release.yml

# GitHub Actions Release Workflow for Zy CLI
#
# This workflow builds and publishes signed (or unsigned if secrets are absent) release binaries
# for the Rust CLI project "zy" across Windows, Linux, and macOS platforms.
#
# Triggers:
# - Tag push matching 'v*' pattern (e.g., v0.1.0, v1.2.3)
# - GitHub Release published event
# - Manual workflow dispatch
#
# Build Matrix:
# - Linux: x86_64 (gnu) and aarch64 (gnu) - MUSL targets removed due to cross-compilation complexity
# - macOS: Intel (x86_64) and Apple Silicon (aarch64)
# - Windows: x86_64
#
# Platform Strategy:
# - Linux GNU targets (x86_64, aarch64): Use native/cross compilation as appropriate
# - macOS targets: Use native runners with cargo directly
# - Windows targets: Use native runners with cargo directly
# - MUSL targets removed: Cross-compilation with musl and pkg-config/OpenSSL proved problematic
#   and adds maintenance burden. Users needing static binaries can build locally or use containers.
#
# Cross-compilation Notes:
# - aarch64-unknown-linux-gnu: Uses cross tool for reliable cross-compilation with proper
#   dependencies and toolchain setup.
# - For adding new targets: Consider native compilation first; use cross only when necessary
#   and test thoroughly with all project dependencies.
#
# The workflow:
# 1. Builds release binaries for all target platforms
# 2. Runs tests to ensure quality
# 3. Prepares binaries with proper naming for each platform
# 4. Generates SHA256 checksums for all binaries
# 5. Uploads binaries to GitHub Releases
#
# To extend this workflow:
# - Add new targets to the matrix carefully (test dependencies and cross-compilation)
# - Modify the binary preparation step to adjust naming or add metadata
# - Add code signing steps before uploading binaries (requires secrets setup)

name: Release

on:
  # Trigger on version tags and main branch commits
  push:
    branches:
      - main
    tags:
      - 'v*'
  
  # Trigger when a GitHub Release is published
  release:
    types: [published]
  
  # Allow manual triggering
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  # Build matrix job for all platforms
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux x86_64 GNU
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            use_cross: false
            
          # Linux aarch64 GNU (cross-compilation)
          # Note: Uses cross tool for reliable ARM64 cross-compilation
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            use_cross: true
            
          # macOS Intel
          - target: x86_64-apple-darwin
            os: macos-latest
            use_cross: false
            
          # macOS Apple Silicon
          - target: aarch64-apple-darwin
            os: macos-latest
            use_cross: false
            
          # Windows x86_64
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            use_cross: false

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}

      # Install cross for cross-compilation targets using taiki-e/install-action
      # This provides better caching and is the recommended approach
      # Cross is used for:
      # - Linux aarch64 GNU target for cross-compilation
      - name: Install cross
        if: matrix.use_cross
        uses: taiki-e/install-action@v2
        with:
          tool: cross

      # Run tests natively before building release binaries
      - name: Run tests
        run: cargo test --release
        shell: bash

      # Build the binary using cargo or cross
      - name: Build release binary
        run: |
          if [ "${{ matrix.use_cross }}" = "true" ]; then
            cross build --release --target ${{ matrix.target }}
          else
            cargo build --release --target ${{ matrix.target }}
          fi
        shell: bash

      # Prepare binary for upload (handle Windows .exe extension)
      - name: Prepare binary
        id: prepare
        run: |
          cd target/${{ matrix.target }}/release
          if [ "${{ matrix.os }}" = "windows-latest" ]; then
            BINARY_NAME="zy.exe"
          else
            BINARY_NAME="zy"
          fi
          echo "binary_name=$BINARY_NAME" >> $GITHUB_OUTPUT
          echo "binary_path=target/${{ matrix.target }}/release/$BINARY_NAME" >> $GITHUB_OUTPUT
        shell: bash

      # Upload binary as artifact for the package job
      - name: Upload binary artifact
        uses: actions/upload-artifact@v4
        with:
          name: binary-${{ matrix.target }}
          path: ${{ steps.prepare.outputs.binary_path }}
          if-no-files-found: error

  # Package job: create archives and checksums
  package:
    name: Package and Release
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write  # Required to create releases and upload assets
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # Download all binary artifacts
      - name: Download all artifacts
        uses: actions/download-artifact@v4.1.3
        with:
          path: artifacts

      - name: Display structure of downloaded files
        run: ls -R artifacts

      # Prepare binaries for release
      - name: Prepare release binaries
        run: |
          # Get version from git tag or use a default
          VERSION="${GITHUB_REF_NAME#v}"
          if [[ -z "${VERSION}" || "${VERSION}" == "${GITHUB_REF_NAME}" ]]; then
              VERSION="$(git describe --tags --always 2>/dev/null || echo 'dev')"
              VERSION="${VERSION#v}"
          fi
          
          echo "Preparing binaries for version: ${VERSION}"
          
          # Create dist directory
          mkdir -p dist
          
          # Copy and rename binaries for each target
          for artifact_dir in artifacts/binary-*; do
            if [[ -d "$artifact_dir" ]]; then
              target=$(basename "$artifact_dir" | sed 's/binary-//')
              echo "Processing target: $target"
              
              if [[ -f "$artifact_dir/zy.exe" ]]; then
                # Windows binary
                cp "$artifact_dir/zy.exe" "dist/zy-${VERSION}-${target}.exe"
                echo "Created zy-${VERSION}-${target}.exe"
              elif [[ -f "$artifact_dir/zy" ]]; then
                # Linux/macOS binary
                cp "$artifact_dir/zy" "dist/zy-${VERSION}-${target}"
                chmod +x "dist/zy-${VERSION}-${target}"
                echo "Created zy-${VERSION}-${target}"
              fi
            fi
          done
          
          echo ""
          echo "Binaries prepared:"
          ls -lh dist/

      # Generate combined SHA256 checksums file
      - name: Generate checksums
        run: |
          cd dist
          sha256sum zy-* > SHA256SUMS.txt
          cat SHA256SUMS.txt

      # Get version from tag or use a default
      - name: Get version
        id: get_version
        run: |
          if [[ $GITHUB_REF == refs/tags/v* ]]; then
            VERSION=${GITHUB_REF#refs/tags/v}
          elif [[ $GITHUB_REF == refs/tags/* ]]; then
            VERSION=${GITHUB_REF#refs/tags/}
          else
            VERSION="dev-$(git rev-parse --short HEAD)"
          fi
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Version: $VERSION"

      # Create GitHub Release (if triggered by tag and release doesn't exist)
      - name: Create Release
        id: create_release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          draft: false
          prerelease: ${{ contains(github.ref, 'alpha') || contains(github.ref, 'beta') || contains(github.ref, 'rc') }}
          generate_release_notes: true
          files: |
            dist/zy-*
            dist/SHA256SUMS.txt

      # Upload artifacts to existing release (if triggered by release event)
      - name: Upload to existing release
        if: github.event_name == 'release'
        uses: softprops/action-gh-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          files: |
            dist/zy-*
            dist/SHA256SUMS.txt

      # For workflow_dispatch or push to main, just upload as workflow artifacts
      - name: Upload workflow artifacts
        if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
        uses: actions/upload-artifact@v4
        with:
          name: release-packages
          path: |
            dist/zy-*
            dist/SHA256SUMS.txt