deploy-github-pages.yml

name: Manual Release Deploy
run-name: ${{ inputs.version && format('Release v{0}', inputs.version) || 'Release auto-bump' }}

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Exact MAJOR.MINOR version to release. Leave empty to bump minor."
        required: false
        default: ""
        type: string

permissions:
  contents: write
  pages: write
  id-token: write

concurrency:
  group: manual-release-deploy
  cancel-in-progress: false

env:
  GODOT_VERSION: "4.6.3-stable"
  GODOT_TEMPLATE_VERSION: "4.6.3.stable"
  GODOT_BIN: "${{ github.workspace }}/.godot/Godot_v4.6.3-stable_linux.x86_64"

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment:
      name: github-pages
      url: ${{ steps.deploy.outputs.page_url }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Configure Pages
        uses: actions/configure-pages@v6

      - name: Validate release branch
        shell: bash
        run: |
          set -euo pipefail
          if [ "${GITHUB_REF_TYPE}" != "branch" ] || [ "${GITHUB_REF_NAME}" != "main" ]; then
            echo "Manual releases must run from the main branch, got ${GITHUB_REF_TYPE}:${GITHUB_REF_NAME}" >&2
            exit 1
          fi
          git fetch origin "${GITHUB_REF_NAME}" --tags
          remote_head="$(git rev-parse "origin/${GITHUB_REF_NAME}")"
          local_head="$(git rev-parse HEAD)"
          if [ "${remote_head}" != "${local_head}" ]; then
            echo "Release checkout is not current with origin/${GITHUB_REF_NAME}: local=${local_head} remote=${remote_head}" >&2
            exit 1
          fi
          echo "BASE_COMMIT=${local_head}" >> "$GITHUB_ENV"
          echo "RELEASE_BRANCH_OK branch=${GITHUB_REF_NAME}"

      - name: Install Godot
        shell: bash
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install -y unzip libfontconfig1

          mkdir -p .godot
          curl -L "https://github.com/godotengine/godot-builds/releases/download/${GODOT_VERSION}/Godot_v${GODOT_VERSION}_linux.x86_64.zip" -o .godot/godot.zip
          curl -L "https://github.com/godotengine/godot-builds/releases/download/${GODOT_VERSION}/Godot_v${GODOT_VERSION}_export_templates.tpz" -o .godot/templates.zip
          unzip -q .godot/godot.zip -d .godot
          unzip -q .godot/templates.zip -d .godot/templates
          chmod +x "$GODOT_BIN"

          template_dir="$HOME/.local/share/godot/export_templates/${GODOT_TEMPLATE_VERSION}"
          mkdir -p "$template_dir"
          cp -a .godot/templates/templates/. "$template_dir/"

      - name: Install browser smoke dependencies
        shell: bash
        run: |
          set -euo pipefail
          PLAYWRIGHT_ROOT="$RUNNER_TEMP/multi-server-test-playwright"
          mkdir -p "$PLAYWRIGHT_ROOT"
          npm --prefix "$PLAYWRIGHT_ROOT" install --no-save playwright@1.61.0
          "$PLAYWRIGHT_ROOT/node_modules/.bin/playwright" install --with-deps chromium

      - name: Configure Git
        shell: bash
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Set release project version
        id: version
        shell: bash
        env:
          REQUESTED_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          python3 tools/project_version.py --self-test
          if [ -n "${REQUESTED_VERSION}" ]; then
            python3 tools/project_version.py --set "${REQUESTED_VERSION}"
          else
            python3 tools/project_version.py --bump-minor
          fi
          version="$(python3 tools/project_version.py --print | sed -E 's/^PROJECT_VERSION version=//')"
          echo "project_version=${version}" >> "$GITHUB_OUTPUT"
          echo "PROJECT_VERSION version=${version}"

      - name: Create release commit
        shell: bash
        run: |
          set -euo pipefail
          version="${{ steps.version.outputs.project_version }}"
          git add project.godot
          if git diff --cached --quiet; then
            echo "PROJECT_VERSION_NO_CHANGE version=${version}"
          else
            git commit -m "chore: bump project version to v${version}"
          fi
          echo "RELEASE_COMMIT=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
          echo "RELEASE_COMMIT_SHORT=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"

