auth-runtime/.forgejo/workflows/release.yml

name: Build and Release auth-rt

on:
  push:
    tags:
      - 'v*'

jobs:
  release:
    runs-on: docker
    steps:
      - uses: actions/checkout@v4

      - name: Install Go
        run: |
          curl -fsSL https://go.dev/dl/go1.22.12.linux-amd64.tar.gz | tar -C /usr/local -xz
          echo "/usr/local/go/bin" >> $GITHUB_PATH

      - name: Build all platforms
        run: |
          export PATH="/usr/local/go/bin:$PATH"
          export GOTOOLCHAIN=local
          cd cli
          for pair in darwin/arm64 darwin/amd64 linux/amd64 linux/arm64; do
            os="${pair%/*}"
            arch="${pair#*/}"
            echo "Building auth-rt-${os}-${arch}..."
            GOOS="$os" GOARCH="$arch" CGO_ENABLED=0 go build -ldflags="-s -w" -o "../auth-rt-${os}-${arch}" .
          done
          ls -lh ../auth-rt-*

      - name: Create release and upload binaries
        env:
          TAG: ${{ github.ref_name }}
          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
          API_URL: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
        run: |
          json_get() { node -e "process.stdout.write(String(JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')).$1 || ''))"; }

          # Create release
          RELEASE_ID=$(curl -s -X POST "$API_URL/releases" \
            -H "Authorization: token $FORGEJO_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\",\"body\":\"auth-rt $TAG\"}" \
            | json_get id)

          echo "Created release ID: $RELEASE_ID"

          # Upload each binary
          for f in auth-rt-*; do
            echo "Uploading $f..."
            curl -s -X POST "$API_URL/releases/$RELEASE_ID/assets?name=$f" \
              -H "Authorization: token $FORGEJO_TOKEN" \
              -H "Content-Type: application/octet-stream" \
              --data-binary "@$f"
            echo ""
          done

          # Maintain "latest" release
          LATEST_ID=$(curl -s "$API_URL/releases/tags/latest" \
            -H "Authorization: token $FORGEJO_TOKEN" | json_get id)

          if [ -n "$LATEST_ID" ]; then
            # Delete old assets
            ASSET_IDS=$(curl -s "$API_URL/releases/$LATEST_ID/assets" \
              -H "Authorization: token $FORGEJO_TOKEN" \
              | node -e "JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')).forEach(a=>console.log(a.id))")
            for aid in $ASSET_IDS; do
              curl -s -X DELETE "$API_URL/releases/$LATEST_ID/assets/$aid" \
                -H "Authorization: token $FORGEJO_TOKEN"
            done
            curl -s -X PATCH "$API_URL/releases/$LATEST_ID" \
              -H "Authorization: token $FORGEJO_TOKEN" \
              -H "Content-Type: application/json" \
              -d "{\"body\":\"auth-rt latest (from $TAG)\"}"
          else
            LATEST_ID=$(curl -s -X POST "$API_URL/releases" \
              -H "Authorization: token $FORGEJO_TOKEN" \
              -H "Content-Type: application/json" \
              -d '{"tag_name":"latest","name":"latest","body":"auth-rt latest","prerelease":true}' \
              | json_get id)
          fi

          for f in auth-rt-*; do
            curl -s -X POST "$API_URL/releases/$LATEST_ID/assets?name=$f" \
              -H "Authorization: token $FORGEJO_TOKEN" \
              -H "Content-Type: application/octet-stream" \
              --data-binary "@$f"
          done

          echo "Done. Release $TAG + latest updated."