release.yml

name: Build and Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version (e.g., v1.0.0)'
        required: true
        type: string
      source_repo:
        description: 'Source repository (e.g., user/repo)'
        required: true
        type: string
        default: 'Soar-Development/desktop-orchestrator'
      source_ref:
        description: 'Source branch/tag (e.g., main, v1.0.0)'
        required: true
        type: string
        default: 'main'

permissions:
  contents: write    # Required to create releases and upload assets
  actions: read      # Required to read workflow artifacts
  packages: write    # Required for package operations

jobs:
  build:
    name: Build Multi-Architecture Binaries
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - arch: amd64
            goarch: amd64
          - arch: arm64
            goarch: arm64
          - arch: armv7
            goarch: arm
            goarm: "7"
    
    steps:
    - name: Checkout runsand-install repository
      uses: actions/checkout@v4
    
    - name: Checkout source repository
      uses: actions/checkout@v4
      with:
        repository: ${{ github.event.inputs.source_repo }}
        ref: ${{ github.event.inputs.source_ref }}
        path: source
        token: ${{ secrets.SOURCE_REPO_TOKEN }}
    
    - name: Set up Go
      uses: actions/setup-go@v4
      with:
        go-version: '1.25'
        cache-dependency-path: source/client/go.sum
    
    - name: Install Garble
      run: go install mvdan.cc/garble@latest
    
    - name: Build binary
      env:
        GOOS: linux
        GOARCH: ${{ matrix.goarch }}
        GOARM: ${{ matrix.goarm }}
        CGO_ENABLED: 0
      run: |
        cd source/client
        
        # Set version in build
        VERSION="${{ github.event.inputs.version }}"
        LDFLAGS="-X main.version=${VERSION} -s -w"
        
        # Build obfuscated binary
        garble -literals -tiny -seed=random build -ldflags "${LDFLAGS}" -o "../../runsand-linux-${{ matrix.arch }}" ./cmd/client
        
        # Verify binary
        file "../../runsand-linux-${{ matrix.arch }}"
        ls -la "../../runsand-linux-${{ matrix.arch }}"
    
    - name: Upload binary artifact
      uses: actions/upload-artifact@v4
      with:
        name: runsand-linux-${{ matrix.arch }}
        path: runsand-linux-${{ matrix.arch }}
        retention-days: 1

  package:
    name: Create Debian Packages
    runs-on: ubuntu-latest
    needs: build
    strategy:
      matrix:
        include:
          - arch: amd64
            deb_arch: amd64
          - arch: arm64
            deb_arch: arm64
          - arch: armv7
            deb_arch: armhf
    
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
    
    - name: Download binary artifact
      uses: actions/download-artifact@v4
      with:
        name: runsand-linux-${{ matrix.arch }}
    
    - name: Create Debian package
      run: |
        VERSION="${{ github.event.inputs.version }}"
        CLEAN_VERSION="${VERSION#v}"  # Remove 'v' prefix
        BINARY_NAME="runsand-linux-${{ matrix.arch }}"
        PACKAGE_NAME="runsand_${CLEAN_VERSION}_${{ matrix.deb_arch }}.deb"
        
        # Create package directory structure
        mkdir -p "package/usr/local/bin"
        mkdir -p "package/DEBIAN"
        
        # Copy binary
        cp "${BINARY_NAME}" "package/usr/local/bin/runsand"
        chmod 755 "package/usr/local/bin/runsand"
        
        # Create control file
        cat > "package/DEBIAN/control" << EOF
        Package: runsand
        Version: ${CLEAN_VERSION}
        Architecture: ${{ matrix.deb_arch }}
        Maintainer: Runsand Team <info@runsand.dev>
        Depends: docker.io | docker-ce
        Description: Runsand Desktop Client
         Desktop-as-a-Service client for accessing cloud-based development environments.
         Provides secure, Solana wallet-authenticated access to containerized desktop
         sessions with full SSH access and development tools.
        Homepage: https://github.com/Soar-Development/runsand-installer
        EOF
        
        # Create postinst script
        cat > "package/DEBIAN/postinst" << 'EOF'
        #!/bin/bash
        set -e
        
        # Create user directories
        if [ "$1" = "configure" ]; then
            # This runs as root, but we want user dirs to be created when user runs runsand
            echo "Runsand installed successfully!"
            echo "Run 'sudo runsand' to get started (requires root privileges)."
        fi
        
        exit 0
        EOF
        chmod 755 "package/DEBIAN/postinst"
        
