build.yml

# Workflow for the dataflow-operator/dataflow-cli repository.
# The repository root is this module. Do not filter on monorepo paths like dataflow-cli/**.
name: dataflow-cli

on:
  push:
    branches:
      - main
    tags:
      - 'v*'
  pull_request:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read
  packages: write

jobs:
  release-version:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      new_release_published: ${{ steps.semantic.outputs.new_release_published }}
      new_release_version: ${{ steps.semantic.outputs.new_release_version }}
      new_release_git_tag: ${{ steps.semantic.outputs.new_release_git_tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.25'
          cache-dependency-path: go.sum

      - name: Semantic release
        id: semantic
        uses: cycjimmy/semantic-release-action@v6
        with:
          extra_plugins: |
            @semantic-release/changelog@6.0.0
            @semantic-release/exec@7.0.0
            @semantic-release/git@10.0.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.25'
          cache-dependency-path: go.sum

      - name: Run tests
        run: go test ./...

  build:
    runs-on: ubuntu-latest
    needs: [test, release-version]
    if: always() && needs.test.result == 'success' && (needs.release-version.result == 'success' || needs.release-version.result == 'skipped')
    strategy:
      matrix:
        include:
          - goos: linux
            goarch: amd64
            suffix: ""
          - goos: linux
            goarch: arm64
            suffix: ""
          - goos: linux
            goarch: arm
            goarm: "7"
            suffix: -v7
          - goos: darwin
            goarch: amd64
            suffix: ""
          - goos: darwin
            goarch: arm64
            suffix: ""
          - goos: windows
            goarch: amd64
            suffix: ""
          - goos: windows
            goarch: arm64
            suffix: ""
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.25'
          cache-dependency-path: go.sum

      - name: Resolve version
        id: version
        run: |
          if [ -n "${{ needs.release-version.outputs.new_release_version }}" ]; then
            v="${{ needs.release-version.outputs.new_release_version }}"
          elif [ "$GITHUB_REF_TYPE" = "tag" ]; then
            v="${GITHUB_REF_NAME#v}"
          else
            v="dev-${GITHUB_SHA::7}"
          fi
          echo "version=$v" >> "$GITHUB_OUTPUT"

      - name: Build
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          GOARM: ${{ matrix.goarm }}
          CGO_ENABLED: "0"
        run: |
          BINARY=dataflow-cli
          if [ "${{ matrix.goos }}" = "windows" ]; then
            BINARY=dataflow-cli.exe
          fi
          go build -trimpath -ldflags "-s -w -X github.com/dataflow-operator/dataflow-cli/cmd.Version=${{ steps.version.outputs.version }}" -o "$BINARY" .
          echo "BINARY=$BINARY" >> "$GITHUB_ENV"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: dataflow-cli-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.suffix }}
          path: ${{ env.BINARY }}

  image:
    runs-on: ubuntu-latest
    needs: [test, release-version]
    if: always() && needs.test.result == 'success' && (needs.release-version.result == 'success' || needs.release-version.result == 'skipped')
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Resolve version
        id: version
        run: |
          if [ -n "${{ needs.release-version.outputs.new_release_version }}" ]; then
            v="${{ needs.release-version.outputs.new_release_version }}"
          elif [ "$GITHUB_REF_TYPE" = "tag" ]; then
            v="${GITHUB_REF_NAME#v}"
          else
            v="dev-${GITHUB_SHA::7}"
          fi
          echo "version=$v" >> "$GITHUB_OUTPUT"

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository_owner }}/dataflow-cli
          tags: |
            type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' && needs.release-version.outputs.new_release_published != 'true' }}
            type=raw,value=${{ needs.release-version.outputs.new_release_version }},enable=${{ needs.release-version.outputs.new_release_published == 'true' }}
            type=raw,value=latest,enable=${{ needs.release-version.outputs.new_release_published == 'true' }}
            type=semver,pattern={{version}}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          push: ${{ github.event_name != 'pull_request' }}
          platforms: ${{ github.event_name == 'pull_request' && 'linux/amd64' || 'linux/amd64,linux/arm64' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            VERSION=${{ steps.version.outputs.version }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  release:
    runs-on: ubuntu-latest
    needs: [build, release-version]
    if: needs.release-version.outputs.new_release_published == 'true'
    permissions:
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Prepare release assets
        run: |
          mkdir -p release
          for d in artifacts/dataflow-cli-*; do
            [ -d "$d" ] || continue
            name=$(basename "$d")
            f=$(find "$d" -type f -print -quit)
            [ -z "$f" ] && continue
            case "$name" in
              *windows*) cp "$f" "release/${name}.exe" ;;
              *) cp "$f" "release/$name" ;;
            esac
          done
          for name in dataflow-cli-darwin-amd64 dataflow-cli-darwin-arm64 dataflow-cli-linux-amd64 dataflow-cli-linux-arm64; do
            [ -f "release/$name" ] || { echo "missing release/$name" >&2; exit 1; }
            stage=$(mktemp -d)
            cp "release/$name" "$stage/dataflow-cli"
            chmod +x "$stage/dataflow-cli"
            tar -C "$stage" -czf "release/${name}.tar.gz" dataflow-cli
            rm -rf "$stage"
          done
          cd release
          sha256sum * > SHA256SUMS
          ls -la

      - name: Render Homebrew formula
        run: |
          version="${{ needs.release-version.outputs.new_release_version }}"
          version="${version#v}"
          sha() { sha256sum "release/$1" | awk '{print $1}'; }
          mkdir -p formula
          sh scripts/homebrew-formula.sh \
            "$version" \
            "$(sha dataflow-cli-darwin-arm64.tar.gz)" \
            "$(sha dataflow-cli-darwin-amd64.tar.gz)" \
            "$(sha dataflow-cli-linux-arm64.tar.gz)" \
            "$(sha dataflow-cli-linux-amd64.tar.gz)" \
            > formula/dataflow-cli.rb

      - name: Attach binaries
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.release-version.outputs.new_release_git_tag }}
          files: release/*
          draft: false

      - name: Publish Homebrew formula
        env:
          TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          VERSION: ${{ needs.release-version.outputs.new_release_version }}
        run: |
          if [ -z "${TAP_TOKEN}" ]; then
            echo "HOMEBREW_TAP_TOKEN is required to publish the Homebrew formula" >&2
            exit 1
          fi
          version="${VERSION#v}"
          git clone "https://x-access-token:${TAP_TOKEN}@github.com/dataflow-operator/homebrew-tap.git" tap
          cd tap
          git checkout -B main
          mkdir -p Formula
          cp ../formula/dataflow-cli.rb Formula/dataflow-cli.rb
          git add Formula/dataflow-cli.rb
          if git diff --cached --quiet; then
            echo "Homebrew formula unchanged"
            exit 0
          fi
          git -c user.name="github-actions[bot]" -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
            commit -m "dataflow-cli ${version}"
          git push origin HEAD:main