release.yaml

---
# Release Workflow
#
# Builds and publishes:
# - Multi-arch container images (linux/amd64, linux/arm64)
# - Standalone binaries (linux-amd64, linux-arm64, darwin-arm64)
#
# Triggered by release-please or manually.
#
# release-please also publishes a GitHub release for the Helm chart
# (tero-edge-chart-v*). Only app releases (v*) and manual runs build here, and
# only the newest app release moves `latest`. A chart release or a manual run
# once moved `latest` to an untagged commit build.
name: release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      distribution:
        description: "Distribution to build"
        required: true
        default: "edge"
        type: choice
        options:
          - edge
          - datadog
          - otlp
          - prometheus
          - tail

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

permissions:
  contents: write
  packages: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

# =============================================================================
# Binary Builds
# =============================================================================

jobs:
  binary-build-linux:
    if: github.event_name == 'workflow_dispatch' || startsWith(github.event.release.tag_name, 'v')
    strategy:
      fail-fast: false
      matrix:
        distribution: ${{ github.event_name == 'workflow_dispatch' && fromJson(format('["{0}"]', inputs.distribution)) || fromJson('["edge", "datadog", "otlp", "prometheus", "tail"]') }}
        arch:
          - runner: ubuntu-24.04
            suffix: linux-amd64
          - runner: ubuntu-24.04-arm
            suffix: linux-arm64
    runs-on: ${{ matrix.arch.runner }}
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

      - name: Set binary name
        run: |
          if [ "${{ matrix.distribution }}" = "edge" ]; then
            echo "BINARY_NAME=edge" >> $GITHUB_ENV
          else
            echo "BINARY_NAME=edge-${{ matrix.distribution }}" >> $GITHUB_ENV
          fi

      - name: Install dependencies
        run: |
          sudo apt-get update
          # hyperscan is x86-only, vectorscan is the ARM-compatible fork
          if [ "$(uname -m)" = "x86_64" ]; then
            sudo apt-get install -y libhyperscan-dev
          else
            sudo apt-get install -y libvectorscan-dev
          fi
          sudo apt-get install -y libzstd-dev zlib1g-dev

      - name: Setup Zig
        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
        with:
          version: 0.16.0

      - name: Verify Zig
        run: |
          which zig
          zig version

      - name: Fetch Zig dependencies
        run: |
          for i in 1 2 3 4 5; do zig build --fetch && break || sleep 10; done

      - name: Build
        run: |
          zig build ${{ matrix.distribution }} -Dcpu=baseline -Doptimize=ReleaseSafe \
            -Dversion="${{ github.ref_name }}" -Dcommit="${{ github.sha }}"

      - name: Prepare artifact
        run: |
          mkdir -p artifacts
          cp zig-out/bin/edge-${{ matrix.distribution }} artifacts/${{ env.BINARY_NAME }}-${{ matrix.arch.suffix }}
          chmod +x artifacts/${{ env.BINARY_NAME }}-${{ matrix.arch.suffix }}

      - name: Upload artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: binary-${{ matrix.distribution }}-${{ matrix.arch.suffix }}
          path: artifacts/*
          if-no-files-found: error
          retention-days: 1

  binary-build-darwin:
    if: github.event_name == 'workflow_dispatch' || startsWith(github.event.release.tag_name, 'v')
    strategy:
      fail-fast: false
      matrix:
        distribution: ${{ github.event_name == 'workflow_dispatch' && fromJson(format('["{0}"]', inputs.distribution)) || fromJson('["edge", "datadog", "otlp", "prometheus", "tail"]') }}
    runs-on: macos-15 # Apple Silicon runner
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

      - name: Set binary name
        run: |
          if [ "${{ matrix.distribution }}" = "edge" ]; then
            echo "BINARY_NAME=edge" >> $GITHUB_ENV
          else
            echo "BINARY_NAME=edge-${{ matrix.distribution }}" >> $GITHUB_ENV
          fi

      - name: Install dependencies
        run: |
          brew install vectorscan zstd

      - name: Setup Zig
        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
        with:
          version: 0.16.0

      - name: Verify Zig
        run: |
          which zig
          zig version

      - name: Fetch Zig dependencies
        run: |
          for i in 1 2 3 4 5; do zig build --fetch && break || sleep 10; done

      - name: Build
        run: |
          zig build ${{ matrix.distribution }} -Dcpu=baseline -Doptimize=ReleaseSafe \
            -Dversion="${{ github.ref_name }}" -Dcommit="${{ github.sha }}"