      - name: Validate release tag
        shell: bash
        run: |
          set -euo pipefail
          version="${{ steps.version.outputs.project_version }}"
          tag="v${version}"
          release_commit="$(git rev-parse HEAD)"
          git fetch --tags origin
          if git rev-parse -q --verify "refs/tags/${tag}" >/dev/null; then
            tag_commit="$(git rev-list -n 1 "${tag}")"
            if [ "$tag_commit" != "$release_commit" ]; then
              echo "Release tag ${tag} already points at ${tag_commit}, expected release commit ${release_commit}" >&2
              echo "Use a new version, or rerun the exact version from the tagged commit." >&2
              exit 1
            fi
            echo "RELEASE_TAG_RERUN_OK tag=${tag} commit=$(git rev-parse --short HEAD)"
          else
            echo "RELEASE_TAG_AVAILABLE tag=${tag}"
          fi

      - name: Export release artifacts
        shell: bash
        run: |
          set -euo pipefail
          rm -rf builds
          mkdir -p builds/client builds/server builds/web builds/world_packs builds/web/world_packs

          project_backup="$RUNNER_TEMP/project.godot.release"
          cp project.godot "$project_backup"
          restore_project() {
            if [ -f "$project_backup" ]; then
              mv "$project_backup" project.godot
            fi
          }
          trap restore_project EXIT
          grep -v '^RunInstanceGrid=' "$project_backup" > project.godot

          "$GODOT_BIN" --headless --path . --export-release "Linux Server" builds/server/server.x86_64
          chmod +x builds/server/server.x86_64

          "$GODOT_BIN" --headless --path . --export-release "Windows Client" builds/client/client.exe

          "$GODOT_BIN" --headless --path . --export-release "Web Client" builds/web/index.html
          python3 tools/patch_web_cache_bust.py --web-root builds/web --version "${{ steps.version.outputs.project_version }}"

          while IFS= read -r world_dir; do
            world_key="$(basename "$world_dir")"
            test -f "$world_dir/${world_key}.tscn"
            "$GODOT_BIN" --headless --path . --export-pack "World Pack - ${world_key}" "builds/world_packs/${world_key}.pck"
            cp -p "builds/world_packs/${world_key}.pck" "builds/web/world_packs/${world_key}.pck"
            echo "WORLD_PACK_EXPORTED key=${world_key}"
          done < <(find server/worlds -mindepth 1 -maxdepth 1 -type d | sort)

          python3 tools/write_deployment_manifest.py --web-root builds/web --version "${{ steps.version.outputs.project_version }}"

          restore_project
          trap - EXIT
          echo "EXPORT_ALL_DONE"

      - name: Verify exports
        shell: bash
        run: |
          set -euo pipefail
          python3 tools/verify_export_artifacts.py --server-binary server/server.x86_64

      - name: Run net config smoke
        shell: bash
        run: |
          set -euo pipefail
          "$GODOT_BIN" --headless --path "$PWD" --script res://tools/net_config_smoke.gd

      - name: Run client UI smoke
        shell: bash
        run: |
          set -euo pipefail
          "$GODOT_BIN" --headless --path "$PWD" --script res://tools/client_ui_smoke.gd

      - name: Run Web smoke
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p .logs/web_smoke

          dump_logs() {
            echo "::group::web smoke logs"
            for log in .logs/web_smoke/*.log; do
              if [ -f "$log" ]; then
                echo "--- ${log} ---"
                cat "$log"
              fi
            done
            echo "::endgroup::"
          }

          python3 -m http.server 19200 --bind 127.0.0.1 --directory builds/web > .logs/web_smoke/static.out.log 2> .logs/web_smoke/static.err.log &
          static_pid="$!"
          MULTI_SERVER_WORLD_PACK_DIR="$PWD/builds/web/world_packs" \
          MULTI_SERVER_WORLD_PACK_BASE_URL="http://127.0.0.1:19200/world_packs" \
            ./builds/server/server.x86_64 --headless > .logs/web_smoke/master.out.log 2> .logs/web_smoke/master.err.log &
          master_pid="$!"
          trap 'status=$?; if [ "$status" -ne 0 ]; then dump_logs; fi; kill "$static_pid" "$master_pid" 2>/dev/null || true; exit "$status"' EXIT

          for _ in $(seq 1 480); do
            if (echo > /dev/tcp/127.0.0.1/19080) >/dev/null 2>&1; then
              break
            fi
            if ! kill -0 "$master_pid" 2>/dev/null; then
              wait "$master_pid" || true
              echo "Master server exited before opening port 19080." >&2
              break
            fi
            sleep 0.25
          done
          (echo > /dev/tcp/127.0.0.1/19080) >/dev/null 2>&1

          cp tools/web_smoke.mjs "$RUNNER_TEMP/multi-server-test-playwright/web_smoke.mjs"
          node "$RUNNER_TEMP/multi-server-test-playwright/web_smoke.mjs" --url="http://127.0.0.1:19200/index.html?args=smoke_test,force_packrat_world_packs&run=${GITHUB_RUN_ID}" --timeout_ms=180000

