release.yml

name: 'Release'
run-name: K Framework Release ${{ github.ref_name }}
on:
  release:
    types:
      - prereleased
concurrency:
  group: ${{ github.workflow }}

jobs:

  set-release-id:
    name: 'Set Release ID'
    runs-on: ubuntu-24.04
    steps:
      - name: 'Get release_id'
        run: echo "release_id=$(jq --raw-output '.release.id' "$GITHUB_EVENT_PATH")" >> "${GITHUB_OUTPUT}"
        id: release
    outputs:
      release_id: ${{ steps.release.outputs.release_id }}

  source-tarball:
    name: 'Create source tarball'
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: 'Check out code'
        uses: actions/checkout@v4
        with:
          submodules: recursive
      - name: 'Create source tarball'
        env:
          GITHUB_TOKEN: ${{ secrets.JENKINS_GITHUB_PAT }}
        run: |
          set -x
          version=$(cat package/version)
          tarball=kframework-${version}-src.tar.gz
          # shellcheck disable=SC2038
          find . -name .git | xargs rm -r
          CURDIR=$(pwd)
          cd ..
          tar czvf "${tarball}" "$(basename "${CURDIR}")"
          mv "${tarball}" "${CURDIR}/"
          cd "${CURDIR}"
          gh release upload --repo runtimeverification/k --clobber "v${version}" "${tarball}"

  cachix-release:
    name: 'k-framework-binary cachix release'
    strategy:
      matrix:
        include:
          - runner: ubuntu-24.04
            os: ubuntu-24.04
          - runner: MacM1
            os: self-macos-12
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 120
    steps:
      - name: 'Check out code'
        uses: actions/checkout@v4

      - name: 'Install Nix'
        if: ${{ !startsWith(matrix.os, 'self') }}
        uses: cachix/install-nix-action@v22
        with:
          install_url: https://releases.nixos.org/nix/nix-2.13.3/install
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
            substituters = http://cache.nixos.org https://hydra.iohk.io
            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=

      - name: 'Install Cachix'
        if: ${{ !startsWith(matrix.os, 'self') }}
        uses: cachix/cachix-action@v14
        with:
          name: k-framework-binary

      - name: 'Publish K to k-framework-binary cache'
        uses: workflow/nix-shell-action@v3.3.0
        env:
          CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PRIVATE_KFB_TOKEN }}'
          GC_DONT_GC: '1'
        with:
          packages: jq
          script: |
            export PATH="$(nix build github:runtimeverification/kup --no-link --json | jq -r '.[].outputs | to_entries[].value')/bin:$PATH"
            kup publish k-framework-binary .#k --keep-days 180
            kup publish k-framework-binary .#k.openssl.procps.secp256k1 --keep-days 180

  ubuntu-jammy:
    name: 'K Ubuntu Jammy Package'
    runs-on: [self-hosted, linux, normal]
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v4
      - name: 'Build and Test Package'
        uses: ./.github/actions/test-package
        with:
          os: ubuntu
          distro: jammy
          llvm: 15
          pkg-name: kframework_amd64_ubuntu_jammy.deb
          build-package: package/debian/build-package jammy kframework
          test-package: package/debian/test-package
      - name: 'Upload the package built to the Summary Page'
        uses: actions/upload-artifact@v4
        with:
          name: kframework_amd64_ubuntu_jammy.deb
          path: kframework_amd64_ubuntu_jammy.deb
          if-no-files-found: error
          retention-days: 1
      - name: 'Upload Package to Release'
        env:
          GITHUB_TOKEN: ${{ secrets.JENKINS_GITHUB_PAT }}
        run: |
          set -x
          version=$(cat package/version)
          cp kframework_amd64_ubuntu_jammy.deb "kframework_${version}_amd64_ubuntu_jammy.deb"
          gh release upload --repo runtimeverification/k --clobber "v${version}" "kframework_${version}_amd64_ubuntu_jammy.deb"
      - name: 'Build, Test, and Push Dockerhub Image'
        shell: bash {0}
        env:
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }}
          DOCKERHUB_REPO: runtimeverificationinc/kframework-k
        run: |
          set -euxo pipefail
          version=$(cat package/version)
          version_tag=ubuntu-jammy-${version}
          docker login --username rvdockerhub --password "${DOCKERHUB_PASSWORD}"
          docker image build . --file package/docker/Dockerfile.ubuntu-jammy --tag "${DOCKERHUB_REPO}:${version_tag}"
          docker run --name "k-package-docker-test-jammy-${GITHUB_SHA}" --rm -it --detach "${DOCKERHUB_REPO}:${version_tag}"
          docker exec -t "k-package-docker-test-jammy-${GITHUB_SHA}" bash -c 'cd ~ && echo "module TEST imports BOOL endmodule" > test.k'
          docker exec -t "k-package-docker-test-jammy-${GITHUB_SHA}" bash -c 'cd ~ && kompile test.k --backend llvm'
          docker exec -t "k-package-docker-test-jammy-${GITHUB_SHA}" bash -c 'cd ~ && kompile test.k --backend haskell'
          docker exec -t "k-package-docker-test-jammy-${GITHUB_SHA}" bash -c 'cd ~ && pyk kompile test.k --backend llvm'
          docker exec -t "k-package-docker-test-jammy-${GITHUB_SHA}" bash -c 'cd ~ && pyk kompile test.k --backend haskell'
          docker image push "${DOCKERHUB_REPO}:${version_tag}"
      - name: 'Clean up Docker Container'
        if: always()
        run: |
          docker stop --time=0 "k-package-docker-test-jammy-${GITHUB_SHA}"
      - name: On Failure, Upload the kore-exec.tar.gz file to the Summary Page
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: kore-exec.tar.gz
          path: |
            **/kore-exec.tar.gz