      - name: Prepare artifact
        run: |
          mkdir -p artifacts
          cp zig-out/bin/edge-${{ matrix.distribution }} artifacts/${{ env.BINARY_NAME }}-darwin-arm64
          chmod +x artifacts/${{ env.BINARY_NAME }}-darwin-arm64

      - name: Upload artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: binary-${{ matrix.distribution }}-darwin-arm64
          path: artifacts/*
          if-no-files-found: error
          retention-days: 1

  upload-binaries:
    runs-on: ubuntu-latest
    needs: [binary-build-linux, binary-build-darwin]
    if: github.event_name == 'release' && startsWith(github.event.release.tag_name, 'v')
    timeout-minutes: 10
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: artifacts
          pattern: binary-*
          merge-multiple: true

      - name: List artifacts
        run: ls -la artifacts/

      - name: Upload binaries to release
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
        with:
          files: artifacts/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Summary
        run: |
          echo "## Binaries uploaded to release" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          ls -1 artifacts/ | while read f; do
            echo "- \`$f\`" >> "$GITHUB_STEP_SUMMARY"
          done

  # =============================================================================
  # Docker Image Builds
  # =============================================================================

  docker-build:
    if: github.event_name == 'workflow_dispatch' || startsWith(github.event.release.tag_name, 'v')
    strategy:
      fail-fast: false
      matrix:
        distribution: ${{ github.event_name == 'workflow_dispatch' && fromJson(format('["{0}"]', inputs.distribution)) || fromJson('["edge", "datadog", "otlp", "prometheus", "tail"]') }}
        arch:
          - platform: linux/amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.arch.runner }}
    timeout-minutes: 30
    steps:
      - name: Prepare
        run: |
          platform=${{ matrix.arch.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
          if [ "${{ matrix.distribution }}" = "edge" ]; then
            echo "REGISTRY_IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}" >> $GITHUB_ENV
          else
            echo "REGISTRY_IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-${{ matrix.distribution }}" >> $GITHUB_ENV
          fi

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: ${{ env.REGISTRY_IMAGE }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          context: .
          file: Dockerfile
          platforms: ${{ matrix.arch.platform }}
          build-args: |
            DISTRIBUTION=${{ matrix.distribution }}
            VERSION=${{ github.ref_name }}
            COMMIT=${{ github.sha }}
          labels: ${{ steps.meta.outputs.labels }}
          tags: ${{ env.REGISTRY_IMAGE }}
          outputs: type=image,push-by-digest=true,name-canonical=true,push=true
          provenance: false
          sbom: false

      - name: Export digest
        run: |
          mkdir -p ${{ runner.temp }}/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: digests-${{ matrix.distribution }}-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  docker-merge:
    runs-on: ubuntu-latest
    needs: docker-build
    if: github.event_name == 'workflow_dispatch' || startsWith(github.event.release.tag_name, 'v')
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        distribution: ${{ github.event_name == 'workflow_dispatch' && fromJson(format('["{0}"]', inputs.distribution)) || fromJson('["edge", "datadog", "otlp", "prometheus", "tail"]') }}
    steps:
      - name: Prepare
        run: |
          if [ "${{ matrix.distribution }}" = "edge" ]; then
            echo "REGISTRY_IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}" >> $GITHUB_ENV
          else
            echo "REGISTRY_IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-${{ matrix.distribution }}" >> $GITHUB_ENV
          fi

      - name: Download digests
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-${{ matrix.distribution }}-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout tags
        if: github.event_name == 'release'
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 0
          fetch-tags: true

      # `latest` is the newest app release. A manual run builds a branch, and a
      # patch to an older line (1.31.1 after 1.32.0) must not move it back.
      - name: Decide latest
        id: latest
        run: |
          enable=false
          if [ "${{ github.event_name }}" = "release" ]; then
            newest=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -1)
            if [ "$newest" = "${{ github.event.release.tag_name }}" ]; then enable=true; fi
            echo "newest app tag: $newest, this release: ${{ github.event.release.tag_name }}"
          fi
          echo "enable=$enable" >> "$GITHUB_OUTPUT"

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: ${{ env.REGISTRY_IMAGE }}
          flavor: |
            latest=false
          tags: |
            type=sha
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable=${{ steps.latest.outputs.enable }}

      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}

      - name: Summary
        run: |
          echo "## Docker Release" >> "$GITHUB_STEP_SUMMARY"
          echo "**Distribution:** ${{ matrix.distribution }}" >> "$GITHUB_STEP_SUMMARY"
          echo "**Image:** ${{ env.REGISTRY_IMAGE }}" >> "$GITHUB_STEP_SUMMARY"
          echo "**Tags:** ${{ steps.meta.outputs.tags }}" >> "$GITHUB_STEP_SUMMARY"