SubMiner/.github/workflows/prerelease.yml

name: Prerelease

on:
  push:
    tags:
      - 'v*-beta.*'
      - 'v*-rc.*'

concurrency:
  group: prerelease-${{ github.ref }}
  cancel-in-progress: false

jobs:
  quality-gate:
    permissions:
      contents: read
    uses: ./.github/workflows/quality-gate.yml

  package:
    needs: [quality-gate]
    permissions:
      contents: read
    uses: ./.github/workflows/package-release.yml
    secrets:
      CSC_LINK: ${{ secrets.CSC_LINK }}
      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

  release:
    needs: [package]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Download AppImage
        uses: actions/download-artifact@v4
        with:
          name: appimage
          path: release

      - name: Download macOS artifacts
        uses: actions/download-artifact@v4
        with:
          name: macos
          path: release

      - name: Download Windows artifacts
        uses: actions/download-artifact@v4
        with:
          name: windows
          path: release

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.5

      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.bun/install/cache
            node_modules
          key: ${{ runner.os }}-${{ runner.arch }}-bun-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-bun-

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build launcher runtime artifacts
        run: make build-launcher

      - name: Smoke launcher bundle
        run: bun dist/launcher/subminer.js --help >/dev/null

      - name: Enforce generated launcher workflow
        run: bash scripts/verify-generated-launcher.sh

      - name: Verify generated config examples
        run: bun run verify:config-example

      - name: Package optional assets bundle
        run: |
          tar -czf "release/subminer-assets.tar.gz" \
            config.example.jsonc \
            plugin/subminer \
            plugin/subminer.conf \
            assets/themes/subminer.rasi \
            assets/thumbnailers/subminer-ffmpegthumbnailer.thumbnailer \
            resources/bun/licenses

      - name: Package Bun corresponding source
        run: bun scripts/package-bun-source.mjs

      - name: Generate checksums
        run: |
          shopt -s nullglob
          files=(release/*.AppImage release/*.dmg release/*.exe release/*.zip release/*.tar.gz release/latest*.yml release/*.blockmap dist/launcher/subminer dist/launcher/subminer.cmd)
          files+=(release/package-size-*.json)
          if [ "${#files[@]}" -eq 0 ]; then
            echo "No release artifacts found for checksum generation."
            exit 1
          fi
          : > release/SHA256SUMS.txt
          for file in "${files[@]}"; do
            printf '%s  %s\n' \
              "$(sha256sum "$file" | awk '{print $1}')" \
              "${file##*/}" >> release/SHA256SUMS.txt
          done

      - name: Get version from tag
        id: version
        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"

      - name: Verify committed prerelease notes
        env:
          RELEASE_VERSION: ${{ steps.version.outputs.VERSION }}
        run: |
          if [ ! -s release/prerelease-notes.md ]; then
            echo "::error::release/prerelease-notes.md is missing or empty. Run 'bun run changelog:prerelease-notes --version <version>' locally and commit the file before tagging."
            exit 1
          fi
          if ! bun run changelog:check-prerelease-notes --version "$RELEASE_VERSION"; then
            echo "::error::release/prerelease-notes.md was not generated for $RELEASE_VERSION. Rerun 'bun run changelog:prerelease-notes --version $RELEASE_VERSION' locally, commit, and retag."
            exit 1
          fi

      - name: Publish Prerelease
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_VERSION: ${{ steps.version.outputs.VERSION }}
        run: |
          set -euo pipefail

          shopt -s nullglob
          artifacts=(
            release/*.AppImage
            release/*.dmg
            release/*.exe
            release/*.zip
            release/*.tar.gz
            release/*.tar.gz.sha256
            release/latest*.yml
            release/*.blockmap
            release/SHA256SUMS.txt
            release/package-size-*.json
            dist/launcher/subminer
            dist/launcher/subminer.cmd
          )

          if [ "${#artifacts[@]}" -eq 0 ]; then
            echo "No release artifacts found for upload."
            exit 1
          fi

          if gh release view "$RELEASE_VERSION" >/dev/null 2>&1; then
            gh release edit "$RELEASE_VERSION" \
              --draft \
              --prerelease \
              --title "$RELEASE_VERSION" \
              --notes-file release/prerelease-notes.md
          else
            gh release create "$RELEASE_VERSION" \
              --draft \
              --latest=false \
              --prerelease \
              --title "$RELEASE_VERSION" \
              --notes-file release/prerelease-notes.md
          fi

          for asset in "${artifacts[@]}"; do
            gh release upload "$RELEASE_VERSION" "$asset" --clobber
          done

          gh release edit "$RELEASE_VERSION" \
            --draft=false \
            --prerelease \
            --title "$RELEASE_VERSION" \
            --notes-file release/prerelease-notes.md