      - name: Configure VPS SSH
        shell: bash
        env:
          VIRTUCADE_HOST: ${{ secrets.VIRTUCADE_HOST }}
          VIRTUCADE_SSH_KEY: ${{ secrets.VIRTUCADE_SSH_KEY }}
          VIRTUCADE_KNOWN_HOSTS: ${{ secrets.VIRTUCADE_KNOWN_HOSTS }}
        run: |
          set -euo pipefail
          test -n "${VIRTUCADE_HOST}"
          test -n "${VIRTUCADE_SSH_KEY}"
          test -n "${VIRTUCADE_KNOWN_HOSTS}"

          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          printf '%s\n' "${VIRTUCADE_SSH_KEY}" > ~/.ssh/virtucade_deploy_key
          chmod 600 ~/.ssh/virtucade_deploy_key
          printf '%s\n' "${VIRTUCADE_KNOWN_HOSTS}" > ~/.ssh/known_hosts
          chmod 600 ~/.ssh/known_hosts

      - name: Render Caddy proxy config
        shell: bash
        env:
          VIRTUCADE_HOST: ${{ secrets.VIRTUCADE_HOST }}
          VIRTUCADE_GAME_HOST: ${{ vars.VIRTUCADE_GAME_HOST || secrets.VIRTUCADE_GAME_HOST }}
          VIRTUCADE_ACME_EMAIL: ${{ vars.VIRTUCADE_ACME_EMAIL || secrets.VIRTUCADE_ACME_EMAIL }}
          VIRTUCADE_WORLD_PACK_BASE_URL: ${{ vars.VIRTUCADE_WORLD_PACK_BASE_URL || secrets.VIRTUCADE_WORLD_PACK_BASE_URL || 'https://virtucade.xyz/world_packs' }}
        run: |
          set -euo pipefail
          python3 tools/render_caddyfile.py --self-test

          printf '%s\n' \
            'MULTI_SERVER_WORLD_PACK_DIR=/opt/virtucade/world_packs' \
            "MULTI_SERVER_WORLD_PACK_BASE_URL=${VIRTUCADE_WORLD_PACK_BASE_URL%/}" \
            'MULTI_SERVER_DB_PATH=/opt/virtucade/data/virtucade' \
            > "$RUNNER_TEMP/virtucade.env"

          if [ -z "${VIRTUCADE_GAME_HOST}" ]; then
            test -n "${VIRTUCADE_HOST}"
            printf '%s\n' \
              "MULTI_SERVER_CLIENT_HOST=${VIRTUCADE_HOST}" \
              'MULTI_SERVER_CLIENT_SCHEME=ws' \
              >> "$RUNNER_TEMP/virtucade.env"
            echo "CADDY_CONFIG_SKIPPED reason=missing_VIRTUCADE_GAME_HOST"
            exit 0
          fi

          python3 tools/render_caddyfile.py \
            --host "${VIRTUCADE_GAME_HOST}" \
            --acme-email "${VIRTUCADE_ACME_EMAIL}" \
            --output "$RUNNER_TEMP/virtucade-Caddyfile"
          printf '%s\n' \
            'MULTI_SERVER_BIND_HOST=127.0.0.1' \
            "MULTI_SERVER_PUBLIC_MASTER_URL=wss://${VIRTUCADE_GAME_HOST}/" \
            "MULTI_SERVER_PUBLIC_WORLD_URL_TEMPLATE=wss://${VIRTUCADE_GAME_HOST}/{world_key}" \
            >> "$RUNNER_TEMP/virtucade.env"
          echo "CADDY_CONFIG_RENDERED host=${VIRTUCADE_GAME_HOST}"

      - name: Publish release commit
        shell: bash
        run: |
          set -euo pipefail
          version="${{ steps.version.outputs.project_version }}"
          tag="v${version}"
          git fetch origin "${GITHUB_REF_NAME}" --tags
          remote_head="$(git rev-parse "origin/${GITHUB_REF_NAME}")"
          if git rev-parse -q --verify "refs/tags/${tag}" >/dev/null; then
            tag_commit="$(git rev-list -n 1 "${tag}")"
            if [ "$tag_commit" != "$RELEASE_COMMIT" ]; then
              echo "Release tag ${tag} already points at ${tag_commit}, expected ${RELEASE_COMMIT}" >&2
              exit 1
            fi
            if [ "$remote_head" != "$RELEASE_COMMIT" ]; then
              echo "Release tag ${tag} exists, but origin/${GITHUB_REF_NAME} is ${remote_head}, expected ${RELEASE_COMMIT}" >&2
              exit 1
            fi
            echo "RELEASE_COMMIT_ALREADY_PUBLISHED tag=${tag} commit=${RELEASE_COMMIT_SHORT}"
          elif [ "$remote_head" = "$RELEASE_COMMIT" ]; then
            echo "RELEASE_COMMIT_ALREADY_PUBLISHED commit=${RELEASE_COMMIT_SHORT}"
          elif [ "$remote_head" = "$BASE_COMMIT" ]; then
            git push origin "${RELEASE_COMMIT}:refs/heads/${GITHUB_REF_NAME}"
            echo "RELEASE_COMMIT_PUBLISHED commit=${RELEASE_COMMIT_SHORT} branch=${GITHUB_REF_NAME}"
          else
            echo "origin/${GITHUB_REF_NAME} moved during release: base=${BASE_COMMIT} remote=${remote_head}" >&2
            exit 1
          fi

