vantage/.gitea/workflows/vantagectl-release.yml

name: vantagectl Release

on:
    push:
        tags:
            - "vantagectl/v*"

jobs:
    build:
        runs-on: ubuntu-docker
        container: node:26
        steps:
            - name: Checkout
              uses: actions/checkout@v4

            - name: Set up Go
              uses: actions/setup-go@v5
              with:
                  go-version: "1.26"
                  cache: true
                  cache-dependency-path: vantagectl/go.sum

            - name: Extract version
              id: version
              run: echo "VERSION=${GITHUB_REF_NAME#vantagectl/}" >> $GITHUB_OUTPUT

            - name: Test
              working-directory: vantagectl
              run: go test ./...

            - name: Build
              working-directory: vantagectl
              env:
                  VERSION: ${{ steps.version.outputs.VERSION }}
              run: |
                  mkdir -p dist
                  for target in linux/amd64 linux/arm64 darwin/arm64 windows/amd64; do
                      goos="${target%/*}"
                      goarch="${target#*/}"
                      out="dist/vantagectl-${goos}-${goarch}"
                      if [ "$goos" = "windows" ]; then out="${out}.exe"; fi
                      CGO_ENABLED=0 GOOS="$goos" GOARCH="$goarch" go build \
                        -ldflags="-s -w -X main.Version=${VERSION}" \
                        -o "$out" .
                  done

            - name: Checksums
              working-directory: vantagectl/dist
              run: sha256sum vantagectl-* > checksums.txt

            - name: Create release
              uses: https://gitea.com/actions/gitea-release-action@v1
              with:
                  token: ${{ secrets.RELEASE_TOKEN }}
                  files: |
                      vantagectl/dist/vantagectl-linux-amd64
                      vantagectl/dist/vantagectl-linux-arm64
                      vantagectl/dist/vantagectl-darwin-arm64
                      vantagectl/dist/vantagectl-windows-amd64.exe
                      vantagectl/dist/checksums.txt

    # The image is built here rather than in server-deploy.yml on every push to
    # main, because vantagectl is a released tool rather than a running service.
    # An operator restoring a database should be able to name the version they
    # ran; ":latest, rebuilt whenever main moved" cannot be named after the
    # fact. It is a separate job from the binaries because it needs a
    # docker-capable runner rather than a Go one, and it does not need the
    # binaries — the image builds from source in its own stage.
    image:
        runs-on: ubuntu-docker
        container: docker:dind
        steps:
            - name: Setup
              run: apk add --update nodejs npm git

            - name: Checkout
              uses: actions/checkout@v4

            - name: Extract version
              id: version
              run: |
                  # v0.1.0 for the binary stamp, 0.1.0 for the image tag: a
                  # leading v is conventional on a git tag and unconventional on
                  # a container tag.
                  VERSION="${GITHUB_REF_NAME#vantagectl/}"
                  echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
                  echo "IMAGE_TAG=${VERSION#v}" >> $GITHUB_OUTPUT

            - name: Log in to registry
              run: |
                  echo "${{ secrets.RELEASE_TOKEN }}" | \
                    docker login ${{ vars.DOCKER_HOST }} \
                      -u "${{ secrets.REGISTRY_USER }}" --password-stdin

            - name: Build and push image
              env:
                  VERSION: ${{ steps.version.outputs.VERSION }}
                  IMAGE_TAG: ${{ steps.version.outputs.IMAGE_TAG }}
              run: |
                  REPO="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/vantagectl"
                  # Root context: vantagectl depends on the shared module through
                  # a replace directive, so the build needs shared/ alongside it.
                  # VERSION is passed through so `vantagectl --version` inside the
                  # image reports the tag it was built from rather than "dev".
                  docker build \
                    --build-arg VERSION="${VERSION}" \
                    -t "${REPO}:${IMAGE_TAG}" \
                    -t "${REPO}:latest" \
                    -f vantagectl/Dockerfile .
                  docker push "${REPO}:${IMAGE_TAG}"
                  docker push "${REPO}:latest"