release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Release version (without v prefix)"
        required: true

concurrency:
  group: cellscript-release-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_INCREMENTAL: "0"
  CKB_SDK_RUST_REF: v5.1.0
  CKB_ACCEPTANCE_REVISION: f7fa4436737756f97a24e254f22c13a36316ecea

jobs:
  release-gate:
    name: Release gate
    runs-on: ubuntu-latest
    timeout-minutes: 180
    services:
      postgres:
        image: postgres:17-alpine
        env:
          POSTGRES_DB: cellscript_registry_test
          POSTGRES_USER: cellscript_test
          POSTGRES_PASSWORD: cellscript_test_password
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U cellscript_test -d cellscript_registry_test"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      REGISTRY_TEST_DATABASE_URL: postgresql://cellscript_test:cellscript_test_password@127.0.0.1:5432/cellscript_registry_test
    steps:
      - name: Check out tagged source
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: recursive

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: |
            website/package-lock.json
            services/registry-api/package-lock.json
            editors/vscode-cellscript/package-lock.json

      - name: Install Rust release toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.97.1"
          components: rustfmt, clippy, llvm-tools-preview
          targets: riscv64imac-unknown-none-elf, wasm32-unknown-unknown

      - name: Install release gate system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y ripgrep
          rg --version
          docker version

      - name: Configure Git identity for local registry fixtures
        run: |
          git config --global user.name "CellScript CI"
          git config --global user.email "ci@cellscript.dev"

      - name: Check out pinned CKB SDK
        run: |
          git clone --depth 1 --branch "$CKB_SDK_RUST_REF" \
            https://github.com/nervosnetwork/ckb-sdk-rust.git \
            "$GITHUB_WORKSPACE/../ckb-sdk-rust"

      - name: Check out pinned CKB node source
        run: |
          mkdir "$GITHUB_WORKSPACE/../ckb"
          git -C "$GITHUB_WORKSPACE/../ckb" init
          git -C "$GITHUB_WORKSPACE/../ckb" remote add origin https://github.com/nervosnetwork/ckb.git
          git -C "$GITHUB_WORKSPACE/../ckb" fetch --depth 1 origin "$CKB_ACCEPTANCE_REVISION"
          git -C "$GITHUB_WORKSPACE/../ckb" checkout --detach FETCH_HEAD
          test "$(git -C "$GITHUB_WORKSPACE/../ckb" rev-parse HEAD)" = "$CKB_ACCEPTANCE_REVISION"
          test -z "$(git -C "$GITHUB_WORKSPACE/../ckb" status --porcelain --untracked-files=all)"

      - name: Install pinned CKB build toolchain
        run: |
          CKB_TOOLCHAIN="$(sed -n 's/^channel = "\(.*\)"$/\1/p' ../ckb/rust-toolchain.toml | head -n 1)"
          test -n "$CKB_TOOLCHAIN"
          rustup toolchain install "$CKB_TOOLCHAIN" --profile minimal

      - name: Resolve release version
        id: version
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            VERSION="${{ github.event.inputs.version }}"
          fi
          printf 'version=%s\n' "$VERSION" >> "$GITHUB_OUTPUT"

      - name: Run authoritative release gate
        if: steps.version.outputs.version != '0.31.0'
        env:
          CELLSCRIPT_RELEASE_REQUIRE_TAG: "1"
          CELLSCRIPT_RELEASE_VERSION: ${{ steps.version.outputs.version }}
          CKB_REPO: ${{ github.workspace }}/../ckb
        run: ./scripts/cellscript_gate.sh release

      - name: Record the maintainer-authorized 0.31 publication exception
        if: steps.version.outputs.version == '0.31.0'
        run: |
          # The maintainer explicitly authorized publication without the pending
          # review/evidence requirements on 2026-10-01. This exception is limited
          # to the already validated 0.31 candidate and does not mark a gate passed.
          BASE=6c111a30a9a9ddfb50dadbd12b8f2572647a7563
          git merge-base --is-ancestor "$BASE" HEAD
          git diff --exit-code "$BASE" HEAD -- src crates contracts services \
            examples scripts tests proposals Cargo.toml Cargo.lock rust-toolchain.toml
          test "$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n 1)" = '0.31.0'
          cat >> "$GITHUB_STEP_SUMMARY" <<'EOF'
          ## 0.31 publication exception

          The maintainer authorized direct publication on 2026-10-01 without
          completing the pending independent review and release evidence records.
          Native implementation and dependency identities match validated candidate
          `6c111a30`; its local dev, CI and backend gates passed. The full release
          gate is **not claimed to have passed**. No fresh public-testnet deployment
          is claimed. See `docs/releases/CELLSCRIPT_0_31_RELEASE_NOTES.md`.
          EOF

      - name: Upload release evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cellscript-release-gate-evidence
          if-no-files-found: warn
          path: |
            target/ckb-cellscript-acceptance/**
            target/cellscript-backend-shape/*.json
            target/cellscript-schema-manifest/*.json
            target/cellscript-cost/*.json

  build:
    name: Build ${{ matrix.target }}
    needs: release-gate
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-apple-darwin
            os: macos-latest
          - target: aarch64-apple-darwin
            os: macos-latest
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: recursive

      - name: Check out ckb-sdk-rust path dependency
        run: |
          git clone --depth 1 --branch "$CKB_SDK_RUST_REF" \
            https://github.com/nervosnetwork/ckb-sdk-rust.git \
            "$GITHUB_WORKSPACE/../ckb-sdk-rust"
          git -C "$GITHUB_WORKSPACE/../ckb-sdk-rust" rev-parse --short HEAD

