release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  version:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - name: Validate tag and project version
        run: |
          set -euo pipefail
          version=$(bash scripts/package-version.sh "$GITHUB_REF_NAME")
          sed -E -i "s/^yoo [0-9]+\.[0-9]+\.[0-9]+$/yoo $version/" README.md
          echo "Release version: $version" >> "$GITHUB_STEP_SUMMARY"
      - run: cargo fmt --check
      - run: cargo test --locked
      - run: cargo clippy --locked --all-targets --all-features -- -D warnings

  build:
    needs: version
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            archive: yoo-${{ github.ref_name }}-linux-x86_64
            binstall_archive: yoo-${{ github.ref_name }}-x86_64-unknown-linux-gnu
            binary_name: yoo
            raw_name: yoo-linux-x86_64
            archive_extension: tar.gz

          - os: macos-latest
            target: aarch64-apple-darwin
            archive: yoo-${{ github.ref_name }}-macos-aarch64
            binstall_archive: yoo-${{ github.ref_name }}-aarch64-apple-darwin
            binary_name: yoo
            raw_name: yoo-macos-aarch64
            archive_extension: tar.gz

          - os: windows-latest
            target: x86_64-pc-windows-msvc
            archive: yoo-${{ github.ref_name }}-windows-x86_64
            binstall_archive: yoo-${{ github.ref_name }}-x86_64-pc-windows-msvc
            binary_name: yoo.exe
            raw_name: yoo-windows-x86_64.exe
            archive_extension: zip

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Build release binary
        run: cargo build --release --locked --target ${{ matrix.target }}

      - name: Prepare raw binary
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force raw | Out-Null

          Copy-Item `
            "target/${{ matrix.target }}/release/${{ matrix.binary_name }}" `
            "raw/${{ matrix.raw_name }}"

      - name: Upload raw binary
        uses: actions/upload-artifact@v7
        with:
          name: raw-${{ matrix.target }}
          path: raw/${{ matrix.raw_name }}
          if-no-files-found: error

      - name: Package Unix archives
        if: runner.os != 'Windows'
        shell: bash
        run: |
          set -euo pipefail

          mkdir -p \
            "staging/${{ matrix.archive }}" \
            "staging/${{ matrix.binstall_archive }}" \
            dist

          cp \
            "target/${{ matrix.target }}/release/yoo" \
            README.md \
            LICENSE \
            "staging/${{ matrix.archive }}/"

          cp \
            "target/${{ matrix.target }}/release/yoo" \
            README.md \
            LICENSE \
            "staging/${{ matrix.binstall_archive }}/"

          tar \
            -C staging \
            -czf "dist/${{ matrix.archive }}.tar.gz" \
            "${{ matrix.archive }}"

          tar \
            -C staging \
            -czf "dist/${{ matrix.binstall_archive }}.tar.gz" \
            "${{ matrix.binstall_archive }}"

      - name: Package Windows archives
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"

          New-Item `
            -ItemType Directory `
            -Force `
            "staging/${{ matrix.archive }}", `
            "staging/${{ matrix.binstall_archive }}", `
            "dist" |
            Out-Null

          Copy-Item `
            "target/${{ matrix.target }}/release/yoo.exe", `
            "README.md", `
            "LICENSE" `
            "staging/${{ matrix.archive }}/"

          Copy-Item `
            "target/${{ matrix.target }}/release/yoo.exe", `
            "README.md", `
            "LICENSE" `
            "staging/${{ matrix.binstall_archive }}/"

          Compress-Archive `
            -Path "staging/${{ matrix.archive }}/*" `
            -DestinationPath "dist/${{ matrix.archive }}.zip"

          Compress-Archive `
            -Path "staging/${{ matrix.binstall_archive }}/*" `
            -DestinationPath "dist/${{ matrix.binstall_archive }}.zip"

      - name: Upload archives
        uses: actions/upload-artifact@v7
        with:
          name: archives-${{ matrix.target }}
          path: dist/*
          if-no-files-found: error

  native-packages:
    needs: version
    uses: ./.github/workflows/packaging.yml

  publish:
    name: Publish GitHub Release
    needs: [build, native-packages]
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Download release artifacts
        uses: actions/download-artifact@v8
        with:
          path: release
          merge-multiple: true

