# GENERATED BY ./promote_to_release.ts -- DO NOT DIRECTLY EDIT

name: promote_to_release
on:
  workflow_dispatch:
    inputs:
      releaseKind:
        description: Kind of release
        type: choice
        options:
          - rc
          - lts
        required: true
      commitHash:
        description: 'rc: canary commit hash to promote. lts: release version to re-stamp, e.g. v2.9.3'
        required: true
jobs:
  promote-to-release-windows:
    name: Promote Windows to Release
    if: github.repository == 'denoland/deno'
    runs-on: windows-2022
    permissions:
      contents: write
      id-token: write
    environment:
      name: build
    strategy:
      matrix:
        target:
          - x86_64-pc-windows-msvc
          - aarch64-pc-windows-msvc
      fail-fast: false
    steps:
      - name: Clone repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          token: '${{ secrets.DENOBOT_PAT }}'
          submodules: false
      - name: Install deno
        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282
        with:
          deno-version: v2.x
      - name: Download Windows binaries
        run: |-
          # LTS is cut from a release branch with no canary build, so re-stamp
          # the already-published stable release binaries. RC still promotes
          # canary binaries by commit hash.
          if ("${{github.event.inputs.releaseKind}}" -eq "lts") {
            $Version = "${{github.event.inputs.commitHash}}" -replace "^v", ""
            $SrcUrl = "https://dl.deno.land/release/v$Version"
          } else {
            $SrcUrl = "https://dl.deno.land/canary/${{github.event.inputs.commitHash}}"
          }
          Invoke-WebRequest -Uri "$SrcUrl/deno-${{ matrix.target }}.zip" -OutFile "deno-windows.zip"
          Invoke-WebRequest -Uri "$SrcUrl/denort-${{ matrix.target }}.zip" -OutFile "denort-windows.zip"
          Expand-Archive -Path "deno-windows.zip" -DestinationPath "."
          Expand-Archive -Path "denort-windows.zip" -DestinationPath "."
      - name: Run patchver for Windows
        run: 'deno run -A --minimum-dependency-age=0 ./tools/release/promote_to_release_windows.ts ${{github.event.inputs.releaseKind}}'
      - name: Authenticate with Azure
        uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d
        with:
          client-id: '${{ secrets.AZURE_CLIENT_ID }}'
          tenant-id: '${{ secrets.AZURE_TENANT_ID }}'
          subscription-id: '${{ secrets.AZURE_SUBSCRIPTION_ID }}'
          enable-AzPSSession: true
      - name: Code sign deno.exe
        uses: Azure/artifact-signing-action@1d365fec12862c4aa68fcac418143d73f0cea293
        with:
          cache-dependencies: false
          trace: true
          endpoint: 'https://eus.codesigning.azure.net/'
          trusted-signing-account-name: deno-cli-code-signing
          certificate-profile-name: deno-cli-code-signing-cert
          files-folder: .
          files-folder-filter: deno.exe
          file-digest: SHA256
          timestamp-rfc3161: 'http://timestamp.acs.microsoft.com'
          timestamp-digest: SHA256
          exclude-environment-credential: true
          exclude-workload-identity-credential: true
          exclude-managed-identity-credential: true
          exclude-shared-token-cache-credential: true
          exclude-visual-studio-credential: true
          exclude-visual-studio-code-credential: true
          exclude-azure-cli-credential: false
      - name: Verify signature
        shell: pwsh
        run: |-
          $SignTool = Get-ChildItem -Path "C:\Program Files*\Windows Kits\*\bin\*\x64\signtool.exe" -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1
          $SignToolPath = $SignTool.FullName
          & $SignToolPath verify /pa /v "deno.exe"
      - name: Create archives
        run: |-
          Compress-Archive -Path "deno.exe" -DestinationPath "deno-${{ matrix.target }}.zip" -Force
          Compress-Archive -Path "denort.exe" -DestinationPath "denort-${{ matrix.target }}.zip" -Force
      - name: Upload Windows archives
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
        with:
          name: 'windows-binaries-${{ matrix.target }}'
          path: |-
            deno-${{ matrix.target }}.zip
            denort-${{ matrix.target }}.zip
  promote-to-release:
    name: Promote to Release
    needs:
      - promote-to-release-windows
    if: github.repository == 'denoland/deno'
    runs-on: macOS-latest
    steps:
      - name: Clone repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          token: '${{ secrets.DENOBOT_PAT }}'
          submodules: recursive
      - name: Authenticate with Google Cloud
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
        with:
          project_id: denoland
          credentials_json: '${{ secrets.GCP_SA_KEY }}'
          export_environment_variables: true
          create_credentials_file: true
      - name: Setup gcloud
        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
        with:
          project_id: denoland
      - name: Install deno
        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282
        with:
          deno-version: v2.x
      - name: Install rust-codesign
        run: |-
          ./tools/install_prebuilt.js rcodesign
          echo $GITHUB_WORKSPACE/third_party/prebuilt/mac >> $GITHUB_PATH
      - name: Promote to Release (non-Windows)
        env:
          APPLE_CODESIGN_KEY: '${{ secrets.APPLE_CODESIGN_KEY }}'
          APPLE_CODESIGN_PASSWORD: '${{ secrets.APPLE_CODESIGN_PASSWORD }}'
        run: 'deno run -A --minimum-dependency-age=0 ./tools/release/promote_to_release.ts ${{github.event.inputs.releaseKind}} ${{github.event.inputs.commitHash}}'
      - name: Download Windows binaries
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
        with:
          pattern: windows-binaries-*
          merge-multiple: true
          path: .
