release.yml

name: Release

on:
  push:
    branches:
      - main
      - v*.*
    tags:
      - v*

env:
  ELIXIR_OPTS: "--warnings-as-errors"
  ERLC_OPTS: "warnings_as_errors"
  LANG: C.UTF-8

permissions:
  contents: write
  id-token: write
  attestations: write

jobs:
  create_draft_release:
    runs-on: ubuntu-22.04
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Create draft release
        if: github.ref_type != 'branch'
        run: |
          gh release create \
            --repo ${{ github.repository }} \
            --title ${{ github.ref_name }} \
            --notes '' \
            --draft \
            ${{ github.ref_name }}

      - uses: actions/checkout@v4
        if: github.ref_type == 'branch'
        with:
          fetch-depth: 50

      - name: Update ${{ github.ref_name }}-latest
        if: github.ref_type == 'branch'
        run: |
          ref_name=${{ github.ref_name }}-latest

          if ! gh release view $ref_name; then
            gh release create \
              --latest=false \
              --title $ref_name \
              --notes "Automated release for latest ${{ github.ref_name }}." \
              $ref_name
          fi

          git tag $ref_name --force
          git push origin $ref_name --force

  build:
    needs: create_draft_release
    strategy:
      fail-fast: true
      matrix:
        include:
          - otp: 25
            otp_version: "25.3"
          - otp: 26
            otp_version: "26.0"
          - otp: 27
            otp_version: "27.0"
            build_docs: build_docs
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 50

      - uses: ./.github/workflows/release_pre_built
        with:
          otp_version: ${{ matrix.otp_version }}
          otp: ${{ matrix.otp }}
          build_docs: ${{ matrix.build_docs }}

      - uses: actions/attest-build-provenance@v1
        with:
          subject-path: 'elixir-otp-${{ matrix.otp }}.*'

      - uses: actions/attest-build-provenance@v1
        if: ${{ matrix.build_docs }}
        with:
          subject-path: 'Docs.*'

      - uses: actions/upload-artifact@v4
        with:
          name: elixir-otp-${{ matrix.otp }}
          path: elixir-otp-${{ matrix.otp }}*

      - uses: actions/upload-artifact@v4
        if: ${{ matrix.build_docs }}
        with:
          name: Docs
          path: Docs.zip*

  upload:
    needs: build
    runs-on: windows-2022

    steps:
      - uses: actions/download-artifact@v4

      - run: |
          mv elixir-otp-*/* .
          mv Docs/* .
        shell: bash

      - name: "Sign files with Trusted Signing"
        if: github.repository == 'elixir-lang/elixir'
        uses: azure/trusted-signing-action@v0.4.0
        with:
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          endpoint: https://eus.codesigning.azure.net/
          trusted-signing-account-name: trusted-signing-elixir
          certificate-profile-name: Elixir
          files-folder: ${{ github.workspace }}
          files-folder-filter: exe
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Upload Pre-built
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if [ "${{ github.ref_type }}" == "branch" ]; then
            tag=${{ github.ref_name }}-latest
          else
            tag="${{ github.ref_name }}"
          fi

          gh release upload \
            --repo ${{ github.repository }} \
            --clobber \
            "$tag" \
            elixir-otp-*.zip \
            elixir-otp-*.zip.sha{1,256}sum \
            elixir-otp-*.exe \
            elixir-otp-*.exe.sha{1,256}sum \
            Docs.zip \
            Docs.zip.sha{1,256}sum