      - name: List release files
        run: ls -lah release

      - name: Generate package publication bundle
        run: |
          bash scripts/package-metadata.sh release target/package-metadata
          tar -czf release/yoo-packaging.tar.gz -C target/package-metadata homebrew aur winget scoop chocolatey void

      - name: Generate SHA-256 checksums
        run: bash scripts/package-checksums.sh release

      - name: Build release notes from changelog
        shell: bash
        run: |
          bash scripts/release-notes.sh "${GITHUB_REF_NAME}" > release-notes.md

      - name: Publish GitHub release
        uses: softprops/action-gh-release@v3
        with:
          body_path: release-notes.md
          overwrite_files: true
          files: release/*

  publish-aur:
    needs: publish
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      status: ${{ steps.publish.outputs.status || steps.credentials.outputs.status }}
    steps:
      - name: Check optional AUR credentials
        id: credentials
        env:
          KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
        run: |
          if [ -n "$KEY" ]; then
            echo enabled=true >> "$GITHUB_OUTPUT"
            echo status=ATTEMPTING >> "$GITHUB_OUTPUT"
          else
            echo status='SKIPPED (AUR_SSH_PRIVATE_KEY is not configured)' >> "$GITHUB_OUTPUT"
            echo 'AUR publication skipped: AUR_SSH_PRIVATE_KEY is not configured.' >> "$GITHUB_STEP_SUMMARY"
          fi
      - name: Download generated metadata
        if: steps.credentials.outputs.enabled == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          gh release download "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --pattern yoo-packaging.tar.gz
          tar -xzf yoo-packaging.tar.gz aur
      - name: Publish yoo-bin to AUR
        id: publish
        if: steps.credentials.outputs.enabled == 'true'
        env:
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
        run: |
          set -euo pipefail
          key=$(mktemp)
          home=$(mktemp -d)
          trap 'rm -f "$key"; rm -rf "$home"' EXIT
          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > "$key"
          chmod 600 "$key"
          mkdir -p "$home/.ssh"
          if ! ssh-keyscan -H aur.archlinux.org > "$home/.ssh/known_hosts"; then
            echo 'status=WARNING (could not retrieve the AUR SSH host key)' >> "$GITHUB_OUTPUT"
            echo 'AUR publication warning: could not retrieve the AUR SSH host key; update the package manually.' >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi
          ssh_command="ssh -i $key -o IdentitiesOnly=yes -o UserKnownHostsFile=$home/.ssh/known_hosts"
          if ! GIT_SSH_COMMAND="$ssh_command" git clone ssh://aur@aur.archlinux.org/yoo-bin.git aur-repo; then
            echo 'status=WARNING (AUR SSH authentication or clone failed)' >> "$GITHUB_OUTPUT"
            echo 'AUR publication warning: SSH authentication or clone failed; update the package manually.' >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi
          cp aur/PKGBUILD aur/.SRCINFO aur-repo/
          cd aur-repo
          git config user.name github-actions[bot]
          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
          git add PKGBUILD .SRCINFO
          if ! git diff --cached --quiet; then
            git commit -m "Update yoo-bin to $GITHUB_REF_NAME"
            if ! GIT_SSH_COMMAND="$ssh_command" git push; then
              echo 'status=WARNING (AUR push failed)' >> "$GITHUB_OUTPUT"
              echo 'AUR publication warning: the AUR push failed; update the package manually.' >> "$GITHUB_STEP_SUMMARY"
              exit 0
            fi
            echo 'status=PUBLISHED' >> "$GITHUB_OUTPUT"
          else
            echo 'status=ALREADY CURRENT' >> "$GITHUB_OUTPUT"
          fi
          echo "AUR: $(tail -n 1 "$GITHUB_OUTPUT" | cut -d= -f2-)" >> "$GITHUB_STEP_SUMMARY"

