tenant.openagents/omega

1use gh_workflow::{
2    Event, Expression, Level, Permissions, Push, Run, Step, Use, Workflow, ctx::Context,
3};
4use indoc::formatdoc;
5
6use crate::tasks::workflows::{
7    run_bundling::{build_static_bwrap, bundle_linux, bundle_mac, bundle_windows, upload_artifact},
8    run_tests,
9    runners::{self, Arch, Platform},
10    steps::{
11        self, CommonPermissionSets, DownloadArtifactStep, FluentBuilder, NamedJob,
12        TokenPermissions, dependant_job, named, release_job,
13    },
14    vars::{self, JobOutput, StepOutput, assets},
15};
16
17const CURRENT_ACTION_RUN_URL: &str =
18    "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}";
19
20pub(crate) fn release() -> Workflow {
21    let macos_tests = run_tests::run_platform_tests_no_filter(Platform::Mac);
22    let linux_tests = run_tests::run_platform_tests_no_filter(Platform::Linux);
23    let windows_tests = run_tests::run_platform_tests_no_filter(Platform::Windows);
24    let macos_clippy = run_tests::clippy(Platform::Mac, None, false);
25    let linux_clippy = run_tests::clippy(Platform::Linux, None, false);
26    let windows_clippy = run_tests::clippy(Platform::Windows, None, false);
27    let check_scripts = run_tests::check_scripts(false);
28
29    let create_draft_release = create_draft_release();
30    let (non_blocking_compliance_run, job_output) = compliance_check();
31
32    let bundle = ReleaseBundleJobs {
33        linux_aarch64: bundle_linux(
34            Arch::AARCH64,
35            None,
36            &[&linux_tests, &linux_clippy, &check_scripts],
37        ),
38        linux_x86_64: bundle_linux(
39            Arch::X86_64,
40            None,
41            &[&linux_tests, &linux_clippy, &check_scripts],
42        ),
43        bwrap_linux_aarch64: build_static_bwrap(
44            Arch::AARCH64,
45            &[&linux_tests, &linux_clippy, &check_scripts],
46        ),
47        bwrap_linux_x86_64: build_static_bwrap(
48            Arch::X86_64,
49            &[&linux_tests, &linux_clippy, &check_scripts],
50        ),
51        mac_aarch64: bundle_mac(
52            Arch::AARCH64,
53            None,
54            &[&macos_tests, &macos_clippy, &check_scripts],
55        ),
56        mac_x86_64: bundle_mac(
57            Arch::X86_64,
58            None,
59            &[&macos_tests, &macos_clippy, &check_scripts],
60        ),
61        windows_aarch64: bundle_windows(
62            Arch::AARCH64,
63            None,
64            &[&windows_tests, &windows_clippy, &check_scripts],
65        ),
66        windows_x86_64: bundle_windows(
67            Arch::X86_64,
68            None,
69            &[&windows_tests, &windows_clippy, &check_scripts],
70        ),
71    };
72
73    let upload_release_assets = upload_release_assets(&[&create_draft_release], &bundle);
74    let validate_release_assets = validate_release_assets(&[&upload_release_assets]);
75    let release_compliance = release_compliance_check(
76        &[&upload_release_assets, &non_blocking_compliance_run],
77        job_output,
78    );
79
80    let (auto_release_preview, auto_release_published) =
81        auto_release_preview(&[&validate_release_assets, &release_compliance]);
82
83    let test_jobs = [
84        &macos_tests,
85        &linux_tests,
86        &windows_tests,
87        &macos_clippy,
88        &linux_clippy,
89        &windows_clippy,
90        &check_scripts,
91    ];
92    let push_slack_notification = push_release_update_notification(
93        &create_draft_release,
94        &upload_release_assets,
95        &validate_release_assets,
96        &release_compliance,
97        &auto_release_preview,
98        &auto_release_published,
99        &test_jobs,
100        &bundle,
101    );
102
103    named::workflow()
104        .on(Event::default().push(Push::default().tags(vec!["v*".to_string()])))
105        .concurrency(vars::one_workflow_per_non_main_branch())
106        .with_minimal_permissions()
107        .add_env(("CARGO_TERM_COLOR", "always"))
108        .add_env(("RUST_BACKTRACE", "1"))