      - name: Create version file
        run: |-
          # Unzip a binary to get the version
          unzip -o deno-x86_64-apple-darwin.zip
          DENO_VERSION=$(./deno -V | cut -d ' ' -f 2 | cut -d '+' -f 1)
          echo "v${DENO_VERSION}" > release-${{github.event.inputs.releaseKind}}-latest.txt
          rm -f ./deno
      - name: Generate checksums
        run: |-
          # Re-stamping (patchver + re-sign) produces binaries that differ
          # byte-for-byte from the stable/canary artifacts they were promoted
          # from, so the checksums change too. Regenerate the sidecars here;
          # otherwise the source release's stale *.sha256sum stays in the
          # bucket and no longer matches the promoted zip (see #36235).
          for f in deno-*.zip denort-*.zip; do
            shasum -a 256 "$f" > "$f.sha256sum"
            tmp="$(mktemp -d)"
            unzip -o -q "$f" -d "$tmp"
            ( cd "$tmp" && shasum -a 256 deno* ) > "${f%.zip}.sha256sum"
            rm -rf "$tmp"
          done
      - name: Upload archives to dl.deno.land
        env:
          AWS_ACCESS_KEY_ID: '${{ vars.S3_ACCESS_KEY_ID }}'
          AWS_SECRET_ACCESS_KEY: '${{ secrets.S3_SECRET_ACCESS_KEY }}'
          AWS_ENDPOINT_URL_S3: '${{ vars.S3_ENDPOINT }}'
          AWS_DEFAULT_REGION: '${{vars.S3_REGION }}'
        run: |-
          VERSION=$(cat release-${{github.event.inputs.releaseKind}}-latest.txt)
          # Upload only the promoted release archives and their freshly
          # regenerated checksums. `aws s3 sync ./` walked the whole checkout
          # (submodules included), uploading stray *.zip test fixtures and
          # tripping over a broken symlink (exit 2).
          for f in deno-*.zip denort-*.zip; do
            aws s3 cp "./$f" "s3://dl-deno-land/release/$VERSION/$f"
            aws s3 cp "./$f.sha256sum" "s3://dl-deno-land/release/$VERSION/$f.sha256sum"
            aws s3 cp "./${f%.zip}.sha256sum" "s3://dl-deno-land/release/$VERSION/${f%.zip}.sha256sum"
          done
          aws s3 cp release-${{github.event.inputs.releaseKind}}-latest.txt s3://dl-deno-land/release-${{github.event.inputs.releaseKind}}-latest.txt

# gagen:pin Azure/artifact-signing-action@v0 = 1d365fec12862c4aa68fcac418143d73f0cea293
# gagen:pin actions/checkout@v6 = de0fac2e4500dabe0009e67214ff5f5447ce83dd
# gagen:pin actions/download-artifact@v7 = 37930b1c2abaa49bbe596cd826c3c89aef350131
# gagen:pin actions/upload-artifact@v6 = b7c566a772e6b6bfb58ed0dc250532a479d7789f
# gagen:pin azure/login@v1 = cb79c773a3cfa27f31f25eb3f677781210c9ce3d
# gagen:pin denoland/setup-deno@v2 = 667a34cdef165d8d2b2e98dde39547c9daac7282
# gagen:pin google-github-actions/auth@v3 = 7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
# gagen:pin google-github-actions/setup-gcloud@v3 = aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
