release.yml

on:
  workflow_dispatch:
  schedule:
  - cron: 0 6 * * *
  push:
    branches:
    - main
    paths:
    - configure
    - m4/version.m4
    - .github/build/windows/download-configure.sh
    - .github/build/windows/download-dependencies.sh
    - .github/workflows/release.yml
  pull_request:
    branches:
    - main
    paths:
    - .github/workflows/release.yml

permissions:
  contents: read

name: Release
jobs:
  version:
    name: Set version
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.version.outputs.version }}
      publish: ${{ steps.version.outputs.publish }}

    steps:
      - name: Clone ImageMagick
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set version
        id: version
        run: |
          version=$(grep -oP "PACKAGE_VERSION='\K[0-9\.-]*" configure)
          echo "version=$version" >> $GITHUB_OUTPUT
          echo "version=$version"
          tag=$(git describe --tags HEAD --exact-match || true)
          if [[ "$tag" == "$version" ]]; then
            echo "publish=true" >> $GITHUB_OUTPUT
            echo "publish=true"
          fi

  changelog:
    name: Create ChangeLog.md
    runs-on: ubuntu-24.04
    needs:
      - version

    steps:
      - name: Clone ImageMagick
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install dependencies
        run: npm install -g auto-changelog

      - name: Create ChangeLog.md
        env:
          VERSION: ${{needs.version.outputs.version}}
        run: |
          if ! git tag -l | grep -q "^$VERSION$"; then
            git tag $VERSION
          fi
          auto-changelog --sort-commits date
          mkdir -p Artifacts
          mv ChangeLog.md Artifacts/ChangeLog.md

      - name: Upload ChangeLog.md
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
        with:
          name: ChangeLog
          path: Artifacts

  windows_installer:
    name: Windows ${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.architecture}} (${{matrix.buildType}})
    runs-on: windows-2025-vs2026
    needs:
      - changelog
      - version

    permissions:
      contents: read
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        architecture: [ x64, x86 ]
        buildType: [ dynamic, static ]
        quantum: [ Q16, Q8 ]
        hdri: [ hdri, noHdri ]
        exclude:
          - quantum: Q8
            hdri: hdri
        include:
          - architecture: x64
            bit: 64
          - architecture: x86
            bit: 32
          - buildType: dynamic
            typeName: dll
          - buildType: static
            typeName: static
          - hdri: hdri
            hdri_flag: -HDRI

    steps:
      - name: Install Strawberry Perl
        if: ${{matrix.buildType == 'dynamic'}}
        shell: cmd
        run: |
          powershell Invoke-WebRequest -Uri https://github.com/ImageMagick/Windows/releases/download/build-binaries-2025-08-30/strawberry-perl-5.30.2.1-${{matrix.bit}}bit.msi -OutFile strawberry-perl-5.30.2.1-${{matrix.bit}}bit.msi
          msiexec /i strawberry-perl-5.30.2.1-${{matrix.bit}}bit.msi /qn INSTALLDIR="C:\Strawberry${{matrix.bit}}"
          mv "C:\Strawberry" "C:\Strawberry64"

      - name: Install Inno Setup
        shell: cmd
        run: |
          powershell Invoke-WebRequest -Uri https://github.com/ImageMagick/Windows/releases/download/build-binaries-2025-08-30/innosetup-6.2.0.exe -OutFile innosetup-6.2.0.exe
          innosetup-6.2.0.exe /SILENT /SUPPRESSMSGBOXES /NORESTART /SP-

      - name: Clone ImageMagick
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          path: ImageMagick
          persist-credentials: false

      - name: Download configure
        shell: cmd
        run: |
          ImageMagick\.github\build\windows\download-configure.cmd

      - name: Download dependencies
        shell: cmd
        run: |
          ImageMagick\.github\build\windows\download-dependencies.cmd windows-${{matrix.architecture}}-${{matrix.buildType}}-openMP.zip

      - name: Download ChangeLog.md
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: ChangeLog
          path: ImageMagick

      - name: Configure ImageMagick
        shell: cmd
        working-directory: Configure
        run: |
          Configure.Release.x64.exe /noWizard /VS2026 /installedSupport /deprecated /${{matrix.hdri}} /${{matrix.quantum}} /${{matrix.architecture}} /${{matrix.buildType}}

      - name: Build ImageMagick
        shell: cmd
        run: |
          call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\Common7\Tools\VsDevCmd.bat"
          msbuild /m /t:Rebuild /p:Configuration=Release,Platform=${{matrix.architecture}}

