cli-release.yml

name: CLI Release

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: Dify release tag to attach difyctl assets to (blank = latest stable)
        required: false
        type: string
      dry_run:
        description: Build and checksum only — skip asset upload and stale-asset prune
        required: false
        type: boolean
        default: false
  workflow_call:
    inputs:
      release_tag:
        description: Dify release tag to attach difyctl assets to (blank = latest stable)
        required: false
        type: string
      dry_run:
        description: Build and checksum only — skip asset upload and stale-asset prune
        required: false
        type: boolean
        default: false
  release:
    types: [released]

concurrency:
  group: difyctl-release
  cancel-in-progress: false

jobs:
  validate:
    name: validate manifest + resolve target Dify release
    runs-on: depot-ubuntu-24.04
    if: github.repository == 'langgenius/dify'
    permissions:
      contents: read
    defaults:
      run:
        shell: bash
        working-directory: ./cli
    outputs:
      dify_tag: ${{ steps.resolve.outputs.dify_tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Validate manifest
        run: node scripts/release-naming.mjs validate

      - name: Resolve target Dify release
        id: resolve
        env:
          GH_TOKEN: ${{ github.token }}
          EVENT_TAG: ${{ github.event.release.tag_name }}
          INPUT_TAG: ${{ inputs.release_tag }}
        run: |
          if [ -n "$EVENT_TAG" ]; then
              tag="$EVENT_TAG"
          elif [ -n "$INPUT_TAG" ]; then
              tag="$INPUT_TAG"
          else
              tag="$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq .tag_name)"
          fi
          if [ -z "$tag" ]; then
              echo "::error::could not resolve a target Dify release tag"
              exit 1
          fi
          if ! gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
              echo "::error::target Dify release ${tag} not found"
              exit 1
          fi
          echo "dify_tag=${tag}" >> "$GITHUB_OUTPUT"
          echo "::notice::target Dify release ${tag}"

  release:
    name: build + attach standalone binaries (all targets)
    needs: validate
    runs-on: depot-ubuntu-24.04
    permissions:
      contents: write
    defaults:
      run:
        shell: bash
        working-directory: ./cli
    env:
      DIFY_TAG: ${{ needs.validate.outputs.dify_tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 1

      - name: Enable cross-arch native prebuilds
        working-directory: ./
        run: cat cli/scripts/cross-arch.pnpm.yaml >> pnpm-workspace.yaml

      - name: Setup web environment
        uses: ./.github/actions/setup-web

      - name: Export manifest to env
        run: node scripts/release-naming.mjs github-env >> "$GITHUB_ENV"

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version-file: cli/.bun-version

      - name: Compile standalone binaries (all targets)
        run: |
          CLI_VERSION="$version" \
          DIFYCTL_COMMIT="$(git rev-parse HEAD)" \
          DIFYCTL_BUILD_DATE="$(git log -1 --format=%cI HEAD)" \
            pnpm build:bin

      - name: Generate sha256 checksum file
        run: scripts/release-write-checksums.sh

      - name: Smoke the runner-arch binary
        run: scripts/release-smoke.sh "./dist/bin/$(node scripts/release-naming.mjs asset "$version" linux-x64)"

      - name: Attach difyctl assets to Dify release
        if: ${{ !inputs.dry_run }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release upload "$DIFY_TAG" dist/bin/${tagPrefix}* \
              --repo "$GITHUB_REPOSITORY" --clobber

      - name: Prune stale difyctl assets
        if: ${{ !inputs.dry_run }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          new_set="$(cd dist/bin && ls ${tagPrefix}*)"
          gh release view "$DIFY_TAG" --repo "$GITHUB_REPOSITORY" \
              --json assets --jq '.assets[].name' \
            | { grep -E "^${tagPrefix}" || true; } \
            | while IFS= read -r name; do
                if ! printf '%s\n' "$new_set" | grep -qxF -- "$name"; then
                    echo "::notice::pruning stale asset ${name}"
                    gh release delete-asset "$DIFY_TAG" "$name" \
                        --repo "$GITHUB_REPOSITORY" --yes
                fi
              done