      - name: Upload server artifact
        uses: actions/upload-artifact@v7
        with:
          name: server-v${{ steps.version.outputs.project_version }}
          path: |
            builds/server/**
            builds/world_packs/*.pck
            builds/web/world_packs/*.pck
          if-no-files-found: error

      - name: Upload Windows client artifact
        uses: actions/upload-artifact@v7
        with:
          name: windows-client-v${{ steps.version.outputs.project_version }}
          path: |
            builds/client/**
          if-no-files-found: error

      - name: Upload Pages artifact
        uses: actions/upload-pages-artifact@v5
        with:
          path: builds/web

      - name: Deploy Pages
        id: deploy
        uses: actions/deploy-pages@v5

      - name: Verify hosted Pages files
        shell: bash
        run: |
          set -euo pipefail
          python3 tools/verify_hosted_pages.py \
            --base-url "${{ steps.deploy.outputs.page_url }}" \
            --web-root builds/web \
            --version "${{ steps.version.outputs.project_version }}" \
            --commit "${RELEASE_COMMIT}" \
            --attempts 20 \
            --delay 5 \
            --sync-world-pack-mtime-root builds/world_packs

      - name: Deploy VPS server
        shell: bash
        env:
          VIRTUCADE_HOST: ${{ secrets.VIRTUCADE_HOST }}
          VIRTUCADE_USER: ${{ secrets.VIRTUCADE_USER }}
        run: |
          set -euo pipefail
          test -n "${VIRTUCADE_HOST}"
          test -n "${VIRTUCADE_USER}"
          tar -C builds/server -czf "$RUNNER_TEMP/virtucade-server.tar.gz" .
          tar -C builds/world_packs -czf "$RUNNER_TEMP/virtucade-world-packs.tar.gz" .
          ssh -i ~/.ssh/virtucade_deploy_key "${VIRTUCADE_USER}@${VIRTUCADE_HOST}" \
            "mkdir -p /opt/virtucade/caddy && rm -f /tmp/virtucade-server.tar.gz /tmp/virtucade-world-packs.tar.gz /tmp/virtucade.env /opt/virtucade/caddy/virtucade-Caddyfile"
          scp -i ~/.ssh/virtucade_deploy_key "$RUNNER_TEMP/virtucade-server.tar.gz" \
            "${VIRTUCADE_USER}@${VIRTUCADE_HOST}:/tmp/virtucade-server.tar.gz"
          scp -i ~/.ssh/virtucade_deploy_key "$RUNNER_TEMP/virtucade-world-packs.tar.gz" \
            "${VIRTUCADE_USER}@${VIRTUCADE_HOST}:/tmp/virtucade-world-packs.tar.gz"
          if [ -f "$RUNNER_TEMP/virtucade-Caddyfile" ]; then
            scp -i ~/.ssh/virtucade_deploy_key "$RUNNER_TEMP/virtucade-Caddyfile" \
              "${VIRTUCADE_USER}@${VIRTUCADE_HOST}:/opt/virtucade/caddy/virtucade-Caddyfile"
          fi
          scp -i ~/.ssh/virtucade_deploy_key "$RUNNER_TEMP/virtucade.env" \
            "${VIRTUCADE_USER}@${VIRTUCADE_HOST}:/tmp/virtucade.env"
          ssh -i ~/.ssh/virtucade_deploy_key "${VIRTUCADE_USER}@${VIRTUCADE_HOST}" 'bash -s' <<'REMOTE'
          set -euo pipefail
          caddyfile="/opt/virtucade/caddy/virtucade-Caddyfile"
          if [ -f "${caddyfile}" ]; then
            sudo -n /usr/bin/caddy validate --adapter caddyfile --config "${caddyfile}"
          fi
          mv /tmp/virtucade.env /opt/virtucade/virtucade.env
          chmod 664 /opt/virtucade/virtucade.env
          rm -rf /opt/virtucade/server.next /opt/virtucade/world_packs.next
          mkdir -p /opt/virtucade/server.next /opt/virtucade/world_packs.next
          tar -xzf /tmp/virtucade-server.tar.gz -C /opt/virtucade/server.next
          tar -xzf /tmp/virtucade-world-packs.tar.gz -C /opt/virtucade/world_packs.next
          mv /opt/virtucade/server.next/server.x86_64 /opt/virtucade/server.next/multi-server-test.x86_64
          chmod +x /opt/virtucade/server.next/multi-server-test.x86_64
          sudo -n /usr/bin/systemctl stop virtucade
          rm -rf /opt/virtucade/server /opt/virtucade/world_packs
          mv /opt/virtucade/server.next /opt/virtucade/server
          mv /opt/virtucade/world_packs.next /opt/virtucade/world_packs
          chgrp -R virtucade /opt/virtucade/server /opt/virtucade/world_packs
          chmod -R g+rwX /opt/virtucade/server /opt/virtucade/world_packs
          rm -f /tmp/virtucade-server.tar.gz /tmp/virtucade-world-packs.tar.gz
          sudo -n /usr/bin/systemctl start virtucade
          test "$(sudo -n /usr/bin/systemctl is-active virtucade)" = active
          if [ -f "${caddyfile}" ]; then
            if ! cmp -s "${caddyfile}" /etc/caddy/Caddyfile; then
              sudo -n /usr/bin/install -m 644 "${caddyfile}" /etc/caddy/Caddyfile
              sudo -n /usr/bin/systemctl reload caddy || sudo -n /usr/bin/systemctl restart caddy
            fi
            test "$(sudo -n /usr/bin/systemctl is-active caddy)" = active
          fi
          rm -f "${caddyfile}"
          REMOTE
          echo "VPS_DEPLOY_DONE host=${VIRTUCADE_HOST} service=virtucade"

