ci(release): parallelize release build (#2170)

Signed-off-by: Dave Henderson <dhenderson@gmail.com>

4 files changed, 225 insertions, 101 deletions

diff --git a/.github/workflows/docker-main.yml b/.github/workflows/docker-main.yml
new file mode 100644
index 00000000..de269ed0
--- /dev/null
+++ b/.github/workflows/docker-main.yml
@@ -0,0 +1,43 @@
+name: Docker Main Build
+on:
+  push:
+    branches: [ main ]
+
+jobs:
+  docker-main-build:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3.1.0
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v3.4.0
+      with:
+        version: v0.14.1
+        driver-opts: |
+          image=moby/buildkit:buildx-stable-1
+          network=host
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Login to GHCR
+      uses: docker/login-action@v3.2.0
+      with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Login to DockerHub
+      uses: docker/login-action@v3.2.0
+      with:
+          # NOTE: DOCKERHUB_TOKEN and DOCKERHUB_USERNAME must be present in https://github.com/hairyhenderson/gomplate/settings
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+    - name: Build & Push (latest tag)
+      run: |
+        export srcrepo=${{ github.repository}}
+        make docker-multi COMMIT=${{ github.sha }} DOCKER_REPO=${srcrepo} BUILDX_ACTION=--push
+
+        docker buildx imagetools create -t gomplate/gomplate:latest ${srcrepo}:latest
+        docker buildx imagetools create -t gomplate/gomplate:alpine ${srcrepo}:alpine
+        docker buildx imagetools create -t ghcr.io/${srcrepo}:latest ${srcrepo}:latest
+        docker buildx imagetools create -t ghcr.io/${srcrepo}:alpine ${srcrepo}:alpine
diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
new file mode 100644
index 00000000..2223384b
--- /dev/null
+++ b/.github/workflows/docker-release.yml
@@ -0,0 +1,74 @@
+name: Docker Release Build
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  docker-release-build:
+    runs-on: ubuntu-latest
+    env:
+      TAG_NAME: ${{ github.event.release.tag_name }}
+    steps:
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3.1.0
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v3.4.0
+      with:
+        version: v0.14.1
+        driver-opts: |
+          image=moby/buildkit:buildx-stable-1
+          network=host
+    - name: Available platforms
+      run: echo {{ `${{ steps.buildx.outputs.platforms }}` }}
+    - run: docker info && docker version
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Login to GHCR
+      uses: docker/login-action@v3.2.0
+      with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Login to DockerHub
+      uses: docker/login-action@v3.2.0
+      with:
+          # NOTE: DOCKERHUB_TOKEN and DOCKERHUB_USERNAME must be present in https://github.com/hairyhenderson/gomplate/settings
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+    - name: Build & Push
+      run: |
+        export srcrepo=${{ github.repository}}
+
+        make docker-multi COMMIT=${{ github.sha }} DOCKER_REPO=${srcrepo} BUILDX_ACTION=--push
+
+        set -x
+        export repo=${srcrepo}
+        docker buildx imagetools create -t ${repo}:stable ${srcrepo}:latest
+        docker buildx imagetools create -t ${repo}:${git_tag} ${srcrepo}:latest
