release.yml

name: Release

# Build four native targets and the cross-platform web bundle on five
# independent runners. Publishing waits for all five artifact uploads, making
# wall-clock time roughly the slowest build instead of the sum of every build.

on:
  push:
    branches: [master]
    tags: ['v*']
  workflow_dispatch:
    inputs:
      version:
        description: 'Version override (defaults to the git commit short SHA)'
        required: false

permissions:
  contents: read

concurrency:
  group: release-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  platform:
    name: Build ${{ matrix.platform }} artifacts
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux
            # Ubuntu 22.04 ships glibc 2.35. Building the Linux core here keeps
            # artifacts runnable on 22.04 and newer glibc-based distributions.
            runner: ubuntu-22.04
            script: release-linux.sh
            rust_targets: ''
            macos_arch: ''
            # The Microsandbox SDK (default feature) links libcap-ng; install
            # its development package here (mirrors the ci.yml core job) or the
            # release link fails with
            # `rust-lld: error: unable to find library -lcap-ng`.
            apt_packages: libcap-ng-dev libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev pkg-config

          - platform: windows
            runner: ubuntu-latest
            script: release-windows.sh
            rust_targets: x86_64-pc-windows-gnu
            macos_arch: ''
            apt_packages: mingw-w64 msitools zip
          - platform: macos-arm64
            runner: ubuntu-latest
            script: release-macos.sh
            rust_targets: aarch64-apple-darwin
            macos_arch: arm64
            apt_packages: xorriso
          - platform: macos-x86_64
            runner: ubuntu-latest
            script: release-macos.sh
            rust_targets: x86_64-apple-darwin
            macos_arch: x86_64
            apt_packages: xorriso
    steps:
      - uses: actions/checkout@v4

      - name: Resolve version
        id: ver
        shell: bash
        env:
          VERSION_OVERRIDE: ${{ inputs.version }}
        run: |
          version="$VERSION_OVERRIDE"
          if [[ -z "$version" ]]; then
            if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
              # vX.Y.Z release: name artifacts with the semver (not the commit
              # SHA) so they line up with the tag, install.sh, and the
              # Homebrew cask/formula in catalystctl/homebrew-catcode.
              version="${GITHUB_REF_NAME#v}"
            else
              version="$(git rev-parse --short HEAD)"
            fi
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Set up native Rust toolchain
        if: matrix.rust_targets == ''
        uses: dtolnay/rust-toolchain@stable
      - name: Set up Rust cross target
        if: matrix.rust_targets != ''
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rust_targets }}
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: core
          # Do not restore Linux objects compiled against a newer glibc after
          # changing the release baseline. Other platforms retain their key.
          key: release-${{ matrix.platform }}${{ matrix.platform == 'linux' && '-glibc235' || '' }}

      - uses: actions/setup-go@v5
        with:
          go-version: '1.25'
          cache-dependency-path: tui/go.sum

      - name: Set up Zig
        if: startsWith(matrix.platform, 'macos-')
        uses: goto-bus-stop/setup-zig@v2
        with:
          version: '0.13.0'
      - name: Install cargo-zigbuild
        if: startsWith(matrix.platform, 'macos-')
        run: pip install cargo-zigbuild

      - name: Install platform packaging dependencies
        if: matrix.apt_packages != ''
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends ${{ matrix.apt_packages }}

      - name: Build ${{ matrix.platform }}
        env:
          CATCODE_MACOS_ARCH: ${{ matrix.macos_arch }}
        run: bash "${{ matrix.script }}" "${{ steps.ver.outputs.version }}"

      - name: Upload ${{ matrix.platform }} artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-${{ matrix.platform }}
          path: dist/*
          if-no-files-found: error
          retention-days: 1

  web:
    name: Build web bundle
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Resolve version
        id: ver
        shell: bash
        env:
          VERSION_OVERRIDE: ${{ inputs.version }}
        run: |
          version="$VERSION_OVERRIDE"
          if [[ -z "$version" ]]; then
            if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
              # vX.Y.Z release: name artifacts with the semver (not the commit
              # SHA) so they line up with the tag, install.sh, and the
              # Homebrew cask/formula in catalystctl/homebrew-catcode.
              version="${GITHUB_REF_NAME#v}"
            else
              version="$(git rev-parse --short HEAD)"
            fi
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: '1.3.14'
      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Restore Bun package cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-${{ runner.arch }}-bun-${{ hashFiles('web/bun.lock', 'sdk/bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-bun-

      - name: Restore Next.js build cache
        uses: actions/cache@v4
        with:
          path: web/.next/cache
          key: ${{ runner.os }}-${{ runner.arch }}-next-${{ hashFiles('web/bun.lock') }}-${{ hashFiles('web/src/**/*.ts', 'web/src/**/*.tsx', 'web/public/**', 'web/next.config.mjs', 'web/tsconfig.json') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-next-${{ hashFiles('web/bun.lock') }}-

      - name: Build web bundle
        env:
          NEXT_TELEMETRY_DISABLED: '1'
        run: bash release-web.sh "${{ steps.ver.outputs.version }}"

      - name: Upload web artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-web
          path: |
            dist/catcode-web-${{ steps.ver.outputs.version }}.tar.gz
            dist/catcode-web-${{ steps.ver.outputs.version }}.tar.gz.sha256
          if-no-files-found: error
          retention-days: 1

  publish:
    name: Publish release
    needs: [platform, web]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4

      - name: Resolve version
        id: ver
        shell: bash
        env:
          VERSION_OVERRIDE: ${{ inputs.version }}
        run: |
          version="$VERSION_OVERRIDE"
          if [[ -z "$version" ]]; then
            if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
              # vX.Y.Z release: name artifacts with the semver (not the commit
              # SHA) so they line up with the tag, install.sh, and the
              # Homebrew cask/formula in catalystctl/homebrew-catcode.
              version="${GITHUB_REF_NAME#v}"
            else
              version="$(git rev-parse --short HEAD)"
            fi
          fi
          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
            tag="$GITHUB_REF_NAME"
          else
            tag="$version"
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "tag=$tag" >> "$GITHUB_OUTPUT"

      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: release-*
          path: dist
          merge-multiple: true

      - name: Verify assembled release
        shell: bash
        run: |
          version="${{ steps.ver.outputs.version }}"
          test -f "dist/catcode-web-${version}.tar.gz"
          test -f "dist/catcode-web-${version}.tar.gz.sha256"
          if compgen -G "dist/catcode-web-${version}-*.tar.gz" > /dev/null; then
            echo "error: unexpected platform-suffixed web tarball" >&2
            exit 1
          fi
          find dist -maxdepth 1 -type f -printf '%f\n' | sort

      - name: Create GitHub Release with assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ steps.ver.outputs.tag }}
        shell: bash
        run: |
          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            gh release upload "$RELEASE_TAG" dist/* --clobber
          else
            gh release create "$RELEASE_TAG" \
              --target "$GITHUB_SHA" \
              --title "$RELEASE_TAG" \
              --generate-notes \
              dist/*
          fi