109        .add_job(macos_tests.name, macos_tests.job)
110        .add_job(linux_tests.name, linux_tests.job)
111        .add_job(windows_tests.name, windows_tests.job)
112        .add_job(macos_clippy.name, macos_clippy.job)
113        .add_job(linux_clippy.name, linux_clippy.job)
114        .add_job(windows_clippy.name, windows_clippy.job)
115        .add_job(check_scripts.name, check_scripts.job)
116        .add_job(create_draft_release.name, create_draft_release.job)
117        .add_job(
118            non_blocking_compliance_run.name,
119            non_blocking_compliance_run.job,
120        )
121        .map(|mut workflow| {
122            for job in bundle.into_jobs() {
123                workflow = workflow.add_job(job.name, job.job);
124            }
125            workflow
126        })
127        .add_job(upload_release_assets.name, upload_release_assets.job)
128        .add_job(validate_release_assets.name, validate_release_assets.job)
129        .add_job(release_compliance.name, release_compliance.job)
130        .add_job(auto_release_preview.name, auto_release_preview.job)
131        .add_job(push_slack_notification.name, push_slack_notification.job)
132}
133
134pub(crate) struct ReleaseBundleJobs {
135    pub linux_aarch64: NamedJob,
136    pub linux_x86_64: NamedJob,
137    pub bwrap_linux_aarch64: NamedJob,
138    pub bwrap_linux_x86_64: NamedJob,
139    pub mac_aarch64: NamedJob,
140    pub mac_x86_64: NamedJob,
141    pub windows_aarch64: NamedJob,
142    pub windows_x86_64: NamedJob,
143}
144
145impl ReleaseBundleJobs {
146    pub fn jobs(&self) -> Vec<&NamedJob> {
147        vec![
148            &self.linux_aarch64,
149            &self.linux_x86_64,
150            &self.bwrap_linux_aarch64,
151            &self.bwrap_linux_x86_64,
152            &self.mac_aarch64,
153            &self.mac_x86_64,
154            &self.windows_aarch64,
155            &self.windows_x86_64,
156        ]
157    }
158
159    pub fn into_jobs(self) -> Vec<NamedJob> {
160        vec![
161            self.linux_aarch64,
162            self.linux_x86_64,
163            self.bwrap_linux_aarch64,
164            self.bwrap_linux_x86_64,
165            self.mac_aarch64,
166            self.mac_x86_64,
167            self.windows_aarch64,
168            self.windows_x86_64,
169        ]
170    }
171}
172
173pub(crate) fn create_sentry_release() -> Step<Use> {
174    named::uses(
175        "getsentry",
176        "action-release",
177        "526942b68292201ac6bbb99b9a0747d4abee354c", // v3
178    )
179    .add_env(("SENTRY_ORG", "zed-dev"))
180    .add_env(("SENTRY_PROJECT", "zed"))
181    .add_env(("SENTRY_AUTH_TOKEN", vars::SENTRY_AUTH_TOKEN))
182    .add_with(("environment", "production"))
183}
184
185pub(crate) const COMPLIANCE_REPORT_PATH: &str = "compliance-report-${GITHUB_REF_NAME}.md";
186pub(crate) const COMPLIANCE_REPORT_ARTIFACT_PATH: &str =
187    "compliance-report-${{ github.ref_name }}.md";
188pub(crate) const COMPLIANCE_STEP_ID: &str = "run-compliance-check";
189const NEEDS_REVIEW_PULLS_URL: &str = "https://github.com/zed-industries/zed/pulls?q=is%3Apr+is%3Aclosed+label%3A%22PR+state%3Aneeds+review%22";
190
191pub(crate) enum ComplianceContext {
192    Release { non_blocking_outcome: JobOutput },
193    ReleaseNonBlocking,
194    Scheduled { tag_source: StepOutput },
195}
196
197impl ComplianceContext {
198    fn tag_source(&self) -> Option<&StepOutput> {
199        match self {
200            ComplianceContext::Scheduled { tag_source } => Some(tag_source),
201            _ => None,
202        }
203    }
204}
205
206pub(crate) fn add_compliance_steps(
207    job: gh_workflow::Job,
208    context: ComplianceContext,
209) -> (gh_workflow::Job, StepOutput) {
210    fn run_compliance_check(context: &ComplianceContext) -> (Step<Run>, StepOutput) {
211        let job = named::bash(
212            formatdoc! {r#"
213                cargo xtask compliance version {target} --report-path "{COMPLIANCE_REPORT_PATH}"
214                "#,