+        docker buildx imagetools create -t ${repo}:${major_version} ${srcrepo}:latest
+
+        docker buildx imagetools create -t ${repo}:stable-alpine ${srcrepo}:alpine
+        docker buildx imagetools create -t ${repo}:${git_tag}-alpine ${srcrepo}:alpine
+        docker buildx imagetools create -t ${repo}:${major_version}-alpine ${srcrepo}:alpine
+
+        export repo=gomplate/gomplate
+        docker buildx imagetools create -t ${repo}:stable ${srcrepo}:latest
+        docker buildx imagetools create -t ${repo}:${git_tag} ${srcrepo}:latest
+        docker buildx imagetools create -t ${repo}:${major_version} ${srcrepo}:latest
+
+        docker buildx imagetools create -t ${repo}:stable-alpine ${srcrepo}:alpine
+        docker buildx imagetools create -t ${repo}:${git_tag}-alpine ${srcrepo}:alpine
+        docker buildx imagetools create -t ${repo}:${major_version}-alpine ${srcrepo}:alpine
+
+        # and now GHCR
+        export repo=ghcr.io/${srcrepo}
+        docker buildx imagetools create -t ${repo}:stable ${srcrepo}:latest
+        docker buildx imagetools create -t ${repo}:${git_tag} ${srcrepo}:latest
+        docker buildx imagetools create -t ${repo}:${major_version} ${srcrepo}:latest
+
+        docker buildx imagetools create -t ${repo}:stable-alpine ${srcrepo}:alpine
+        docker buildx imagetools create -t ${repo}:${git_tag}-alpine ${srcrepo}:alpine
+        docker buildx imagetools create -t ${repo}:${major_version}-alpine ${srcrepo}:alpine
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 79d14130..f70dfe9c 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -1,8 +1,5 @@
 name: Docker Build
 on:
-  push:
-    branches: [ main ]
-    tags: [ 'v*', '!v*-pre*']
   pull_request:
     branches: [ main ]
   workflow_dispatch:
@@ -15,21 +12,14 @@ jobs:
         image: registry:2
         ports:
           - '5000:5000'
-    env:
-      DOCKER_BUILDKIT: 1
-      DOCKER_CLI_EXPERIMENTAL: enabled
     steps:
-    - name: enable experimental mode
-      run: |
-        mkdir -p ~/.docker
-        echo '{"experimental": "enabled"}' > ~/.docker/config.json
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v3.1.0
     - name: Set up Docker Buildx
       id: buildx
       uses: docker/setup-buildx-action@v3.4.0
       with:
-        version: v0.11.2
+        version: v0.14.1
         driver-opts: |
           image=moby/buildkit:buildx-stable-1
           network=host
@@ -39,75 +29,10 @@ jobs:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
-    - name: determine if this is a tag
-      run: |
-        if (git describe --abbrev=0 --exact-match &>/dev/null); then
-          tag=$(git describe --abbrev=0 --exact-match)
-          echo "is_tag=true" >> $GITHUB_ENV
-          echo "git_tag=$tag" >> $GITHUB_ENV
-          # splits the major version from $tag - assumes it's a 3-part semver
-          echo "major_version=${tag%%\.*}" >> $GITHUB_ENV
-        fi
-        echo $GITHUB_ENV
-      if: github.repository == 'hairyhenderson/gomplate'
-    - name: Build & Push (non-main)
+    - name: Build & Push (local CI registry)
       run: |
         set -ex
         make docker-multi COMMIT=${{ github.sha }} DOCKER_REPO=localhost:5000/gomplate BUILDX_ACTION=--push
 
