release.yml

name: Release

on:
  push:
    tags: ["v[0-9]+.[0-9]+.[0-9]+*"]
  workflow_dispatch:
    inputs:
      version:
        description: "Version to release (e.g. 1.2.3, without v prefix)"
        required: true
        type: string

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  BINARY_NAME: cdcx

jobs:
  # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  # Job 1: Create draft release (tags/dispatch only)
  # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  create-release:
    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.meta.outputs.version }}
      tag: ${{ steps.meta.outputs.tag }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Resolve version
        id: meta
        env:
          INPUT_VERSION: ${{ inputs.version }}
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            VERSION="$INPUT_VERSION"
            TAG="v${VERSION}"
          else
            TAG="${GITHUB_REF_NAME}"
            VERSION="${TAG#v}"
          fi
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"

      - name: Validate Cargo.toml version matches
        env:
          EXPECTED_VERSION: ${{ steps.meta.outputs.version }}
          TAG: ${{ steps.meta.outputs.tag }}
        run: |
          CARGO_VER=$(grep -m1 '^version' Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
          if [ "$CARGO_VER" != "$EXPECTED_VERSION" ]; then
            echo "::error::Tag $TAG != Cargo.toml version ${CARGO_VER}"
            exit 1
          fi

      - name: Create tag (workflow_dispatch only)
        if: github.event_name == 'workflow_dispatch'
        env:
          TAG: ${{ steps.meta.outputs.tag }}
        run: |
          git tag "$TAG"
          git push origin "$TAG"

      - name: Create draft release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ steps.meta.outputs.tag }}
        run: |
          gh release create "$TAG" \
            --draft \
            --title "$TAG" \
            --generate-notes

  # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  # Job 2: Test on native runners (real OS coverage)
  # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, macos-26, windows-2025]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --locked --all-features

  # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  # Job 3: Build release binaries
  #
  # Strategy:
  #   Linux   → ubuntu runner + musl-tools / cross (cross-compile)
  #   macOS   → macos-latest runner (native, avoids SDK issues)
  #   Windows → ubuntu runner + cargo-xwin (cross-compile)
  #
  # On tag/dispatch: uploads to GitHub Release
  # On branch push: uploads as Actions artifacts
  # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  build:
    needs: [test, create-release]
    strategy:
      fail-fast: false
      matrix:
        include:
          # ── Linux (cross-compile on ubuntu) ────────────────
          - target: x86_64-unknown-linux-musl
            runner: ubuntu-24.04
            method: musl-native
            ext: ""
            archive: tar.gz

          - target: aarch64-unknown-linux-musl
            runner: ubuntu-24.04
            method: cross
            ext: ""
            archive: tar.gz

          - target: aarch64-unknown-linux-gnu
            runner: ubuntu-24.04
            method: cross
            ext: ""
            archive: tar.gz

          # ── macOS (native on macos runner) ─────────────────
          - target: x86_64-apple-darwin
            runner: macos-26
            method: native
            ext: ""
            archive: tar.gz

          - target: aarch64-apple-darwin
            runner: macos-26
            method: native
            ext: ""
            archive: tar.gz

          # ── Windows (cross-compile on ubuntu) ──────────────
          - target: x86_64-pc-windows-msvc
            runner: ubuntu-24.04
            method: xwin
            ext: ".exe"
            archive: zip

          - target: aarch64-pc-windows-msvc
            runner: ubuntu-24.04
            method: xwin
            ext: ".exe"
            archive: zip

    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          key: release-${{ matrix.target }}

      # ── Tool installation (conditional per method) ─────────

      - name: Install musl-tools
        if: matrix.method == 'musl-native'
        run: sudo apt-get update && sudo apt-get install -y musl-tools

      - name: Install cross
        if: matrix.method == 'cross'
        env:
          CROSS_VERSION: "0.2.5"
          CROSS_SHA256: "642375d1bcf3bd88272c32ba90e999f3d983050adf45e66bd2d3887e8e838bad"
        run: |
          curl -fsSL "https://github.com/cross-rs/cross/releases/download/v${CROSS_VERSION}/cross-x86_64-unknown-linux-gnu.tar.gz" \
            -o cross.tar.gz
          echo "${CROSS_SHA256}  cross.tar.gz" | shasum -a 256 --check
          tar xzf cross.tar.gz -C /usr/local/bin
          rm cross.tar.gz
          cross --version