215                target = if context.tag_source().is_some() { r#""$LATEST_TAG" --branch main"# } else { r#""$GITHUB_REF_NAME""# },
216            }
217        )
218        .id(COMPLIANCE_STEP_ID)
219        .add_env(("GITHUB_APP_ID", vars::ZED_ZIPPY_APP_ID))
220        .add_env(("GITHUB_APP_KEY", vars::ZED_ZIPPY_APP_PRIVATE_KEY))
221        .when_some(context.tag_source(), |step, tag_source| {
222            step.add_env(("LATEST_TAG", tag_source.to_string()))
223        })
224        .when(
225            matches!(
226                context,
227                ComplianceContext::Scheduled { .. } | ComplianceContext::ReleaseNonBlocking
228            ),
229            |step| step.continue_on_error(true),
230        );
231
232        let result = StepOutput::new_unchecked(&job, "outcome");
233        (job, result)
234    }
235
236    let upload_step = upload_artifact(COMPLIANCE_REPORT_ARTIFACT_PATH)
237        .if_condition(Expression::new("always()"))
238        .when(
239            matches!(context, ComplianceContext::Release { .. }),
240            |step| step.overwrite(true),
241        );
242
243    let (success_prefix, failure_prefix) = match context {
244        ComplianceContext::Release { .. } => {
245            ("✅ Compliance check passed", "❌ Compliance check failed")
246        }
247        ComplianceContext::ReleaseNonBlocking => (
248            "✅ Compliance check passed",
249            "❌ Preliminary compliance check failed (but this can still be fixed while the builds are running!)",
250        ),
251        ComplianceContext::Scheduled { .. } => (
252            "✅ Scheduled compliance check passed",
253            "⚠️ Scheduled compliance check failed",
254        ),
255    };
256
257    let script = formatdoc! {r#"
258        if [ "$COMPLIANCE_OUTCOME" == "success" ]; then
259            STATUS="{success_prefix} for $COMPLIANCE_TAG"
260            MESSAGE=$(printf "%s\n\nReport: %s" "$STATUS" "$ARTIFACT_URL")
261        else
262            STATUS="{failure_prefix} for $COMPLIANCE_TAG"
263            MESSAGE=$(printf "%s\n\nReport: %s\nPRs needing review: %s" "$STATUS" "$ARTIFACT_URL" "{NEEDS_REVIEW_PULLS_URL}")
264        fi
265
266        curl -X POST -H 'Content-type: application/json' \
267            --data "$(jq -n --arg text "$MESSAGE" '{{"text": $text}}')" \
268            "$SLACK_WEBHOOK"
269        "#,
270    };
271
272    let notification_step = Step::new("send_compliance_slack_notification")
273        .run(&script)
274        .if_condition(match &context {
275            ComplianceContext::Release {
276                non_blocking_outcome,
277            } => Expression::new(format!(
278                "${{{{ failure() || {prior_outcome} != 'success' }}}}",
279                prior_outcome = non_blocking_outcome.expr()
280            )),
281            ComplianceContext::Scheduled { .. } | ComplianceContext::ReleaseNonBlocking => {
282                Expression::new("${{ always() }}")
283            }
284        })
285        .add_env(("SLACK_WEBHOOK", vars::SLACK_WEBHOOK_WORKFLOW_FAILURES))
286        .add_env((
287            "COMPLIANCE_OUTCOME",
288            format!("${{{{ steps.{COMPLIANCE_STEP_ID}.outcome }}}}"),
289        ))
290        .add_env((
291            "COMPLIANCE_TAG",
292            match &context {
293                ComplianceContext::Release { .. } | ComplianceContext::ReleaseNonBlocking => {
294                    Context::github().ref_name().to_string()
295                }
296                ComplianceContext::Scheduled { tag_source } => tag_source.to_string(),
297            },
298        ))
299        .add_env((
300            "ARTIFACT_URL",
301            format!("{CURRENT_ACTION_RUN_URL}#artifacts"),
302        ));
303
304    let (compliance_step, check_result) = run_compliance_check(&context);
305
306    (
307        job.add_step(compliance_step)
308            .add_step(upload_step)
309            .add_step(notification_step)
310            .when(
311                matches!(context, ComplianceContext::ReleaseNonBlocking),
312                |step| step.outputs([("outcome".to_string(), check_result.to_string())]),