         docker buildx imagetools create --dry-run -t localhost:5000/gomplate:dev localhost:5000/gomplate:latest
         docker buildx imagetools create --dry-run -t localhost:5000/gomplate:dev-alpine localhost:5000/gomplate:alpine
-      if: github.repository != 'hairyhenderson/gomplate' || (github.ref != 'refs/heads/main' && env.is_tag != 'true')
-    - name: Login to GHCR
-      uses: docker/login-action@v3.2.0
-      with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      if: github.repository == 'hairyhenderson/gomplate' && (github.ref == 'refs/heads/main' || env.is_tag == 'true')
-    - name: Login to DockerHub
-      uses: docker/login-action@v3.2.0
-      with:
-          # NOTE: DOCKERHUB_TOKEN and DOCKERHUB_USERNAME must be present in https://github.com/hairyhenderson/gomplate/settings
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      if: github.repository == 'hairyhenderson/gomplate' && (github.ref == 'refs/heads/main' || env.is_tag == 'true')
-    - name: Build & Push (main)
-      run: |
-        make docker-multi COMMIT=${{ github.sha }} DOCKER_REPO=hairyhenderson/gomplate BUILDX_ACTION=--push
-        make docker-multi COMMIT=${{ github.sha }} DOCKER_REPO=ghcr.io/hairyhenderson/gomplate BUILDX_ACTION=--push
-      if: github.repository == 'hairyhenderson/gomplate' && github.ref == 'refs/heads/main'
-    - name: Build & Push (tagged release)
-      run: |
-        export srcrepo=hairyhenderson/gomplate
-        make docker-multi COMMIT=${{ github.sha }} DOCKER_REPO=hairyhenderson/gomplate BUILDX_ACTION=--push
-
-        set -x
-        export repo=hairyhenderson/gomplate
-        docker buildx imagetools create -t ${repo}:stable ${srcrepo}:latest
-        docker buildx imagetools create -t ${repo}:${git_tag} ${srcrepo}:latest
-        docker buildx imagetools create -t ${repo}:${major_version} ${srcrepo}:latest
-
-        docker buildx imagetools create -t ${repo}:stable-alpine ${srcrepo}:alpine
-        docker buildx imagetools create -t ${repo}:${git_tag}-alpine ${srcrepo}:alpine
-        docker buildx imagetools create -t ${repo}:${major_version}-alpine ${srcrepo}:alpine
-
-        export repo=gomplate/gomplate
-        docker buildx imagetools create -t ${repo}:stable ${srcrepo}:latest
-        docker buildx imagetools create -t ${repo}:${git_tag} ${srcrepo}:latest
-        docker buildx imagetools create -t ${repo}:${major_version} ${srcrepo}:latest
-
-        docker buildx imagetools create -t ${repo}:stable-alpine ${srcrepo}:alpine
-        docker buildx imagetools create -t ${repo}:${git_tag}-alpine ${srcrepo}:alpine
-        docker buildx imagetools create -t ${repo}:${major_version}-alpine ${srcrepo}:alpine
-
-        # and now GHCR
-        export repo=ghcr.io/hairyhenderson/gomplate
-        docker buildx imagetools create -t ${repo}:stable ${srcrepo}:latest
-        docker buildx imagetools create -t ${repo}:${git_tag} ${srcrepo}:latest
-        docker buildx imagetools create -t ${repo}:${major_version} ${srcrepo}:latest
-
-        docker buildx imagetools create -t ${repo}:stable-alpine ${srcrepo}:alpine
-        docker buildx imagetools create -t ${repo}:${git_tag}-alpine ${srcrepo}:alpine
-        docker buildx imagetools create -t ${repo}:${major_version}-alpine ${srcrepo}:alpine
-      if: github.repository == 'hairyhenderson/gomplate' && env.is_tag == 'true'
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 13c10118..43f9f614 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -12,6 +12,7 @@ permissions:
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    if: false
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
@@ -91,13 +92,42 @@ jobs:
           echo "prs_created=true"                      >> "$GITHUB_OUTPUT"
           node -e "console.log('pr=' +JSON.stringify($(cat rp-out.js)[0]))" >> "$GITHUB_OUTPUT"
           node -e "console.log('prs='+JSON.stringify($(cat rp-out.js)   ))" >> "$GITHUB_OUTPUT"
-  create-release:
+  build-artifacts:
     runs-on: ubuntu-latest
     needs: release-please
-    if: ${{ needs.release-please.outputs.release_created }}
+    if: needs.release-please.outputs.release_created
+    outputs:
+      tag_name: ${{ needs.release-please.outputs.tag_name }}
+      version: ${{ needs.release-please.outputs.version }}
     env:
       VERSION: ${{ needs.release-please.outputs.version }}
-      TAG_NAME: ${{ needs.release-please.outputs.tag_name }}
+    strategy:
+      matrix:
+        goos: [linux, darwin]
+        goarch: [amd64, arm64]
+        include:
+          - goos: freebsd
+            goarch: amd64
+          - goos: linux
+            goarch: '386'
+          - goos: linux
+            goarch: arm
+            variant: 'v6'
+          - goos: linux
+            goarch: arm
+            variant: 'v7'
+          - goos: linux
+            goarch: ppc64le
+          - goos: linux
+            goarch: s390x
+          - goos: solaris
+            goarch: amd64
+          - goos: windows
+            goarch: amd64
+            extension: .exe
+          - goos: windows
+            goarch: '386'
+            extension: .exe
     steps:
       - uses: actions/create-github-app-token@v1
         id: app-token
@@ -108,23 +138,53 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
-      - name: Build release assets
+      - name: Build Artifacts for ${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.variant }}
         run: |
           export COMMIT=${{ github.sha }}
-          make bin/checksums_sha256.txt VERSION=${VERSION}
-          make bin/checksums_sha512.txt VERSION=${VERSION}
 
