name: Release

on:
  push:
    tags:
      - 'v*.*.*'

env:
  CGO_ENABLED: 0
  VERSION: ${{ github.ref_name }}
  TRAEFIKER_EMAIL: "traefiker@traefik.io"
  CODENAME: langres

jobs:

  build-webui:
    if: github.ref_type == 'tag' && github.repository == 'traefik/traefik'
    uses: ./.github/workflows/template-webui.yaml

  build:
    if: github.ref_type == 'tag' && github.repository == 'traefik/traefik'
    runs-on: ubuntu-latest
    timeout-minutes: 45

    strategy:
      matrix:
        os: [ linux-amd64, linux-386, linux-arm, linux-arm64, linux-ppc64le, linux-s390x, linux-riscv64, darwin-amd64, darwin-arm64, windows-amd64, windows-arm64, windows-386, freebsd-amd64, freebsd-386, openbsd-amd64, openbsd-386, openbsd-riscv64 ]
    needs:
      - build-webui

    steps:
      - name: Check out code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        env:
          # Ensure cache consistency on Linux, see https://github.com/actions/setup-go/pull/383
          ImageOS: ${{ matrix.os }}
        with:
          go-version-file: '.go-version'
          check-latest: true

      - name: Artifact webui
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: webui.tar.gz

      - name: Untar webui
        run: |
          tar xvf webui.tar.gz
          rm webui.tar.gz

      - name: Go generate
        run: go generate


      - name: Generate goreleaser file
        run: |
          GORELEASER_CONFIG_FILE_PATH=$(go run ./internal/release "${{ matrix.os }}")
          echo "GORELEASER_CONFIG_FILE_PATH=$GORELEASER_CONFIG_FILE_PATH" >> $GITHUB_ENV

      - name: Build with goreleaser
        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          distribution: goreleaser
          # 'latest', 'nightly', or a semver
          version: '~> v2'
          args: release --clean --timeout="90m" --config "${{ env.GORELEASER_CONFIG_FILE_PATH }}"

      - name: Artifact binaries
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: ${{ matrix.os }}-binaries
          path: |
            dist/**/*_checksums.txt
            dist/**/*.tar.gz
            dist/**/*.zip
          retention-days: 1

  release:
    if: github.ref_type == 'tag' && github.repository == 'traefik/traefik'
    runs-on: ubuntu-latest
    timeout-minutes: 45

    needs:
      - build

    steps:
      - name: Check out code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

      - name: Artifact webui
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: webui.tar.gz

      - name: Untar webui
        run: |
          tar xvf webui.tar.gz
          rm webui.tar.gz

      - name: Retrieve the secret and decode it to a file
        env:
          TRAEFIKER_RSA: ${{ secrets.TRAEFIKER_RSA }}
        run: |
          mkdir -p ~/.ssh
          echo "${TRAEFIKER_RSA}" | base64 --decode > ~/.ssh/traefiker_rsa

      - name: Download All Artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: dist/
          pattern: "*-binaries"
          merge-multiple: true

      - name: Publish Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          cat dist/**/*_checksums.txt >> "dist/traefik_${VERSION}_checksums.txt"
          rm dist/**/*_checksums.txt
          tar cfz "dist/traefik-${VERSION}.src.tar.gz" \
            --exclude-vcs \
            --exclude .idea \
            --exclude .github \
            --exclude dist .

          chown -R "$(id -u)":"$(id -g)" dist/
          gh release create ${VERSION} ./dist/**/traefik*.{zip,tar.gz} ./dist/traefik*.{tar.gz,txt} --repo traefik/traefik --title ${VERSION} --notes ${VERSION} --latest=false

          ./script/deploy.sh