313            ),
314        check_result,
315    )
316}
317
318fn compliance_check() -> (NamedJob, JobOutput) {
319    let job = release_job(&[])
320        .runs_on(runners::LINUX_SMALL)
321        .add_step(
322            steps::checkout_repo()
323                .with_full_history()
324                .with_ref(Context::github().ref_()),
325        )
326        .add_step(steps::cache_rust_dependencies_namespace());
327
328    let (compliance_job, check_result) =
329        add_compliance_steps(job, ComplianceContext::ReleaseNonBlocking);
330    let compliance_job = named::job(compliance_job);
331    let check_result = check_result.as_job_output(&compliance_job);
332
333    (compliance_job, check_result)
334}
335
336fn validate_release_assets(deps: &[&NamedJob]) -> NamedJob {
337    let expected_assets: Vec<String> = assets::all().iter().map(|a| format!("\"{a}\"")).collect();
338    let expected_assets_json = format!("[{}]", expected_assets.join(", "));
339
340    let validation_script = formatdoc! {r#"
341        EXPECTED_ASSETS='{expected_assets_json}'
342        TAG="$GITHUB_REF_NAME"
343
344        ACTUAL_ASSETS=$(gh release view "$TAG" --repo=zed-industries/zed --json assets -q '[.assets[].name]')
345
346        MISSING_ASSETS=$(echo "$EXPECTED_ASSETS" | jq -r --argjson actual "$ACTUAL_ASSETS" '. - $actual | .[]')
347
348        if [ -n "$MISSING_ASSETS" ]; then
349            echo "Error: The following assets are missing from the release:"
350            echo "$MISSING_ASSETS"
351            exit 1
352        fi
353
354        echo "All expected assets are present in the release."
355        "#,
356    };
357
358    named::job(
359        dependant_job(deps)
360            .runs_on(runners::LINUX_SMALL)
361            // The release is still a draft at this point, and draft releases are
362            // only visible to tokens with write access to repository contents.
363            .permissions(Permissions::default().contents(Level::Write))
364            .add_step(
365                named::bash(&validation_script).add_env(("GITHUB_TOKEN", vars::GITHUB_TOKEN)),
366            ),
367    )
368}
369
370fn release_compliance_check(deps: &[&NamedJob], non_blocking_outcome: JobOutput) -> NamedJob {
371    let job = dependant_job(deps)
372        .runs_on(runners::LINUX_LARGE)
373        .add_step(
374            steps::checkout_repo()
375                .with_full_history()
376                .with_ref(Context::github().ref_()),
377        )
378        .add_step(steps::cache_rust_dependencies_namespace());
379
380    let (job, _) = add_compliance_steps(
381        job,
382        ComplianceContext::Release {
383            non_blocking_outcome,
384        },
385    );
386
387    named::job(job)
388}
389
390fn auto_release_preview(deps: &[&NamedJob]) -> (NamedJob, JobOutput) {
391    fn auto_release_preview(token: &StepOutput) -> Step<Run> {
392        named::bash(indoc::indoc! {r#"
393            tag="$GITHUB_REF_NAME"
394            release_published=false
395
396            if [[ ! "$tag" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)-pre$ ]]; then
397                echo "::error::expected preview release tag in the form vMAJOR.MINOR.PATCH-pre, got $tag"
398                exit 1
399            fi
400
401            major="${BASH_REMATCH[1]}"
402            minor="${BASH_REMATCH[2]}"
403            should_release=true
404
405            released_preview="$(script/get-released-version preview)"
406            if [[ -z "$released_preview" || "$released_preview" == "null" ]]; then
407                echo "::error::could not determine released preview version"
408                exit 1
409            fi
410
411            released_preview_major="$(echo "$released_preview" | cut -d. -f1)"
412            released_preview_minor="$(echo "$released_preview" | cut -d. -f2)"
413
414            if [[ "$released_preview_major" != "$major" || "$released_preview_minor" != "$minor" ]]; then
415                should_release=false