        # Create prerm script
        cat > "package/DEBIAN/prerm" << 'EOF'
        #!/bin/bash
        set -e
        
        # Stop any running runsand processes
        if [ "$1" = "remove" ]; then
            pkill -f "/usr/local/bin/runsand" || true
        fi
        
        exit 0
        EOF
        chmod 755 "package/DEBIAN/prerm"
        
        # Build package
        dpkg-deb --build package "${PACKAGE_NAME}"
        
        # Verify package
        dpkg-deb --info "${PACKAGE_NAME}"
        ls -la "${PACKAGE_NAME}"
    
    - name: Upload package artifact
      uses: actions/upload-artifact@v4
      with:
        name: runsand_${{ matrix.deb_arch }}.deb
        path: runsand_*.deb
        retention-days: 1

  release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs: [build, package]
    
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
    
    - name: Download all artifacts
      uses: actions/download-artifact@v4
    
    - name: Prepare release assets
      run: |
        # Create release directory
        mkdir -p release
        
        # Show current directory structure for debugging
        echo "Current directory structure:"
        find . -type f -name "*runsand*" -o -name "*.deb" | head -20
        
        # Move binaries (they should be in artifact subdirectories)
        if [ -f "runsand-linux-amd64/runsand-linux-amd64" ]; then
          mv runsand-linux-amd64/runsand-linux-amd64 release/
        fi
        if [ -f "runsand-linux-arm64/runsand-linux-arm64" ]; then
          mv runsand-linux-arm64/runsand-linux-arm64 release/
        fi
        if [ -f "runsand-linux-armv7/runsand-linux-armv7" ]; then
          mv runsand-linux-armv7/runsand-linux-armv7 release/
        fi
        
        # Move packages (find them and avoid duplicates)
        find . -name "*.deb" -not -path "./release/*" -exec cp {} release/ \;
        
        # Create checksums
        cd release
        if [ -n "$(ls -A .)" ]; then
          sha256sum * > checksums.txt
          
          # List all files
          echo "Release files:"
          ls -la
          echo "Checksums:"
          cat checksums.txt
        else
          echo "ERROR: No files found in release directory!"
          exit 1
        fi
    
    - name: Generate release notes
      run: |
        VERSION="${{ github.event.inputs.version }}"
        
        cat > release_notes.md << EOF
        # Runsand Desktop Client ${VERSION}
        
        ## Installation
        
        ### Universal Installer (Recommended)
        \`\`\`bash
        curl -sSL https://raw.githubusercontent.com/Soar-Development/runsand-installer/main/install.sh | bash
        \`\`\`
        
        ### Debian Package
        \`\`\`bash
        # AMD64
        wget https://github.com/Soar-Development/runsand-installer/releases/download/${VERSION}/runsand_$(echo ${VERSION} | sed 's/v//')_amd64.deb
        sudo dpkg -i runsand_*.deb
        
        # ARM64
        wget https://github.com/Soar-Development/runsand-installer/releases/download/${VERSION}/runsand_$(echo ${VERSION} | sed 's/v//')_arm64.deb
        sudo dpkg -i runsand_*.deb
        \`\`\`
        
        ### Manual Installation
        \`\`\`bash
        # Download for your architecture
        wget https://github.com/Soar-Development/runsand-installer/releases/download/${VERSION}/runsand-linux-amd64
        chmod +x runsand-linux-amd64
        sudo mv runsand-linux-amd64 /usr/local/bin/runsand
        \`\`\`
        
        ## Supported Architectures
        
        - **Linux AMD64** (Intel/AMD 64-bit) - \`runsand-linux-amd64\`
        - **Linux ARM64** (64-bit ARM) - \`runsand-linux-arm64\`
        - **Linux ARMv7** (32-bit ARM) - \`runsand-linux-armv7\`
        
        ## What's New
        
        This release includes the latest features and improvements from the main repository.
        
        ## Verification
        
        All binaries and packages can be verified using the provided checksums:
        
        \`\`\`bash
        # Download checksums
        wget https://github.com/Soar-Development/runsand-installer/releases/download/${VERSION}/checksums.txt
        
        # Verify your download
        sha256sum -c checksums.txt
        \`\`\`
        
        ---
        
        🚀 **Generated with GitHub Actions** from source repository: \`${{ github.event.inputs.source_repo }}\` @ \`${{ github.event.inputs.source_ref }}\`
        EOF
    
    - name: Create Release
      uses: softprops/action-gh-release@v1
      with:
        tag_name: ${{ github.event.inputs.version }}
        name: Runsand Desktop Client ${{ github.event.inputs.version }}
        body_path: release_notes.md
        files: |
          release/runsand-linux-amd64
          release/runsand-linux-arm64
          release/runsand-linux-armv7
          release/*.deb
          release/checksums.txt
        draft: false
        prerelease: false
      env:
        GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}