release.yml

# This GitHub action publishes release assets and the npm installer when a
# semantic version tag is created, for example v1.2.3.
#
# Flow (Volcengine TOS/npm defaults):
#   1) GoReleaser builds the archives and uploads versioned TOS assets.
#   2) npm publish goes straight to the target channel: latest for stable tags,
#      next for prereleases.
#   3) Stable releases then write the TOS root version_manifest.json + latest.
name: release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: 1.17

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: https://registry.npmjs.org

      - name: Extract version
        id: version
        run: |
          tag="${GITHUB_REF_NAME}"
          version="${tag#v}"
          if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
            echo "Invalid release tag: $tag" >&2
            exit 1
          fi
          # A prerelease must never land on latest, or `npm i @volcengine/cli`
          # would resolve to an rc.
          npm_tag="latest"
          if [[ "$version" == *-* ]]; then
            npm_tag="next"
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "npm_tag=$npm_tag" >> "$GITHUB_OUTPUT"

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v3.0.0
        with:
          version: v1.26.2
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Install AWS CLI
        run: |
          python3 -m pip install --user --upgrade awscli
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Upload release assets to TOS
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.TOS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.TOS_SECRET_ACCESS_KEY }}
          AWS_MAX_ATTEMPTS: "2"
          AWS_CLI_CONNECT_TIMEOUT: "10"
          AWS_CLI_READ_TIMEOUT: "60"
          TOS_BUCKET: ${{ vars.TOS_BUCKET }}
          TOS_PREFIX: ${{ vars.TOS_PREFIX }}
          TOS_REGION: ${{ vars.TOS_REGION }}
          TOS_S3_ENDPOINT: ${{ vars.TOS_S3_ENDPOINT }}
          TOS_UPLOAD_CONCURRENCY: ${{ vars.TOS_UPLOAD_CONCURRENCY }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          : "${AWS_ACCESS_KEY_ID:?missing secret TOS_ACCESS_KEY_ID}"
          : "${AWS_SECRET_ACCESS_KEY:?missing secret TOS_SECRET_ACCESS_KEY}"

          export AWS_DEFAULT_REGION="${TOS_REGION:-cn-beijing}"
          bucket="${TOS_BUCKET:-eps-common-public}"
          prefix="${TOS_PREFIX:-ve}"
          endpoint="${TOS_S3_ENDPOINT:-https://tos-s3-cn-beijing.volces.com}"
          concurrency="${TOS_UPLOAD_CONCURRENCY:-20}"
          destination="s3://${bucket}/${prefix}/v${VERSION}/"

          if ! [[ "$concurrency" =~ ^[1-9][0-9]*$ ]]; then
            echo "Invalid TOS_UPLOAD_CONCURRENCY: $concurrency" >&2
            exit 1
          fi

          aws configure set default.s3.addressing_style virtual
          find dist -maxdepth 1 -type f \( -name '*.zip' -o -name '*SHA256SUMS' \) -print
          aws --endpoint-url "$endpoint" s3 ls "s3://${bucket}/${prefix}/" || true

          pids=()
          while IFS= read -r file; do
            echo "Uploading ${file}"
            aws --endpoint-url "$endpoint" s3 cp "$file" "$destination" &
            pids+=("$!")

            if [ "${#pids[@]}" -ge "$concurrency" ]; then
              for pid in "${pids[@]}"; do
                wait "$pid"
              done
              pids=()
            fi
          done < <(find dist -maxdepth 1 -type f \( -name '*.zip' -o -name '*SHA256SUMS' \) -print | sort)

          for pid in "${pids[@]}"; do
            wait "$pid"
          done

          aws --endpoint-url "$endpoint" s3 ls "$destination" --recursive

      - name: Configure npm package for TOS
        env:
          TOS_PREFIX: ${{ vars.TOS_PREFIX }}
          TOS_PUBLIC_BASE_URL: ${{ vars.TOS_PUBLIC_BASE_URL }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          prefix="${TOS_PREFIX:-ve}"
          public_base="${TOS_PUBLIC_BASE_URL:-https://cloudcache.volccdn.com}"
          download_base="${public_base%/}/${prefix}"
          node scripts/configure_npm_release.js "$VERSION" "$download_base"

      - name: Verify public TOS download
        env:
          TOS_PREFIX: ${{ vars.TOS_PREFIX }}
          TOS_PUBLIC_BASE_URL: ${{ vars.TOS_PUBLIC_BASE_URL }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          prefix="${TOS_PREFIX:-ve}"
          public_base="${TOS_PUBLIC_BASE_URL:-https://cloudcache.volccdn.com}"
          download_base="${public_base%/}/${prefix}"
          archive="volcengine-cli_${VERSION}_linux_amd64.zip"
          curl --fail --location --head "${download_base}/v${VERSION}/${archive}"

      - name: Test npm package
        working-directory: npm
        run: |
          npm test
          npm pack --dry-run