416                echo "Leaving $tag as a draft because it is the first preview release for v${major}.${minor}.x"
417            fi
418
419            if [[ "$should_release" == "true" ]]; then
420                gh release edit "$tag" --repo=zed-industries/zed --draft=false
421                release_published=true
422            fi
423
424            echo "release_published=$release_published" >> "$GITHUB_OUTPUT"
425        "#})
426        .id("auto-release-preview")
427        .add_env(("GITHUB_TOKEN", token))
428    }
429
430    let (authenticate, token) = steps::authenticate_as_zippy()
431        .for_repository(steps::RepositoryTarget::current())
432        .with_permissions([(steps::TokenPermissions::Contents, Level::Write)])
433        .into();
434    let auto_release_preview_step = auto_release_preview(&token);
435    let release_published = StepOutput::new(&auto_release_preview_step, "release_published");
436
437    let job = named::job(
438        dependant_job(deps)
439            .runs_on(runners::LINUX_SMALL)
440            .cond(Expression::new(indoc::indoc!(
441                r#"startsWith(github.ref, 'refs/tags/v') && endsWith(github.ref, '-pre')"#
442            )))
443            .add_step(authenticate)
444            .add_step(
445                steps::checkout_repo()
446                    .with_token(&token)
447                    .with_ref(Context::github().ref_()),
448            )
449            .add_step(auto_release_preview_step)
450            .outputs([(
451                release_published.name.to_owned(),
452                release_published.to_string(),
453            )]),
454    );
455    let release_published = release_published.as_job_output(&job);
456    (job, release_published)
457}
458
459pub(crate) fn download_workflow_artifacts() -> DownloadArtifactStep {
460    steps::download_artifact().path("./artifacts/")
461}
462
463pub(crate) fn prep_release_artifacts() -> Step<Run> {
464    let mut script_lines = vec!["mkdir -p release-artifacts/\n".to_string()];
465    for asset in assets::all() {
466        let mv_command = format!("mv ./artifacts/{asset}/{asset} release-artifacts/{asset}");
467        script_lines.push(mv_command)
468    }
469
470    named::bash(&script_lines.join("\n"))
471}
472
473fn upload_release_assets(deps: &[&NamedJob], bundle: &ReleaseBundleJobs) -> NamedJob {
474    let mut deps = deps.to_vec();
475    deps.extend(bundle.jobs());
476
477    named::job(
478        dependant_job(&deps)
479            .runs_on(runners::LINUX_MEDIUM)
480            .permissions(Permissions::default().contents(Level::Write))
481            .add_step(download_workflow_artifacts())
482            .add_step(steps::script("ls -lR ./artifacts"))
483            .add_step(prep_release_artifacts())
484            .add_step(
485                steps::script("gh release upload \"$GITHUB_REF_NAME\" --repo=zed-industries/zed release-artifacts/*")
486                    .add_env(("GITHUB_TOKEN", vars::GITHUB_TOKEN)),
487            ),
488    )
489}
490
491fn create_draft_release() -> NamedJob {
492    fn generate_release_notes() -> Step<Run> {
493        named::bash(
494            r#"node --redirect-warnings=/dev/null ./script/draft-release-notes "$RELEASE_VERSION" "$RELEASE_CHANNEL" > target/release-notes.md"#,
495        )
496    }
497
498    fn create_release(token: StepOutput) -> Step<Run> {
499        named::bash("script/create-draft-release target/release-notes.md")
500            .add_env(("GITHUB_TOKEN", token.to_string()))
501    }
502
503    let (authenticate_step, token) = steps::authenticate_as_zippy()
504        .for_repository(steps::RepositoryTarget::current())
505        .with_permissions([(TokenPermissions::Contents, Level::Write)])
506        .into();
507
508    named::job(
509        release_job(&[])
510            .runs_on(runners::LINUX_SMALL)
511            // We need to fetch more than one commit so that `script/draft-release-notes`
512            // is able to diff between the current and previous tag.
513            //
514            // 25 was chosen arbitrarily.