  macos-build:
    name: 'Build MacOS Package'
    runs-on: macos-14
    timeout-minutes: 120
    environment: production
    needs: [set-release-id, source-tarball]
    steps:
      - name: Check out code
        uses: actions/checkout@v4
        with:
          submodules: recursive
          path: kframework

      - name: Check out matching homebrew repo branch
        uses: actions/checkout@v4
        id: checkout
        with:
          repository: runtimeverification/homebrew-k
          path: homebrew-k
          ref: staging
        continue-on-error: true

      - name: Check out homebrew repo master branch
        uses: actions/checkout@v4
        if: ${{ steps.checkout.outcome == 'failure' }}
        with:
          repository: runtimeverification/homebrew-k
          path: homebrew-k

      - name: Cache maven
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}-
          restore-keys: |
            ${{ runner.os }}-maven-

      - name: Mac Dependencies
        run: |
          # Via: https://github.com/ledger/ledger/commit/1eec9f86667cad3b0bbafb82a83739a0d30ca09f
          # Unlink and re-link to prevent errors when github mac runner images
          # install python outside of brew, for example:
          # https://github.com/orgs/Homebrew/discussions/3895
          # https://github.com/actions/setup-python/issues/577
          # https://github.com/actions/runner-images/issues/6459
          # https://github.com/actions/runner-images/issues/6507
          # https://github.com/actions/runner-images/issues/2322

          # shellcheck disable=SC2162
          brew list -1 | grep python | while read formula; do brew unlink "$formula"; brew link --overwrite "$formula"; done

      - name: Build brew bottle
        id: build
        env:
          HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK: 1
          MAVEN_OPTS: >-
              -Dhttp.keepAlive=false
              -Dmaven.wagon.http.pool=false
              -Dmaven.wagon.httpconnectionManager.ttlSeconds=30
        run: |
          PACKAGE=kframework
          VERSION=$(cat kframework/package/version)
          ROOT_URL='https://github.com/runtimeverification/k/releases/download'
          wget "$ROOT_URL/v${VERSION}/kframework-${VERSION}-src.tar.gz"
          cd homebrew-k
          ../kframework/package/macos/brew-update-to-local "${PACKAGE}" "${VERSION}"
          git commit "Formula/$PACKAGE.rb" -m "Update ${PACKAGE} to ${VERSION}: part 1"
          ../kframework/package/macos/brew-build-and-update-to-local-bottle "${PACKAGE}" "${VERSION}" "${ROOT_URL}"
          git reset HEAD^
          LOCAL_BOTTLE_NAME=$(basename "$(find . -name "kframework--${VERSION}.arm64_sonoma.bottle*.tar.gz")")
          # shellcheck disable=2001
          BOTTLE_NAME=$(echo "${LOCAL_BOTTLE_NAME#./}" | sed 's!kframework--!kframework-!')
          ../kframework/package/macos/brew-update-to-final "${PACKAGE}" "${VERSION}" "${ROOT_URL}"
          echo "path=${LOCAL_BOTTLE_NAME}" >> "${GITHUB_OUTPUT}"
          echo "path_remote=${BOTTLE_NAME}" >> "${GITHUB_OUTPUT}"