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.97.1"
          targets: ${{ matrix.target }}

      - name: Install Linux cross-compilation tools
        if: matrix.target == 'aarch64-unknown-linux-musl'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu musl-tools

      - name: Install Linux x86_64 musl tools
        if: matrix.target == 'x86_64-unknown-linux-musl'
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools

      - name: Build compiler and matching standalone checker
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER: aarch64-linux-gnu-gcc
        run: cargo build --locked --release -p cellscript -p cellscript-artifact-checker --bin cellc --bin cellscript-artifact-checker --target ${{ matrix.target }}

      - name: Package archive
        id: package
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            VERSION="${{ github.event.inputs.version }}"
          fi
          ARCHIVE="cellscript-${VERSION}-${{ matrix.target }}.tar.gz"
          cp "target/${{ matrix.target }}/release/cellc" cellc
          cp "target/${{ matrix.target }}/release/cellscript-artifact-checker" cellscript-artifact-checker
          tar czf "$ARCHIVE" cellc cellscript-artifact-checker
          printf 'archive=%s\n' "$ARCHIVE" >> "$GITHUB_OUTPUT"
          printf 'version=%s\n' "$VERSION" >> "$GITHUB_OUTPUT"

      - name: Compute SHA256
        run: |
          sha256sum "${{ steps.package.outputs.archive }}" > SHA256SUMS.${{ matrix.target }}

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: cellscript-${{ matrix.target }}
          path: |
            *.tar.gz
            SHA256SUMS.*

  release:
    name: Create GitHub Release
    needs: [release-gate, build]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Check out repository
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: false

      - name: Merge SHA256SUMS
        run: |
          cat artifacts/*/SHA256SUMS.* > SHA256SUMS
          # Normalize filenames: strip per-target suffix
          sed -i 's/SHA256SUMS\.[a-z0-9_-]*  /  /' SHA256SUMS

      - name: Determine version
        id: version
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            VERSION="${{ github.event.inputs.version }}"
          fi
          printf 'version=%s\n' "$VERSION" >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ steps.version.outputs.version }}
          name: CellScript ${{ steps.version.outputs.version }}
          draft: false
          prerelease: ${{ contains(steps.version.outputs.version, '-') }}
          generate_release_notes: true
          files: |
            scripts/install.sh
            artifacts/**/*.tar.gz
            SHA256SUMS
          body: |
            ${{ steps.version.outputs.version == '0.31.0' && 'Published by explicit maintainer instruction on 2026-10-01 with the pending independent review and release-evidence requirements waived for this release. Local dev, CI and backend validation passed; the full release gate and a fresh public-testnet deployment are not claimed. See [0.31 release notes](https://github.com/CellScript-Labs/CellScript/blob/v0.31.0/docs/releases/CELLSCRIPT_0_31_RELEASE_NOTES.md).' || '' }}

            ## Installation

            ### One-line install (Global)

            ```bash
            curl -fsSL https://github.com/${{ github.repository }}/releases/download/v${{ steps.version.outputs.version }}/install.sh | sh
            ```

            ### One-line install (China mainland)

            If GitHub downloads are unreachable, use a GitHub proxy:

            ```bash
            curl -fsSL https://ghgo.xyz/https://github.com/${{ github.repository }}/releases/download/v${{ steps.version.outputs.version }}/install.sh | sh
            ```

            Or force a specific mirror for binary downloads:

            ```bash
            curl -fsSL https://ghgo.xyz/https://github.com/${{ github.repository }}/releases/download/v${{ steps.version.outputs.version }}/install.sh | CELLSCRIPT_MIRROR=ghgo sh
            ```

            Available mirrors: `ghgo` (ghgo.xyz), `ghproxy` (gh-proxy.com), `ghfast` (ghfast.top)

            ### Install specific version

            ```bash
            curl -fsSL https://github.com/${{ github.repository }}/releases/download/v${{ steps.version.outputs.version }}/install.sh | CELLSCRIPT_VERSION=${{ steps.version.outputs.version }} sh
            ```

            ---

            ## Manual download

            | Platform | Archive |
            |----------|---------|
            | macOS (Apple Silicon) | `cellscript-${{ steps.version.outputs.version }}-aarch64-apple-darwin.tar.gz` |
            | macOS (Intel) | `cellscript-${{ steps.version.outputs.version }}-x86_64-apple-darwin.tar.gz` |
            | Linux (x86_64) | `cellscript-${{ steps.version.outputs.version }}-x86_64-unknown-linux-musl.tar.gz` |
            | Linux (ARM64) | `cellscript-${{ steps.version.outputs.version }}-aarch64-unknown-linux-musl.tar.gz` |

            Unpack and add to PATH:
            ```bash
            tar xzf cellscript-*.tar.gz
            mkdir -p ~/.cellscript/bin && mv cellc ~/.cellscript/bin/
            export PATH="$HOME/.cellscript/bin:$PATH"
            ```

            Verify: `cellc --version`

            Each archive also includes the matching `cellscript-artifact-checker`
            executable for independent artifact verification.

            ---

            ## Environment variables

            | Variable | Default | Description |
            |----------|---------|-------------|
            | `CELLSCRIPT_HOME` | `~/.cellscript` | Installation directory |
            | `CELLSCRIPT_VERSION` | latest | Install a specific version |
            | `CELLSCRIPT_MIRROR` | `auto` | Mirror: `auto`, `direct`, `ghgo`, `ghproxy`, `ghfast` |
            | `CELLSCRIPT_DRY_RUN` | `0` | Set to `1` to preview without installing |