515            .add_step(authenticate_step)
516            .add_step(
517                steps::checkout_repo()
518                    .with_custom_fetch_depth(25)
519                    .with_ref(Context::github().ref_()),
520            )
521            .add_step(steps::script("script/determine-release-channel"))
522            .add_step(steps::script("mkdir -p target/"))
523            .add_step(generate_release_notes())
524            .add_step(create_release(token)),
525    )
526}
527
528pub(crate) fn push_release_update_notification(
529    create_draft_release_job: &NamedJob,
530    upload_assets_job: &NamedJob,
531    validate_assets_job: &NamedJob,
532    compliance_job: &NamedJob,
533    auto_release_preview: &NamedJob,
534    auto_release_published: &JobOutput,
535    test_jobs: &[&NamedJob],
536    bundle_jobs: &ReleaseBundleJobs,
537) -> NamedJob {
538    fn env_name(name: &str) -> String {
539        format!("RESULT_{}", name.to_uppercase())
540    }
541
542    let all_job_names: Vec<&str> = test_jobs
543        .iter()
544        .map(|j| j.name.as_ref())
545        .chain(bundle_jobs.jobs().into_iter().map(|j| j.name.as_ref()))
546        .collect();
547
548    let env_entries = [
549        (
550            "DRAFT_RESULT".into(),
551            format!("${{{{ needs.{}.result }}}}", create_draft_release_job.name),
552        ),
553        (
554            "UPLOAD_RESULT".into(),
555            format!("${{{{ needs.{}.result }}}}", upload_assets_job.name),
556        ),
557        (
558            "VALIDATE_RESULT".into(),
559            format!("${{{{ needs.{}.result }}}}", validate_assets_job.name),
560        ),
561        (
562            "COMPLIANCE_RESULT".into(),
563            format!("${{{{ needs.{}.result }}}}", compliance_job.name),
564        ),
565        (
566            "AUTO_RELEASE_RESULT".into(),
567            format!("${{{{ needs.{}.result }}}}", auto_release_preview.name),
568        ),
569        (
570            "AUTO_RELEASE_PUBLISHED".into(),
571            auto_release_published.to_string(),
572        ),
573        ("RUN_URL".into(), CURRENT_ACTION_RUN_URL.to_string()),
574        ("TAG".into(), Context::github().ref_name().to_string()),
575    ]
576    .into_iter()
577    .chain(
578        all_job_names
579            .iter()
580            .map(|name| (env_name(name), format!("${{{{ needs.{name}.result }}}}"))),
581    );
582
583    let failure_checks = all_job_names
584        .iter()
585        .map(|name| {
586            format!(
587                "if [ \"${env_name}\" == \"failure\" ];then FAILED_JOBS=\"$FAILED_JOBS {name}\"; fi",
588                    env_name = env_name(name)
589            )
590        })
591        .collect::<Vec<_>>()
592        .join("\n        ");
593
594    let notification_script = formatdoc! {r#"
595        if [ "$DRAFT_RESULT" == "failure" ]; then
596            echo "❌ Draft release creation failed for $TAG: $RUN_URL"
597        else
598            RELEASE_URL=$(gh release view "$TAG" --repo=zed-industries/zed --json url -q '.url')
599            if [ "$UPLOAD_RESULT" == "failure" ]; then
600                echo "❌ Release asset upload failed for $TAG: $RELEASE_URL"
601            elif [ "$UPLOAD_RESULT" == "cancelled" ] || [ "$UPLOAD_RESULT" == "skipped" ]; then
602                FAILED_JOBS=""
603                {failure_checks}
604                FAILED_JOBS=$(echo "$FAILED_JOBS" | xargs)
605                if [ "$UPLOAD_RESULT" == "cancelled" ]; then
606                    if [ -n "$FAILED_JOBS" ]; then
607                        echo "❌ Release job for $TAG was cancelled, most likely because tests \`$FAILED_JOBS\` failed: $RUN_URL"
608                    else
609                        echo "❌ Release job for $TAG was cancelled: $RUN_URL"
610                    fi
611                else
612                    if [ -n "$FAILED_JOBS" ]; then
613                        echo "❌ Tests \`$FAILED_JOBS\` for $TAG failed: $RUN_URL"
614                    else
615                        echo "❌ Tests for $TAG failed: $RUN_URL"
616                    fi
617                fi
618            elif [ "$COMPLIANCE_RESULT" == "failure" ]; then