  publish-cargo:
    name: Publish to crates.io
    needs: publish
    runs-on: ubuntu-latest
    env:
      CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.ref_name }}
      - uses: dtolnay/rust-toolchain@stable
      - name: Publish versioned crate
        if: env.CARGO_REGISTRY_TOKEN != ''
        run: |
          set -euo pipefail
          version=$(bash scripts/package-version.sh "$GITHUB_REF_NAME")
          status=$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
            --user-agent 'yoo-release (https://github.com/nihitdev/yo-cli)' \
            "https://crates.io/api/v1/crates/yoo/$version")
          case "$status" in
            200) echo "crates.io yoo@$version already exists: SKIPPED" >> "$GITHUB_STEP_SUMMARY" ;;
            404)
              cargo publish --locked
              echo "crates.io yoo@$version: PUBLISHED" >> "$GITHUB_STEP_SUMMARY"
              ;;
            *) echo "crates.io version lookup failed: HTTP $status" >&2; exit 1 ;;
          esac
      - name: Report missing Cargo credentials
        if: env.CARGO_REGISTRY_TOKEN == ''
        run: echo 'crates.io publication skipped — CARGO_REGISTRY_TOKEN is not configured.' >> "$GITHUB_STEP_SUMMARY"

  publish-npm:
    needs: publish
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.ref_name }}
      - name: Set up Node.js for npm trusted publishing
        uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
      - name: Publish versioned npm package
        run: |
          set -euo pipefail
          version=$(bash scripts/package-version.sh "$GITHUB_REF_NAME")
          work=$(mktemp -d)
          trap 'rm -rf "$work"' EXIT
          cp -a packages/npm/. "$work/"
          npm --prefix "$work" pkg set version="$version"
          (cd "$work" && npm pack --dry-run --ignore-scripts)
          if npm view "@nihit_dev/yoo@$version" version --silent >/dev/null 2>&1; then
            echo "npm @nihit_dev/yoo@$version already exists: SKIPPED" >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi
          (cd "$work" && npm publish --access public)
          echo "npm @nihit_dev/yoo@$version: PUBLISHED via Trusted Publishing (pnpm/Bun consume the npm registry)" >> "$GITHUB_STEP_SUMMARY"

  publish-alpine:
    needs: publish
    permissions:
      contents: write
    uses: ./.github/workflows/alpine-repository.yml
    with:
      tag: ${{ github.ref_name }}
    secrets:
      ALPINE_SIGNING_KEY: ${{ secrets.ALPINE_SIGNING_KEY }}

  release-summary:
    if: always()
    needs:
      - publish
      - publish-npm
      - publish-cargo
      - publish-aur
      - publish-alpine
    runs-on: ubuntu-latest
    steps:
      - name: Write release status summary
        env:
          PUBLISH: ${{ needs.publish.result }}
          NPM: ${{ needs.publish-npm.result }}
          CARGO: ${{ needs.publish-cargo.result }}
          AUR: ${{ needs.publish-aur.outputs.status || needs.publish-aur.result }}
          ALPINE: ${{ needs.publish-alpine.result }}
        run: |
          {
            echo "## yoo ${GITHUB_REF_NAME} release"
            echo
            echo '| Ecosystem | Workflow status | Notes |'
            echo '| --- | --- | --- |'
            echo "| GitHub Release | $PUBLISH | Release assets and checksums |"
            echo "| npm (pnpm/Bun) | $NPM | Uses npm Trusted Publishing via GitHub OIDC |"
            echo "| crates.io | $CARGO | Versioned crate published using CARGO_REGISTRY_TOKEN |"
            echo "| AUR | $AUR | AUR SSH publishing is optional; warnings are recorded in the publisher job summary |"
            echo '| Snap | BUILT | Store publishing disabled; .snap attached to GitHub Release |'
            echo
            echo '### Snap status'
            echo '- BUILD AUTOMATED: YES'
            echo '- STORE PUBLISHING: DISABLED'
            echo '- GITHUB RELEASE ARTIFACT: YES'
            echo "| Alpine/APK | $ALPINE | Signed APKINDEX publication |"
            echo '| WinGet | BUILT | Manifest included in yoo-packaging.tar.gz; community PR remains external |'
            echo '| Scoop | BUILT | Manifest included; nihitdev/scoop-nihitdev updates independently |'
            echo
            echo 'WinGet manifests, Scoop metadata, and package metadata are attached in yoo-packaging.tar.gz.'
          } >> "$GITHUB_STEP_SUMMARY"