      - name: Publish npm package
        working-directory: npm
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          VERSION: ${{ steps.version.outputs.version }}
          NPM_TAG: ${{ steps.version.outputs.npm_tag }}
        run: |
          : "${NODE_AUTH_TOKEN:?missing secret NPM_TOKEN}"

          npm_version_or_empty() {
            local package_spec="$1"
            local error_file
            local version
            error_file="$(mktemp)"
            if version="$(npm view "$package_spec" version 2>"$error_file")"; then
              rm -f "$error_file"
              printf '%s' "$version"
              return
            fi
            if grep -Eq 'E404|No match found|is not in this registry' "$error_file"; then
              rm -f "$error_file"
              return
            fi
            cat "$error_file" >&2
            rm -f "$error_file"
            return 1
          }

          package_spec="@volcengine/cli@${VERSION}"
          published_version="$(npm_version_or_empty "$package_spec")"

          if [[ "$published_version" == "$VERSION" ]]; then
            # Re-run after a partial failure: the version is already on the
            # registry, so only point the channel at it.
            npm dist-tag add "$package_spec" "$NPM_TAG"
          else
            npm publish --access public --tag "$NPM_TAG"
          fi

      - name: Publish version manifest to TOS root
        if: ${{ steps.version.outputs.npm_tag == 'latest' }}
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.TOS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.TOS_SECRET_ACCESS_KEY }}
          AWS_MAX_ATTEMPTS: "2"
          AWS_CLI_CONNECT_TIMEOUT: "10"
          AWS_CLI_READ_TIMEOUT: "60"
          TOS_BUCKET: ${{ vars.TOS_BUCKET }}
          TOS_PREFIX: ${{ vars.TOS_PREFIX }}
          TOS_REGION: ${{ vars.TOS_REGION }}
          TOS_S3_ENDPOINT: ${{ vars.TOS_S3_ENDPOINT }}
          TOS_PUBLIC_BASE_URL: ${{ vars.TOS_PUBLIC_BASE_URL }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          : "${AWS_ACCESS_KEY_ID:?missing secret TOS_ACCESS_KEY_ID}"
          : "${AWS_SECRET_ACCESS_KEY:?missing secret TOS_SECRET_ACCESS_KEY}"

          export AWS_DEFAULT_REGION="${TOS_REGION:-cn-beijing}"
          bucket="${TOS_BUCKET:-eps-common-public}"
          prefix="${TOS_PREFIX:-ve}"
          endpoint="${TOS_S3_ENDPOINT:-https://tos-s3-cn-beijing.volces.com}"
          public_base="${TOS_PUBLIC_BASE_URL:-https://cloudcache.volccdn.com}"
          cdn_base="${public_base%/}/${prefix}"
          root_dest="s3://${bucket}/${prefix}/"

          VERSION="$VERSION" CDN_BASE="$cdn_base" python3 - <<'PY'
          import json, os
          from pathlib import Path
          version = os.environ["VERSION"]
          cdn_base = os.environ["CDN_BASE"]
          Path("latest").write_text(version + "\n")
          # min_supported / security_update are reserved for future policy;
          # leave empty/false until a real enforcement path exists.
          manifest = {
              "latest": version,
              "min_supported": "",
              "security_update": False,
              "channels": {"cdn_base": cdn_base},
          }
          Path("version_manifest.json").write_text(json.dumps(manifest, indent=2) + "\n")
          PY

          aws --endpoint-url "$endpoint" s3 cp version_manifest.json "${root_dest}version_manifest.json"
          aws --endpoint-url "$endpoint" s3 cp latest "${root_dest}latest"
          aws --endpoint-url "$endpoint" s3 ls "$root_dest"

      - name: Refresh CDN release pointers
        if: ${{ steps.version.outputs.npm_tag == 'latest' }}
        env:
          VOLCENGINE_ACCESS_KEY: ${{ secrets.VOLCENGINE_ACCESS_KEY }}
          VOLCENGINE_SECRET_KEY: ${{ secrets.VOLCENGINE_SECRET_KEY }}
          VOLCENGINE_REGION: ${{ vars.VOLCENGINE_REGION }}
          VOLCENGINE_CLI_SKIP_SKILLS: "1"
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          : "${VOLCENGINE_ACCESS_KEY:?missing secret VOLCENGINE_ACCESS_KEY}"
          : "${VOLCENGINE_SECRET_KEY:?missing secret VOLCENGINE_SECRET_KEY}"
          : "${VOLCENGINE_REGION:?missing variable VOLCENGINE_REGION}"

          npm install -g "@volcengine/cli@${VERSION}"
          ve cdn SubmitRefreshTask \
            --Type file \
            --UrlList.1 "https://cloudcache.volccdn.com/ve/latest" \
            --UrlList.2 "https://cloudcache.volccdn.com/ve/version_manifest.json"