      - name: Build PerlMagick
        if: ${{matrix.buildType == 'dynamic'}}
        shell: cmd
        run: |
          set PATH=
          call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\Common7\Tools\VsDevCmd.bat"
          cd ImageMagick\PerlMagick
          set PATH=%PATH%;C:\Strawberry${{matrix.bit}}\c\bin;C:\Strawberry${{matrix.bit}}\perl\site\bin;C:\Strawberry${{matrix.bit}}\perl\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0
          perl "Makefile.PL" "MAKE=nmake"
          nmake
          nmake release

      - name: Sign executables and libraries
        uses: ImageMagick/code-signing-action@11c51f7659405bee4dd3529748e1501a0d388911 #v1.0.1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          directory: ${{ github.workspace }}\Artifacts\bin
          files: '*.exe *.dll'

      - name: Create installer
        shell: cmd
        run: |
          call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\Common7\Tools\VsDevCmd.bat"
          "C:\Program Files (x86)\Inno Setup 6\iscc.exe" Configure\Installer\Inno\ImageMagick.iss

      - name: Sign installer
        uses: ImageMagick/code-signing-action@11c51f7659405bee4dd3529748e1501a0d388911 #v1.0.1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          directory: ${{ github.workspace }}\Configure\Installer\Inno\Artifacts
          files: '*.exe'

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
        with:
          name: ImageMagick-${{needs.version.outputs.version}}-${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.typeName}}-${{matrix.architecture}}.exe
          path: Configure\Installer\Inno\Artifacts

  windows_source:
    name: Windows source
    if: github.event_name != 'pull_request'
    runs-on: windows-2025
    needs:
      - changelog
      - version

    steps:
      - name: Clone ImageMagick/Windows
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          repository: ImageMagick/Windows
          ref: refs/heads/main
          persist-credentials: false

      - name: Clone repositories
        shell: cmd
        run: |
          clone-repositories-im6.cmd ${{github.sha}}

      - name: Download ChangeLog.md
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: ChangeLog
          path: ImageMagick

      - name: Create source archive
        shell: cmd
        env:
          VERSION: ${{needs.version.outputs.version}}
        run: |
          mkdir source
          move Configure source
          move Dependencies source
          move ImageMagick source
          7z a -mx=9 ImageMagick-%VERSION%-Windows.7z .\source\*

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
        with:
          name: ImageMagick-${{needs.version.outputs.version}}-Windows.7z
          path: ImageMagick-${{needs.version.outputs.version}}-Windows.7z

  windows_portable:
    name: Windows portable ${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.architecture}}
    runs-on: windows-2025-vs2026
    needs:
      - changelog
      - version

    permissions:
      contents: read
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        architecture: [ x64, x86 ]
        quantum: [ Q16, Q8 ]
        hdri: [ hdri, noHdri ]
        exclude:
          - quantum: Q8
            hdri: hdri
        include:
          - hdri: hdri
            hdri_flag: -HDRI

    steps:
      - name: Clone ImageMagick
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          path: ImageMagick
          persist-credentials: false

      - name: Download configure
        shell: cmd
        run: |
          ImageMagick\.github\build\windows\download-configure.cmd

      - name: Download dependencies
        shell: cmd
        run: |
          ImageMagick\.github\build\windows\download-dependencies.cmd windows-${{matrix.architecture}}-static-openMP-linked-runtime.zip

      - name: Download ChangeLog.md
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: ChangeLog
          path: ImageMagick

      - name: Configure ImageMagick
        shell: cmd
        working-directory: Configure
        run: |
          Configure.Release.x64.exe /noWizard /VS2026 /${{matrix.hdri}} /${{matrix.quantum}} /${{matrix.architecture}} /static /linkRuntime

      - name: Build ImageMagick
        shell: cmd
        run: |
          call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\Common7\Tools\VsDevCmd.bat"
          msbuild /m /t:Rebuild /p:Configuration=Release,Platform=${{matrix.architecture}}

      - name: Sign executables and libraries
        uses: ImageMagick/code-signing-action@11c51f7659405bee4dd3529748e1501a0d388911 #v1.0.1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          directory: ${{ github.workspace }}\Artifacts\bin
          files: '*.exe *.dll'

      - name: Copy Files
        shell: pwsh
        env:
          VERSION: ${{needs.version.outputs.version}}
        run: |
          [void](New-Item -Name "portable" -ItemType directory)
          Copy-Item "Artifacts\bin\*.exe" "portable"
          Copy-Item "Artifacts\bin\*.xml" "portable"
          Copy-Item "Artifacts\bin\sRGB.icc" "portable"

          Copy-Item "Artifacts\NOTICE.txt" "portable"
          Copy-Item "ImageMagick\ChangeLog.md" "portable"
          Copy-Item "ImageMagick\LICENSE" "portable\LICENSE.txt"
          7z a -mx=9 "ImageMagick-$env:VERSION-portable-${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.architecture}}.7z" .\portable\*