      - name: Upload bottle
        uses: actions/upload-artifact@v4
        with:
          name: homebrew
          path: homebrew-k

      - name: Delete Release
        if: failure()
        uses: actions/github-script@v7
        with:
          github-token: ${{secrets.GITHUB_TOKEN}}
          script: |
            const { owner, repo } = context.repo
            await github.rest.repos.deleteRelease({ owner, repo, release_id: ${{ needs.set-release-id.outputs.release_id }} })

    outputs:
      bottle_path: ${{ steps.build.outputs.path }}
      bottle_path_remote: ${{ steps.build.outputs.path_remote }}

  macos-test:
    name: 'Test MacOS Package'
    runs-on: macos-14
    timeout-minutes: 60
    environment: production
    needs: [macos-build, set-release-id]
    steps:
      - name: 'Check out matching homebrew repo branch'
        uses: actions/checkout@v4
        id: checkout
        with:
          repository: runtimeverification/homebrew-k
          token: ${{ secrets.JENKINS_GITHUB_PAT }}
          path: homebrew-k
          ref: staging
        continue-on-error: true

      - name: 'Check out homebrew repo master branch'
        uses: actions/checkout@v4
        if: ${{ steps.checkout.outcome == 'failure' }}
        with:
          repository: runtimeverification/homebrew-k
          token: ${{ secrets.JENKINS_GITHUB_PAT }}
          path: homebrew-k

      - name: 'Download bottle'
        uses: actions/download-artifact@v4
        with:
          name: homebrew
          path: homebrew-k-old

      - name: Mac Dependencies
        run: |
          # Via: https://github.com/ledger/ledger/commit/1eec9f86667cad3b0bbafb82a83739a0d30ca09f
          # Unlink and re-link to prevent errors when github mac runner images
          # install python outside of brew, for example:
          # https://github.com/orgs/Homebrew/discussions/3895
          # https://github.com/actions/setup-python/issues/577
          # https://github.com/actions/runner-images/issues/6459
          # https://github.com/actions/runner-images/issues/6507
          # https://github.com/actions/runner-images/issues/2322

          # shellcheck disable=SC2162
          brew list -1 | grep python | while read formula; do brew unlink "$formula"; brew link --overwrite "$formula"; done

      - name: 'Test brew bottle'
        id: test
        env:
          # github actions sets the JAVA_HOME variable to Java 8 explicitly for
          # some reason. There doesn't seem to be a way to tell it to unset the
          # variable, so instead we just have to tell it to use Java 17
          # explicitly instead.
          JAVA_HOME: ${{ env.JAVA_HOME_17_X64 }}
          HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK: 1
        run: |
          # The macOS public runners are prone to flakiness when running this
          # test suite, so the PL-tutorial is disabled for now.
          #   - https://github.com/runtimeverification/k/issues/3705
          cd homebrew-k-old
          brew tap runtimeverification/k "file:///$(pwd)"
          brew install ${{ needs.macos-build.outputs.bottle_path }} -v
          # cp -R /usr/local/share/kframework/pl-tutorial ~
          # WD=`pwd`
          # cd
          # echo 'Starting kserver...'
          # spawn-kserver $WD/kserver.log
          # cd pl-tutorial
          # echo 'Testing tutorial in user environment...'
          # make -j`sysctl -n hw.ncpu` ${MAKE_EXTRA_ARGS}
          # cd ~
          echo 'module TEST imports BOOL endmodule' > test.k
          kompile test.k --backend llvm
          kompile test.k --backend haskell

      - name: 'Check out code'
        uses: actions/checkout@v4
        with:
          path: k-homebrew-checkout
          token: ${{ secrets.JENKINS_GITHUB_PAT }}