      - name: Run hosted smoke
        shell: bash
        env:
          VIRTUCADE_PUBLIC_WEB_URL: ${{ vars.VIRTUCADE_PUBLIC_WEB_URL || secrets.VIRTUCADE_PUBLIC_WEB_URL || 'https://virtucade.xyz' }}
          VIRTUCADE_GAME_HOST: ${{ vars.VIRTUCADE_GAME_HOST || secrets.VIRTUCADE_GAME_HOST }}
        run: |
          set -euo pipefail
          test -n "${VIRTUCADE_PUBLIC_WEB_URL}"
          test -n "${VIRTUCADE_GAME_HOST}"
          hosted_url="${VIRTUCADE_PUBLIC_WEB_URL%/}/?args=smoke_test,force_packrat_world_packs&master_url=wss://${VIRTUCADE_GAME_HOST}/&world_url_template=wss://${VIRTUCADE_GAME_HOST}/%7Bworld_key%7D&run=${GITHUB_RUN_ID}-hosted"
          cp tools/web_smoke.mjs "$RUNNER_TEMP/multi-server-test-playwright/web_smoke.mjs"
          node "$RUNNER_TEMP/multi-server-test-playwright/web_smoke.mjs" --url="${hosted_url}" --timeout_ms=240000

      - name: Tag verified release
        shell: bash
        run: |
          set -euo pipefail
          version="${{ steps.version.outputs.project_version }}"
          tag="v${version}"
          git fetch origin "${GITHUB_REF_NAME}" --tags
          remote_head="$(git rev-parse "origin/${GITHUB_REF_NAME}")"
          if [ "$remote_head" != "$RELEASE_COMMIT" ]; then
            echo "origin/${GITHUB_REF_NAME} is ${remote_head}, expected verified release commit ${RELEASE_COMMIT}" >&2
            exit 1
          fi
          if git rev-parse -q --verify "refs/tags/${tag}" >/dev/null; then
            tag_commit="$(git rev-list -n 1 "${tag}")"
            if [ "$tag_commit" != "$RELEASE_COMMIT" ]; then
              echo "Release tag ${tag} already points at ${tag_commit}, expected ${RELEASE_COMMIT}" >&2
              exit 1
            fi
            echo "RELEASE_TAG_EXISTS tag=${tag} commit=${RELEASE_COMMIT_SHORT}"
          else
            git tag -a "${tag}" "${RELEASE_COMMIT}" -m "Release ${tag}"
            git push origin "refs/tags/${tag}"
            echo "RELEASE_TAG_PUBLISHED tag=${tag} commit=${RELEASE_COMMIT_SHORT}"
          fi