619                # We already notify within that job
620                echo ""
621            elif [ "$VALIDATE_RESULT" == "failure" ]; then
622                echo "❌ Release validation failed for $TAG: missing assets: $RUN_URL"
623            elif [ "$AUTO_RELEASE_RESULT" == "failure" ]; then
624                echo "❌ Auto release failed for $TAG: $RUN_URL"
625            elif [ "$AUTO_RELEASE_RESULT" == "success" ] && [ "$AUTO_RELEASE_PUBLISHED" == "true" ]; then
626                echo "✅ Release $TAG was auto-released successfully: $RELEASE_URL"
627            else
628                echo "👀 Release $TAG sitting freshly baked in the oven and waiting to be published: $RELEASE_URL"
629            fi
630        fi
631        "#,
632    };
633
634    let mut all_deps: Vec<&NamedJob> = vec![
635        create_draft_release_job,
636        upload_assets_job,
637        validate_assets_job,
638        compliance_job,
639        auto_release_preview,
640    ];
641    all_deps.extend(test_jobs.iter().copied());
642    all_deps.extend(bundle_jobs.jobs());
643
644    let mut job = dependant_job(&all_deps)
645        .runs_on(runners::LINUX_SMALL)
646        .cond(Expression::new("always()"));
647
648    for step in notify_slack(MessageType::Evaluated {
649        script: notification_script,
650        env: env_entries.collect(),
651    }) {
652        job = job.add_step(step);
653    }
654    named::job(job)
655}
656
657pub(crate) fn notify_on_failure(deps: &[&NamedJob]) -> NamedJob {
658    let failure_message = format!("❌ ${{{{ github.workflow }}}} failed: {CURRENT_ACTION_RUN_URL}");
659
660    let mut job = dependant_job(deps)
661        .runs_on(runners::LINUX_SMALL)
662        .cond(Expression::new("failure()"));
663
664    for step in notify_slack(MessageType::Static(failure_message)) {
665        job = job.add_step(step);
666    }
667    named::job(job)
668}
669
670pub(crate) enum MessageType {
671    Static(String),
672    Evaluated {
673        script: String,
674        env: Vec<(String, String)>,
675    },
676}
677
678enum MessageSource {
679    String(String),
680    StepOutput(StepOutput),
681}
682
683impl MessageSource {
684    fn message(self) -> String {
685        match self {
686            MessageSource::String(string) => string,
687            MessageSource::StepOutput(output) => output.to_string(),
688        }
689    }
690}
691
692fn notify_slack(message: MessageType) -> Vec<Step<Run>> {
693    match message {
694        MessageType::Static(message) => vec![send_slack_message(MessageSource::String(message))],
695        MessageType::Evaluated { script, env } => {
696            let (generate_step, generated_message) = generate_slack_message(script, env);
697
698            vec![
699                generate_step,
700                send_slack_message(MessageSource::StepOutput(generated_message)),
701            ]
702        }
703    }
704}
705
706fn generate_slack_message(
707    expression: String,
708    env: Vec<(String, String)>,
709) -> (Step<Run>, StepOutput) {
710    let script = formatdoc! {r#"
711        MESSAGE=$({expression})
712        echo "message=$MESSAGE" >> "$GITHUB_OUTPUT"
713        "#
714    };
715    let mut generate_step = named::bash(&script)
716        .id("generate-webhook-message")
717        .add_env(("GH_TOKEN", Context::github().token()));
718
719    for (name, value) in env {
720        generate_step = generate_step.add_env((name, value));
721    }
722
723    let output = StepOutput::new(&generate_step, "message");
724
725    (generate_step, output)
726}
727
728fn send_slack_message(message_source: MessageSource) -> Step<Run> {
729    named::bash(
730        r#"curl -X POST -H 'Content-type: application/json' --data "$(jq -n --arg text "$SLACK_MESSAGE" '{"text": $text}')" "$SLACK_WEBHOOK""#
731    )
732    .map(|this| match &message_source {
733        MessageSource::String(_) => this,
734        MessageSource::StepOutput(output) => this
735            .if_condition(Expression::new(format!("{message} != ''", message = output.expr()))),
736    })
737    .add_env(("SLACK_WEBHOOK", vars::SLACK_WEBHOOK_WORKFLOW_FAILURES))
738    .add_env(("SLACK_MESSAGE", message_source.message()))
739}
740