      - name: Install cargo-xwin
        if: matrix.method == 'xwin'
        run: |
          sudo apt-get update && sudo apt-get install -y clang llvm lld
          cargo install cargo-xwin
          cargo-xwin --version

      # ── Build ──────────────────────────────────────────────

      - name: Build release binary
        shell: bash
        run: |
          case "${{ matrix.method }}" in
            native|musl-native)
              cargo build --release --locked --target ${{ matrix.target }}
              ;;
            cross)
              cross build --release --locked --target ${{ matrix.target }}
              ;;
            xwin)
              cargo xwin build --release --locked --target ${{ matrix.target }}
              ;;
          esac

      # ── Strip (reduce binary size) ─────────────────────────

      - name: Strip binary
        shell: bash
        run: |
          BIN="target/${{ matrix.target }}/release/${{ env.BINARY_NAME }}${{ matrix.ext }}"

          case "${{ matrix.method }}" in
            native|musl-native)
              strip "$BIN" 2>/dev/null || true
              ;;
            cross)
              docker run --rm \
                -v "$(pwd)/target:/target" \
                "ghcr.io/cross-rs/${{ matrix.target }}:main" \
                sh -c "which strip && strip /target/${{ matrix.target }}/release/${{ env.BINARY_NAME }} || true"
              ;;
            xwin)
              echo "Skipping strip for Windows binary"
              ;;
          esac

          ls -lh "$BIN"

      # ── Package ────────────────────────────────────────────

      - name: Package archive
        id: pkg
        shell: bash
        run: |
          if [ "${{ needs.create-release.outputs.version }}" != "" ]; then
            VERSION="${{ needs.create-release.outputs.version }}"
          else
            VERSION="dev-${GITHUB_SHA::8}"
          fi
          ARCHIVE_NAME="${{ env.BINARY_NAME }}-${VERSION}-${{ matrix.target }}"

          mkdir -p "dist/${ARCHIVE_NAME}"
          cp "target/${{ matrix.target }}/release/${{ env.BINARY_NAME }}${{ matrix.ext }}" "dist/${ARCHIVE_NAME}/"
          cp README.md "dist/${ARCHIVE_NAME}/" 2>/dev/null || true

          cd dist
          if [ "${{ matrix.archive }}" = "zip" ]; then
            7z a "${ARCHIVE_NAME}.zip" "${ARCHIVE_NAME}"
          else
            tar czf "${ARCHIVE_NAME}.tar.gz" "${ARCHIVE_NAME}"
          fi

          echo "file=${ARCHIVE_NAME}.${{ matrix.archive }}" >> "$GITHUB_OUTPUT"

      # ── Checksum ───────────────────────────────────────────

      - name: Generate checksum
        shell: bash
        working-directory: dist
        run: shasum -a 256 "${{ steps.pkg.outputs.file }}" > "${{ steps.pkg.outputs.file }}.sha256"

      # ── Upload to release (tag/dispatch only) ──────────────

      - name: Upload to GitHub release
        if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.create-release.outputs.tag }}
        run: |
          gh release upload "$TAG" \
            "dist/${{ steps.pkg.outputs.file }}" \
            "dist/${{ steps.pkg.outputs.file }}.sha256"

      # ── Upload as artifact (branch push — for testing) ─────

      - name: Upload build artifact
        if: "!startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch'"
        uses: actions/upload-artifact@v6
        with:
          name: ${{ env.BINARY_NAME }}-${{ matrix.target }}
          path: |
            dist/${{ steps.pkg.outputs.file }}
            dist/${{ steps.pkg.outputs.file }}.sha256
          retention-days: 7

  # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  # Job 4: Aggregate checksums & publish release (tags only)
  # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  publish:
    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
    needs: [create-release, build]
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v5

      - name: Generate combined checksums.txt
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.create-release.outputs.tag }}
        run: |
          mkdir -p tmp && cd tmp
          gh release download "$TAG" --pattern "*.sha256"
          cat *.sha256 | sort > checksums.txt
          gh release upload "$TAG" checksums.txt --clobber

      - name: Publish release (remove draft)
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.create-release.outputs.tag }}
        run: gh release edit "$TAG" --draft=false