release.yml

name: Release shared JavaScript runtime

on:
  workflow_dispatch:
    inputs:
      registry:
        description: Publish npm from an immutable release tag
        required: true
        type: choice
        default: validate-only
        options:
          - validate-only
          - npm

permissions:
  contents: read

jobs:
  contract:
    name: Validate immutable release identity
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@v6
        with: { persist-credentials: false }
      - uses: actions/setup-node@v6
        with: { node-version: "24", package-manager-cache: false }
      - uses: dtolnay/rust-toolchain@1.95
        with: { components: rustfmt }
      - id: version
        shell: bash
        run: |
          ./scripts/verify.sh
          version=$(node -p 'require("./release/version.json").canonical')
          node scripts/check-release-ref.mjs \
            --ref "$GITHUB_REF" \
            --ref-name "$GITHUB_REF_NAME" \
            --registry "${{ inputs.registry }}"
          echo "version=$version" >> "$GITHUB_OUTPUT"

  native-prebuild:
    name: Native ${{ matrix.os }} / ${{ matrix.arch }}
    needs: contract
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-24.04, arch: x64, platform: linux-x64 }
          - { os: ubuntu-24.04-arm, arch: arm64, platform: linux-arm64 }
          - { os: macos-15-intel, arch: x64, platform: darwin-x64 }
          - { os: macos-15, arch: arm64, platform: darwin-arm64 }
          - { os: windows-2025, arch: x64, platform: win32-x64 }
          - { os: windows-11-arm, arch: arm64, platform: win32-arm64 }
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6
        with: { persist-credentials: false }
      - uses: actions/setup-node@v6
        with: { node-version: "24", architecture: "${{ matrix.arch }}", package-manager-cache: false }
      - name: Checkout immutable family sources
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: node scripts/checkout-family-sources.mjs --parent "$GITHUB_WORKSPACE/.."
      - uses: dtolnay/rust-toolchain@1.95
      - name: Install build tool and local interop type package
        shell: bash
        run: >-
          npm install --ignore-scripts --no-save node-gyp@13.0.1
          "@vinary-tree/vinary-tree-interop@file:../vinary-tree-interop/bindings/javascript"
      - name: Build relocatable SDK and native addon
        shell: bash
        env:
          VINARY_TREE_INTEROP_ROOT: ${{ github.workspace }}/../vinary-tree-interop
          VINARY_TREE_LLATTICE_ROOT: ${{ github.workspace }}/../llattice
          VINARY_TREE_LIBDICTENSTEIN_ROOT: ${{ github.workspace }}/../libdictenstein
          VINARY_TREE_LIBLEVENSHTEIN_ROOT: ${{ github.workspace }}/../liblevenshtein-rust
          VINARY_TREE_LLING_LLANG_ROOT: ${{ github.workspace }}/../lling-llang
          VINARY_TREE_DUALLITY_ROOT: ${{ github.workspace }}/../duallity
        run: |
          npm run bootstrap:native
          npm run build:native:release
          npm run test:native
          npm run test:leak
          npm run stage:native
      - uses: actions/upload-artifact@v7
        with:
          name: native-${{ matrix.platform }}
          path: native/prebuilds
          if-no-files-found: error

  webassembly:
    name: Browser WASM and WASI artifacts
    needs: contract
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6
        with: { persist-credentials: false }
      - uses: actions/setup-node@v6
        with: { node-version: "24", package-manager-cache: false }
      - name: Checkout immutable family sources
        env:
          GH_TOKEN: ${{ github.token }}
        run: node scripts/checkout-family-sources.mjs --parent "$GITHUB_WORKSPACE/.."
      - uses: dtolnay/rust-toolchain@1.95
        with: { targets: "wasm32-unknown-unknown,wasm32-wasip1" }
      - uses: jetli/wasm-pack-action@v0.4.0
        with: { version: v0.13.1 }
      - run: bash .github/setup-binaryen.sh
      - name: Install local interop type package
        run: >-
          npm install --ignore-scripts --no-save
          "@vinary-tree/vinary-tree-interop@file:../vinary-tree-interop/bindings/javascript"
      - name: Build and test both WebAssembly hosts
        env:
          VINARY_TREE_INTEROP_ROOT: ${{ github.workspace }}/../vinary-tree-interop
          VINARY_TREE_LLATTICE_ROOT: ${{ github.workspace }}/../llattice
          VINARY_TREE_LIBDICTENSTEIN_ROOT: ${{ github.workspace }}/../libdictenstein
          VINARY_TREE_LIBLEVENSHTEIN_ROOT: ${{ github.workspace }}/../liblevenshtein-rust
          VINARY_TREE_LLING_LLANG_ROOT: ${{ github.workspace }}/../lling-llang
          VINARY_TREE_DUALLITY_ROOT: ${{ github.workspace }}/../duallity
        run: |
          npm run configure:local
          npm run build:wasm
          npm run build:wasi
          npm test
      - uses: actions/upload-artifact@v7
        with:
          name: webassembly
          path: generated
          if-no-files-found: error

  assemble:
    name: Assemble and inspect npm tarball
    needs: [contract, native-prebuild, webassembly]
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6
        with: { persist-credentials: false }
      - uses: actions/setup-node@v6
        with: { node-version: "24", package-manager-cache: false }
      - uses: actions/download-artifact@v7
        with: { pattern: native-*, path: native/prebuilds, merge-multiple: true }
      - uses: actions/download-artifact@v7
        with: { name: webassembly, path: generated }
      - run: npm install --ignore-scripts
      - run: npm run verify:prebuilds
      - run: npm run verify:package
      - run: mkdir dist && npm pack --ignore-scripts --pack-destination dist
      - uses: actions/upload-artifact@v7
        with:
          name: npm-package
          path: dist/*.tgz
          if-no-files-found: error

  publish-npm:
    name: Publish npm under next
    needs: [contract, assemble]
    if: github.event_name == 'workflow_dispatch' && github.ref_type == 'tag' && inputs.registry == 'npm'
    runs-on: ubuntu-24.04
    environment: npm
    permissions: { id-token: write }
    steps:
      - uses: actions/setup-node@v6
        with: { node-version: "24", registry-url: "https://registry.npmjs.org", package-manager-cache: false }
      - uses: actions/download-artifact@v7
        with: { name: npm-package, path: dist }
      - run: npm publish --access public --provenance --tag next ./dist/*.tgz

  github-release:
    name: Publish checksummed runtime release
    needs: [contract, assemble]
    if: >-
      github.event_name == 'workflow_dispatch' &&
      github.ref_type == 'tag' &&
      inputs.registry == 'validate-only'
    runs-on: ubuntu-24.04
    environment: github-release
    permissions: { contents: write }
    steps:
      - uses: actions/download-artifact@v7
        with: { name: npm-package, path: assets }
      - run: sha256sum assets/*.tgz > assets/SHA256SUMS
      - uses: softprops/action-gh-release@v2
        with:
          files: assets/*
          prerelease: ${{ contains(github.ref_name, '-') }}
          generate_release_notes: true