-          # clean up a bit to make the next steps easier
-          rm bin/*_checksum*
+          make bin/gomplate_${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.variant }}${{ matrix.extension }}_checksum_sha256.txt \
+            VERSION=$VERSION
+          make bin/gomplate_${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.variant }}${{ matrix.extension }}_checksum_sha512.txt \
+            VERSION=$VERSION
 
-          mv bin/checksums_sha256.txt bin/checksums-${TAG_NAME}_sha256.txt
-          mv bin/checksums_sha512.txt bin/checksums-${TAG_NAME}_sha512.txt
-
-          # zip file for choco package
-          make bin/gomplate_windows-amd64.zip VERSION=${VERSION}
-      - name: Upload release assets
+          if [ "${{ matrix.goos }}-${{ matrix.goarch }}" = "windows-amd64" ]; then
+            make bin/gomplate_windows-amd64.zip VERSION=$VERSION
+          fi
+      - name: Save Artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.variant }}
+          path: bin/*
+          retention-days: 1
+  create-release:
+    runs-on: ubuntu-latest
+    needs: build-artifacts
+    env:
+      VERSION: ${{ needs.build-artifacts.outputs.version }}
+      TAG_NAME: ${{ needs.build-artifacts.outputs.tag_name }}
+    steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+      - uses: actions/download-artifact@v4
+      - name: Organize Artifacts
+        run: |
+          mv build*/* .
+          rm -rf build*
+      - name: Aggregate Checksums
         run: |
-          cd bin
+          # duplicate the make bin/checksums_sha(256|512).txt targets without
+          # invoking make
+          cat gomplate_*_checksum_sha256.txt > checksums-${TAG_NAME}_sha256.txt
+          cat gomplate_*_checksum_sha512.txt > checksums-${TAG_NAME}_sha512.txt
+
+          # clean up a bit to make the upload simpler
+          rm *_checksum*.txt
+      - name: Upload Release Assets
+        run: |
+          ls -alh
 
           assets="checksums-${TAG_NAME}_sha256.txt checksums-${TAG_NAME}_sha512.txt"
           for f in gomplate_*; do
@@ -132,15 +192,20 @@ jobs:
           done
 
           echo "uploading assets: $assets"
-          gh release upload ${TAG_NAME} $assets --clobber
+          gh release upload ${TAG_NAME} $assets \
+            --clobber --repo ${{ github.repository }}
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
-      - name: Publish GitHub Release
+      - name: Publish Release
         run: |
-          gh release edit ${TAG_NAME} --discussion-category "General" --draft=false
+          gh release edit ${TAG_NAME} \
+            --discussion-category "General" \
+            --repo ${{ github.repository }} \
+            --draft=false
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
-      - name: Get archive checksums
+      - name: Upload archive checksums
+        id: archive-checksums
         # has to happen post-publish so the URL works
         run: |
           archive=https://github.com/${{ github.repository }}/archive/refs/tags/${TAG_NAME}.tar.gz
@@ -149,12 +214,29 @@ jobs:
 
           sha256sum $archiveFile | cut -f1 -d\  > ${TAG_NAME}.sha256
           sha512sum $archiveFile | cut -f1 -d\  > ${TAG_NAME}.sha512
-          
+
           echo "sha256sum=$(cat ${TAG_NAME}.sha256)" >> $GITHUB_OUTPUT
           echo "sha512sum=$(cat ${TAG_NAME}.sha512)" >> $GITHUB_OUTPUT
-      - name: Upload archive checksums
-        run: |
-          gh release upload ${TAG_NAME} ${TAG_NAME}.sha256
-          gh release upload ${TAG_NAME} ${TAG_NAME}.sha512
+
+          gh release upload ${TAG_NAME} ${TAG_NAME}.sha256 ${TAG_NAME}.sha512 \
+            --repo ${{ github.repository }}
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+  deploy-homebrew:
+    runs-on: ubuntu-latest
+    needs: create-release
+    steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+      - name: Set up Homebrew
+        id: set-up-homebrew
+        uses: Homebrew/actions/setup-homebrew@master
+      - name: Bump packages
+        uses: Homebrew/actions/bump-packages@master
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          formulae: gomplate
+          fork: false