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
        with:
          name: ImageMagick-${{needs.version.outputs.version}}-portable-${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.architecture}}.7z
          path: ImageMagick-${{needs.version.outputs.version}}-portable-${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.architecture}}.7z

  source:
    name: Create source archive
    runs-on: ubuntu-24.04
    needs:
      - changelog
      - version

    steps:
      - name: Clone ImageMagick
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          path: ImageMagick
          persist-credentials: false

      - name: Download ChangeLog.md
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: ChangeLog
          path: ImageMagick

      - name: Create source archive
        env:
          VERSION: ${{needs.version.outputs.version}}
        run: |
          set -e
          DIRECTORIES=(
            ".devcontainer"
            ".git"
            ".github"
          )
          FILES=(
            ".auto-changelog"
            ".editorconfig"
            ".gitignore"
          )
          for dir_name in "${DIRECTORIES[@]}"; do
            path="ImageMagick/$dir_name"
            if [[ -e "$path" ]]; then
              rm -rf -- "$path"
              echo "Removed: $dir_name"
            else
              echo "Not found: $dir_name"
              exit 1
            fi
          done
          for file_name in "${FILES[@]}"; do
            path="ImageMagick/$file_name"
            if [[ -e "$path" ]]; then
              rm -f -- "$path"
              echo "Removed: $file_name"
            else
              echo "Not found: $file_name"
              exit 1
            fi
          done
          mv ImageMagick "ImageMagick-$VERSION"
          mkdir artifacts
          7z a -mx=9 "artifacts/ImageMagick-$VERSION.7z" "ImageMagick-$VERSION"
          XZ_OPT="-9e" tar -cJf "artifacts/ImageMagick-$VERSION.tar.xz" "ImageMagick-$VERSION"

      - name: Upload source archive
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
        with:
          name: ImageMagick-${{needs.version.outputs.version}}.7z
          path: artifacts

  release:
    name: Publish Release
    if: ${{ needs.version.outputs.publish == 'true' }}
    runs-on: ubuntu-24.04
    needs:
      - version
      - source
      - windows_installer
      - windows_portable
      - windows_source

    permissions:
      contents: write
      id-token: write
      attestations: write

    steps:
      - name: Clone ImageMagick
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

      - name: Download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          path: artifacts
          merge-multiple: true

      - name: Generate SLSA provenance
        id: attest
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 #v4.2.2
        with:
          subject-path: |
            ${{github.workspace}}/artifacts/*.7z
            ${{github.workspace}}/artifacts/*.exe
            ${{github.workspace}}/artifacts/*.xz

      - name: Save provenance as an artifact
        env:
          BUNDLE_PATH: ${{steps.attest.outputs.bundle-path}}
          VERSION: ${{needs.version.outputs.version}}
        run: |
          cp "$BUNDLE_PATH" "${{github.workspace}}/artifacts/ImageMagick-$VERSION.intoto.jsonl"

      - name: Publish release
        env:
          GH_TOKEN: ${{github.token}}
          VERSION: ${{needs.version.outputs.version}}
        run: |
          gh release create "$VERSION" \
            --title "$VERSION" \
            --notes "$VERSION" \
            ${{github.workspace}}/artifacts/*.7z \
            ${{github.workspace}}/artifacts/*.exe \
            ${{github.workspace}}/artifacts/*.intoto.jsonl \
            ${{github.workspace}}/artifacts/*.xz

  update_website:
    name: Update website
    runs-on: ubuntu-24.04
    needs:
      - version
      - release

    steps:
      - name: Create GitHub app token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 #v3.2.0
        id: app-token
        with:
          client-id: ${{vars.APP_CLIENT_ID}}
          private-key: ${{secrets.APP_PRIVATE_KEY}}
          repositories: Website6
          permission-contents: write

      - name: Clone Website6
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          repository: ImageMagick/Website6
          token: ${{steps.app-token.outputs.token}}

      - name: Download ChangeLog.md
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: ChangeLog

      - name: Move ChangeLog.md
        run: |
          mv ChangeLog.md docs/changelog/index.md

      - name: Configure git
        run: |
          git config --global user.name '${{steps.app-token.outputs.app-slug}}[bot]'
          git config --global user.email '${{vars.APP_USER_ID}}+${{steps.app-token.outputs.app-slug}}[bot]@users.noreply.github.com'

      - name: Update website version
        env:
          VERSION: ${{needs.version.outputs.version}}
        run: |
          ./update-version.sh "$VERSION" "$(date -u +"%Y-%m-%d")"

      - name: Commit and push changes
        env:
          VERSION: ${{needs.version.outputs.version}}
        run: |
          git add -A
          git commit -m "Update version to $VERSION"
          git push