST \
            --header 'Content-Type: text/plain' --data-raw "$TAG" "$WEBHOOK")"
          echo "COPR build $build: https://copr.fedorainfracloud.org/coprs/build/$build/"