binary-release.yaml

name: Release varlock CLI binaries

# normal CI release workflow handles publishing multiple packages from the monorepo
# this workflow triggered by a release `varlock@x.y.z`
on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version (ex: "1.2.3")'
        required: true
        type: string
  release:
    types: [published]

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  debug:
    runs-on: ubuntu-latest
    steps:
      - name: print github context
        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}
        run: |
          echo "$GITHUB_CONTEXT"

  release-binaries:
    # was using github.ref.tag_name, but it seems that when publishing multiple tags at once, it was behaving weirdly
    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref_name, 'varlock@')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
      - name: Cache bun dependencies
        uses: actions/cache@v5
        with:
          path: ~/.bun/install/cache
          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
          restore-keys: |
            bun-${{ runner.os }}-
      - name: Use Node.js 24.x
        uses: actions/setup-node@v6
        with:
          node-version: "24.x"
      - name: Install node deps
        run: bun install
      - name: Enable turborepo build cache
        uses: rharkor/caching-for-turbo@v2.3.11
      # ------------------------------------------------------------

      - name: get version from release tag
        if: ${{ github.event_name == 'release' }}
        run: |
          # get the full release tag name - ex: varlock@1.2.3
          echo "RELEASE_TAG=${GITHUB_REF_NAME}" >> $GITHUB_ENV
          # get the version only from the tag - ex: 1.2.3
          echo "RELEASE_VERSION=${GITHUB_REF_NAME#varlock@}" >> $GITHUB_ENV

      - name: use manual version from input
        if: ${{ github.event_name == 'workflow_dispatch' }}
        run: |
          echo "RELEASE_TAG=varlock@${{ inputs.version }}" >> $GITHUB_ENV
          echo "RELEASE_VERSION=${{ inputs.version }}" >> $GITHUB_ENV

      - name: build libs
        run: bun run build:libs
        env:
          BUILD_TYPE: release
      - name: build varlock SEA binaries
        run: bun run packages/varlock/scripts/build-binaries.ts
      - name: add binaries to GH release
        env:
          # default token works to update release on this repo
          GH_TOKEN: ${{ github.token }}
        working-directory: packages/varlock/dist-sea
        run: gh release upload ${{ env.RELEASE_TAG }} *.{tar.gz,zip} checksums.txt --clobber

      # UPDATE HOMEBREW FORMULA ---
      - name: checkout homebrew tap repo
        uses: actions/checkout@v6
        with:
          repository: dmno-dev/homebrew-tap
          # need a different token to update a different repo
          token: ${{ secrets.HOMEBREW_REPO_GITHUB_ACCESS_TOKEN }}
          path: homebrew-tap
          clean: false
      - name: update homebrew formula
        run: bun run scripts/update-homebrew-formula.ts
      - name: commit and push homebrew tap update
        run: |
          cd homebrew-tap
          git config --global user.name 'theoephraim'
          git config --global user.email 'theo@dmno.dev'
          git add .
          git commit -m "varlock@${{ env.RELEASE_VERSION }}"
          git tag "varlock@${{ env.RELEASE_VERSION }}"
          git push origin HEAD --tags

  release-docker:
    needs: release-binaries
    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref_name, 'varlock@')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6

      - name: get version from release tag
        if: ${{ github.event_name == 'release' }}
        run: |
          # get the version only from the tag - ex: 1.2.3
          echo "RELEASE_VERSION=${GITHUB_REF_NAME#varlock@}" >> $GITHUB_ENV

      - name: use manual version from input
        if: ${{ github.event_name == 'workflow_dispatch' }}
        run: |
          echo "RELEASE_VERSION=${{ inputs.version }}" >> $GITHUB_ENV

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Dockerfile
          push: true
          tags: |
            ghcr.io/dmno-dev/varlock:${{ env.RELEASE_VERSION }}
            ghcr.io/dmno-dev/varlock:latest
          build-args: |
            VARLOCK_VERSION=${{ env.RELEASE_VERSION }}
          platforms: linux/amd64,linux/arm64