incudal/.github/workflows/agent-release.yml

name: Agent Build & Release

on:
  push:
    branches:
      - main
      - dev
    paths:
      - 'agent/**'
      - 'server/templates/agent-install.sh'
      - 'server/src/routes/agent.ts'
      - 'server/src/lib/agent-auth.ts'
      - 'server/src/lib/host-agent-credentials.ts'
      - 'server/src/services/agent-instance-report.ts'
      - '.github/workflows/agent-release.yml'
  pull_request:
    branches:
      - main
    paths:
      - 'agent/**'
      - 'server/templates/agent-install.sh'
      - 'server/src/routes/agent.ts'
      - 'server/src/lib/agent-auth.ts'
      - 'server/src/lib/host-agent-credentials.ts'
      - 'server/src/services/agent-instance-report.ts'
      - '.github/workflows/agent-release.yml'
  workflow_dispatch:
    inputs:
      publish_release:
        description: 'Publish an Agent GitHub Release using the version in agent/VERSION.'
        required: false
        default: false
        type: boolean

env:
  GO_VERSION: '1.22.x'

jobs:
  version:
    name: Resolve Agent Version
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      version: ${{ steps.version.outputs.version }}
      version_changed: ${{ steps.changed.outputs.version_changed }}
      should_release: ${{ steps.release.outputs.should_release }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Read Agent version
        id: version
        shell: bash
        run: |
          set -euo pipefail
          VERSION="$(tr -d '[:space:]' < agent/VERSION)"

          if [[ ! "${VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
            echo "Invalid Agent version: ${VERSION}" >&2
            echo "Expected vMAJOR.MINOR.PATCH or vMAJOR.MINOR.PATCH-suffix" >&2
            exit 1
          fi

          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
          echo "Agent version: ${VERSION}"

      - name: Detect agent/VERSION change
        id: changed
        shell: bash
        run: |
          set -euo pipefail

          VERSION_CHANGED=false
          if [[ "${GITHUB_EVENT_NAME}" == "push" ]]; then
            BEFORE="${{ github.event.before }}"
            AFTER="${{ github.sha }}"

            if [[ -z "${BEFORE}" || "${BEFORE}" =~ ^0+$ ]]; then
              VERSION_CHANGED=true
            elif git diff --name-only "${BEFORE}" "${AFTER}" | grep -qx 'agent/VERSION'; then
              VERSION_CHANGED=true
            fi
          fi

          echo "version_changed=${VERSION_CHANGED}" >> "${GITHUB_OUTPUT}"
          echo "agent/VERSION changed: ${VERSION_CHANGED}"

      - name: Decide release publishing
        id: release
        shell: bash
        run: |
          set -euo pipefail

          SHOULD_RELEASE=false
          if [[ "${GITHUB_EVENT_NAME}" == "push" && "${{ steps.changed.outputs.version_changed }}" == "true" ]]; then
            SHOULD_RELEASE=true
          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${{ inputs.publish_release }}" == "true" ]]; then
            SHOULD_RELEASE=true
          fi

          echo "should_release=${SHOULD_RELEASE}" >> "${GITHUB_OUTPUT}"
          echo "should release: ${SHOULD_RELEASE}"

  build-agent:
    name: Build Agent
    runs-on: ubuntu-latest
    needs:
      - version
    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: agent/go.mod

      - name: Test Agent
        working-directory: agent
        run: go test ./...

      - name: Build Agent release files
        run: VERSION="${{ needs.version.outputs.version }}" bash agent/scripts/build-release.sh

      - name: Prepare release assets
        shell: bash
        run: |
          set -euo pipefail
          VERSION="${{ needs.version.outputs.version }}"
          mkdir -p agent/release

          cp agent/dist/incudal-agent-linux-amd64 "agent/release/incudal-agent-x86_64-${VERSION}"
          cp agent/dist/incudal-agent-linux-arm64 "agent/release/incudal-agent-aarch64-${VERSION}"

      - name: Verify release assets
        shell: bash
        run: |
          set -euo pipefail
          VERSION="${{ needs.version.outputs.version }}"
          test -s "agent/release/incudal-agent-x86_64-${VERSION}"
          test -s "agent/release/incudal-agent-aarch64-${VERSION}"

      - name: Upload Agent artifacts
        uses: actions/upload-artifact@v4
        with:
          name: incudal-agent-${{ needs.version.outputs.version }}
          path: |
            agent/release/incudal-agent-x86_64-${{ needs.version.outputs.version }}
            agent/release/incudal-agent-aarch64-${{ needs.version.outputs.version }}
          retention-days: 30

  release-agent:
    name: Publish Agent Release
    runs-on: ubuntu-latest
    needs:
      - version
      - build-agent
    if: needs.version.outputs.should_release == 'true'
    permissions:
      contents: write

    steps:
      - name: Download Agent artifacts
        uses: actions/download-artifact@v4
        with:
          name: incudal-agent-${{ needs.version.outputs.version }}
          path: agent-release

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: agent-${{ needs.version.outputs.version }}
          target_commitish: ${{ github.sha }}
          name: Incudal Agent ${{ needs.version.outputs.version }}
          files: |
            agent-release/incudal-agent-x86_64-${{ needs.version.outputs.version }}
            agent-release/incudal-agent-aarch64-${{ needs.version.outputs.version }}
          generate_release_notes: true
          draft: false
          prerelease: ${{ contains(needs.version.outputs.version, '-') }}
          fail_on_unmatched_files: true
          overwrite_files: true