release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

jobs:
  build:
    name: Build and upload release tarball
    runs-on: ubuntu-latest
    container: archlinux:latest

    steps:
      - name: Install dependencies
        run: pacman --noconfirm -Syu && pacman --needed --noconfirm -S base-devel gnupg gzip bzip2 xz git autoconf automake nasm curl mtools llvm clang lld

      - name: Import GPG public key
        run: gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 05D29860D0A0668AAEFB9D691F3C021BECA23821

      - name: Import GPG private key
        run: echo "$MINTSUKI_PRIVATE_KEY" | gpg --batch --import
        env:
          MINTSUKI_PRIVATE_KEY: ${{ secrets.MINTSUKI_PRIVATE_KEY }}

      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: '0'

      - name: Git config
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Get tag name
        run: echo "TAG_NAME=$(git describe --exact-match --tags $(git log -n1 --pretty='%h'))" >> $GITHUB_ENV

      - name: Package release tarball
        run: |
          set -e
          ./bootstrap
          ./configure
          make dist

      - name: Sign release tarball
        run: |
          set -e
          for f in limine-*.tar.*; do \
            gpg --batch --default-key 05D29860D0A0668AAEFB9D691F3C021BECA23821 --detach-sign $f; \
          done

      - name: Create release notes
        run: |
          cat <<EOF >rel_notes.txt
          Changelog can be found [here](https://github.com/Limine-Bootloader/Limine/blob/$TAG_NAME/ChangeLog).

          Binary release can be found [here](https://github.com/Limine-Bootloader/Limine/tree/$TAG_NAME-binary).
          EOF
          cat <<'EOF' >>rel_notes.txt

          Tarballs are signed using key ID `05D29860D0A0668AAEFB9D691F3C021BECA23821` which can be obtained from a keyserver such as `keyserver.ubuntu.com`.

          Import the public key with:
          ```bash
          gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 05D29860D0A0668AAEFB9D691F3C021BECA23821
          ```

          In order to verify the tarball with the given signature, do:
          ```bash
          gpg --verify <tarball sig file> <associated tarball>
          ```
          EOF

      - name: Release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda
        with:
          body_path: rel_notes.txt
          files: |
            limine-*.tar.*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}