release-server.yml

name: Release Server

on:
  push:
    tags:
      - 'server-v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Server version to release (e.g., 1.0.0)'
        required: true
        default: '1.0.0'

jobs:
  release-server:
    name: Release AnchorPQ Server
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - name: Set up JDK 17
        uses: actions/setup-java@v5
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: 'maven'

      - name: Get version
        id: get_version
        run: |
          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
            echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
          else
            VERSION=${GITHUB_REF#refs/tags/server-v}
            echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          fi
          echo "Using version: ${{ steps.get_version.outputs.VERSION }}"

      - name: Build and test
        working-directory: anchorpq-server
        run: mvn -B -T 1C verify

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata for Docker
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: |
            ghcr.io/${{ github.repository_owner }}/anchorpq-server
          tags: |
            type=raw,value=${{ steps.get_version.outputs.VERSION }}
            type=raw,value=latest

      - name: Build and push Docker image
        uses: docker/build-push-action@v7
        with:
          context: ./anchorpq-server
          file: ./anchorpq-server/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha
          platforms: linux/amd64,linux/arm64

      - name: Create release artifacts
        working-directory: anchorpq-server
        run: |
          mkdir -p release
          cp -r target/quarkus-app release/ || true
          cp Dockerfile release/
          cp README.md release/
          cp ../docker-compose.yml release/
          cd release && zip -r ../anchorpq-server-${{ steps.get_version.outputs.VERSION }}.zip .

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: server-v${{ steps.get_version.outputs.VERSION }}
          name: AnchorPQ Server v${{ steps.get_version.outputs.VERSION }}
          body: |
            ## AnchorPQ Verification Server v${{ steps.get_version.outputs.VERSION }}
            
            Post-Quantum Secure Mobile Application Integrity Verification Server using ML-KEM (CRYSTALS-Kyber).
            
            ### 🐳 Docker Images
            
            ```bash
            # Pull from GitHub Container Registry
            docker pull ghcr.io/${{ github.repository_owner }}/anchorpq-server:${{ steps.get_version.outputs.VERSION }}
            
            # Or use latest
            docker pull ghcr.io/${{ github.repository_owner }}/anchorpq-server:latest
            ```
            
            ### 🚀 Quick Start
            
            ```bash
            # Using Docker Compose
            docker-compose up -d
            
            # Or run standalone
            docker run -p 8080:8080 \
              -e DB_HOST=your-postgres-host \
              -e DB_USERNAME=anchorpq \
              -e DB_PASSWORD=your-secret \
              ghcr.io/${{ github.repository_owner }}/anchorpq-server:${{ steps.get_version.outputs.VERSION }}
            ```
            
            ### 📡 API Endpoints
            
            | Endpoint | Method | Description |
            |----------|--------|-------------|
            | `/public-key` | GET | Get ML-KEM public key |
            | `/verify` | POST | Verify application integrity |
            | `/admin/records` | GET/POST | Manage integrity records |
            | `/health` | GET | Health check |
            | `/swagger-ui` | GET | API documentation |
            
            ### 🔐 Security Features
            
            - ML-KEM (CRYSTALS-Kyber) post-quantum key encapsulation
            - HKDF-SHA3-256 key derivation
            - AES-256-GCM authenticated encryption
            - Constant-time Merkle root comparison
            
            ### 📦 Downloads
            
            - **Docker Image**: `ghcr.io/${{ github.repository_owner }}/anchorpq-server:${{ steps.get_version.outputs.VERSION }}`
            - **Release Archive**: See attached `anchorpq-server-${{ steps.get_version.outputs.VERSION }}.zip`
            
            See [Server README](https://github.com/${{ github.repository }}/tree/main/anchorpq-server#readme) for full documentation.
          files: |
            anchorpq-server/anchorpq-server-${{ steps.get_version.outputs.VERSION }}.zip
          draft: false
          prerelease: false
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}