      - name: 'Upload Package to Release'
        env:
          GITHUB_TOKEN: ${{ secrets.JENKINS_GITHUB_PAT }}
          BOTTLE_NAME: ${{ needs.macos-build.outputs.bottle_path }}
          REMOTE_BOTTLE_NAME: ${{ needs.macos-build.outputs.bottle_path_remote }}
        run: |
          set -x
          version=$(cat k-homebrew-checkout/package/version)
          mv "homebrew-k-old/${BOTTLE_NAME}" "homebrew-k-old/${REMOTE_BOTTLE_NAME}"
          gh release upload --repo runtimeverification/k --clobber "v${version}" "homebrew-k-old/${REMOTE_BOTTLE_NAME}"

      - run: |
          git config --global user.name rv-jenkins
          git config --global user.email devops@runtimeverification.com

      - name: 'Commit changes'
        run: |
          cp homebrew-k-old/Formula/kframework.rb homebrew-k/Formula/kframework.rb
          cd homebrew-k
          git commit -m 'Update brew package version' Formula/kframework.rb
          git push origin master

      - name: 'Delete Release'
        if: failure()
        uses: actions/github-script@v7
        with:
          github-token: ${{secrets.GITHUB_TOKEN}}
          script: |
            const { owner, repo } = context.repo
            await github.rest.repos.deleteRelease({ owner, repo, release_id: ${{ needs.set-release-id.outputs.release_id }} })

  release:
    name: 'Publish Release'
    runs-on: [self-hosted, linux, normal]
    environment: production
    needs: [cachix-release, macos-test, source-tarball, ubuntu-jammy, set-release-id]
    steps:
      - name: 'Check out code'
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Set up Java for publishing to GitHub Maven Packages
        uses: actions/setup-java@v4
        with:
          java-version: '11'
          distribution: 'adopt'
          overwrite-settings: true
          server-id: runtime.verification.snapshots
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD

      # Build and Run Tests in Docker
      - name: 'Set up Docker'
        uses: ./.github/actions/with-docker
        with:
          tag: k-release-ci-${{ github.sha }}
          os: ubuntu
          distro: jammy
          llvm: 15

      - name: 'Push Maven Packages'
        shell: bash {0}
        continue-on-error: true
        env:
          MAVEN_USERNAME: devops@runtimeverification.com
          MAVEN_PASSWORD: ${{ secrets.CLOUDREPO_PASSWORD }}
        run: |
          cat ~/.m2/settings.xml
          docker exec -t "k-release-ci-${GITHUB_SHA}" bash -c 'mkdir -p /home/github-runner/.m2'
          docker cp ~/.m2/settings.xml "k-release-ci-${GITHUB_SHA}:/tmp/settings.xml"
          docker exec -t "k-release-ci-${GITHUB_SHA} bash" -c 'mv /tmp/settings.xml /home/github-runner/.m2/settings.xml'
          docker exec -e MAVEN_USERNAME -e MAVEN_PASSWORD -t "k-release-ci-${GITHUB_SHA}" bash -c "mvn --batch-mode deploy"

      - name: 'Tear down Docker'
        if: always()
        run: |
          docker stop --time=0 "k-release-ci-${GITHUB_SHA}"
          docker container rm --force "k-release-ci-${GITHUB_SHA}" || true

      - name: Publish release
        uses: actions/github-script@v7
        with:
          github-token: ${{secrets.GITHUB_TOKEN}}
          script: |
            const { owner, repo } = context.repo
            await github.rest.repos.updateRelease({ owner, repo, release_id: ${{ needs.set-release-id.outputs.release_id }}, prerelease: false })

  pyk-publish:
    name: 'Publish pyk'
    runs-on: ubuntu-latest
    environment: production
    permissions:
      id-token: write
    needs: release
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.10'

      - name: Install Poetry
        uses: Gr1N/setup-poetry@v9

      - name: Build pyk
        working-directory: pyk
        run: |
          make build

      - name: Publish pyk to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: pyk/dist
          user: __token__
          password: ${{ secrets.PYPI_TOKEN }}
      - name: Wait for PyPi to publish Pyk
        run: |
          while true; do
            VERSION=$(cat package/version)
            if curl --fail --silent --location --head "https://pypi.org/project/kframework/$VERSION"; then
              break
            fi
            sleep 10
          done
  
  notify-dependents:
    name: 'Notify Dependents'
    runs-on: ubuntu-latest
    needs: pyk-publish
    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: 'Update dependents'
        env:
          GITHUB_TOKEN: ${{ secrets.JENKINS_GITHUB_PAT }}
        run: |
          set -x
          VERSION=$(cat package/version)
          curl --fail                                                          \
            -X POST                                                            \
            -H "Accept: application/vnd.github+json"                           \
            -H "Authorization: Bearer ${GITHUB_TOKEN}"                         \
            -H "X-GitHub-Api-Version: 2022-11-28"                              \
            https://api.github.com/repos/runtimeverification/devops/dispatches \
            -d '{"event_type":"on-demand-test","client_payload":{"repo":"runtimeverification/k","version":"'"${VERSION}"'"}}'

  pyk-build-docs:
    name: 'Build Pyk Documentation'
    needs: ubuntu-jammy
    runs-on: [self-hosted, linux, normal]
    timeout-minutes: 30
    steps:
      - name: 'Check out code'
        uses: actions/checkout@v4
      - name: 'Download K package from the Summary Page'
        uses: actions/download-artifact@v4
        with:
          name: kframework_amd64_ubuntu_jammy.deb
      - name: 'Set up Docker'
        uses: ./.github/actions/with-k-docker
        with:
          container-name: k-pyk-docs-${{ github.sha }}
          k-deb-path: kframework_amd64_ubuntu_jammy.deb
          install-backend-debs: false
      - name: 'Build documentation in Docker container'
        run: docker exec -u user k-pyk-docs-${{ github.sha }} make docs
      - name: 'Copy documentation from Docker container'
        run: docker cp k-pyk-docs-${{ github.sha }}:/home/user/docs/build pyk-docs
      - name: 'Upload pyk documentation to the Summary Page'
        uses: actions/upload-artifact@v4
        with:
          name: pyk-docs
          path: pyk-docs
          if-no-files-found: error
          retention-days: 1
      - name: 'Tear down Docker'
        if: always()
        run: docker stop --time=0 k-pyk-docs-${{ github.sha }}

  gh-pages:
    name: 'GitHub Pages deployment'
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    needs: [pyk-build-docs, pyk-publish]
    steps:
      - name: 'Install pandoc/texlive/calibre'
        run: |
          sudo apt update --yes
          sudo apt install --yes wget texlive-xetex libegl1 libopengl0
          sudo wget -nv -O- https://download.calibre-ebook.com/linux-installer.sh | sh /dev/stdin version=6.29.0
          sudo wget https://github.com/jgm/pandoc/releases/download/2.18/pandoc-2.18-1-amd64.deb -O /tmp/pandoc.deb
          sudo dpkg -i /tmp/pandoc.deb
      - name: 'Checkout code and set up web build'
        uses: actions/checkout@v4
        with:
          submodules: recursive
          path: gh-pages
          token: ${{ secrets.JENKINS_GITHUB_PAT }}
          fetch-depth: 0
      - name: 'Checkout PL Tutorial code'
        uses: actions/checkout@v4
        with:
          repository: runtimeverification/pl-tutorial
          path: gh-pages/k-distribution/pl-tutorial
          token: ${{ secrets.JENKINS_GITHUB_PAT }}
      - working-directory: gh-pages
        run: |
          git config --global user.name rv-jenkins
          git config --global user.email devops@runtimeverification.com
          git checkout --orphan gh-pages origin/master
      - name: 'Build webpage'
        working-directory: gh-pages
        run: |
          export PATH="$PATH":/opt/calibre
          cd web
          npm install
          npm run build
          npm run build-book
          npm run build-sitemap
          cd -
          mv web/public_content ./
          # shellcheck disable=SC2046
          rm -rf $(find . -maxdepth 1 -not -name public_content -a -not -name .git -a -not -path . -a -not -path .. -a -not -name CNAME)
          mv public_content/* ./
          rm -rf public_content
          touch .nojekyll
      - name: 'Download pyk documentation from the Summary Page'
        uses: actions/download-artifact@v4
        with:
          name: pyk-docs
          path: gh-pages/pyk
      - name: 'Push gh-pages branch'
        working-directory: gh-pages
        run: |
          set -x
          git add ./
          git commit -m 'gh-pages: Updated the website'
          git push --force origin gh-pages