release.yml

# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# SPDX-FileCopyrightText: 2025 hyperpolymath

name: Release
on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (e.g., v0.1.0)'
        required: true
permissions: read-all
env:
  CARGO_TERM_COLOR: always
  RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
jobs:
  build-binaries:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            binary: echidnabot
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            binary: echidnabot
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            binary: echidnabot
          - target: x86_64-apple-darwin
            os: macos-latest
            binary: echidnabot
          - target: aarch64-apple-darwin
            os: macos-latest
            binary: echidnabot
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            binary: echidnabot.exe
    steps:
      - uses: actions/checkout@v7.0.1
      - name: Install Rust toolchain
        # `toolchain:` is mandatory when this action is pinned to a SHA — see
        # the note in stress-test.yml. Supplying `targets:` alone does not
        # satisfy it.
        uses: dtolnay/rust-toolchain@v1
        with:
          toolchain: stable
          targets: ${{ matrix.target }}
      - name: Install cross-compilation tools
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu
      - name: Configure aarch64 linker
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
      - name: Install musl tools
        if: matrix.target == 'x86_64-unknown-linux-musl'
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools
      - name: Install OpenSSL (Linux)
        if: runner.os == 'Linux'
        run: sudo apt-get install -y libssl-dev
      - name: Build
        run: cargo build --release --target ${{ matrix.target }}
      - name: Package (Unix)
        if: runner.os != 'Windows'
        run: |
          cd target/${{ matrix.target }}/release
          tar -czvf echidnabot-${{ env.RELEASE_TAG }}-${{ matrix.target }}.tar.gz ${{ matrix.binary }}
          sha256sum echidnabot-${{ env.RELEASE_TAG }}-${{ matrix.target }}.tar.gz > echidnabot-${{ env.RELEASE_TAG }}-${{ matrix.target }}.tar.gz.sha256
      - name: Package (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          cd target/${{ matrix.target }}/release
          Compress-Archive -Path ${{ matrix.binary }} -DestinationPath echidnabot-${{ env.RELEASE_TAG }}-${{ matrix.target }}.zip
          Get-FileHash echidnabot-${{ env.RELEASE_TAG }}-${{ matrix.target }}.zip -Algorithm SHA256 | ForEach-Object { "$($_.Hash.ToLower())  echidnabot-${{ env.RELEASE_TAG }}-${{ matrix.target }}.zip" } | Out-File -FilePath echidnabot-${{ env.RELEASE_TAG }}-${{ matrix.target }}.zip.sha256
      - name: Upload artifact
        uses: actions/upload-artifact@v7.0.2
        with:
          name: echidnabot-${{ matrix.target }}
          path: |
            target/${{ matrix.target }}/release/echidnabot-${{ env.RELEASE_TAG }}-${{ matrix.target }}.*
  build-deb:
    name: Build .deb package
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    needs: build-binaries
    steps:
      - uses: actions/checkout@v7.0.1
      - name: Install cargo-deb
        run: cargo install cargo-deb
      - name: Build .deb
        run: cargo deb
      - name: Upload .deb
        uses: actions/upload-artifact@v7.0.2
        with:
          name: deb-package
          path: target/debian/*.deb
  build-rpm:
    name: Build .rpm package
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    needs: build-binaries
    steps:
      - uses: actions/checkout@v7.0.1
      - name: Install cargo-generate-rpm
        run: cargo install cargo-generate-rpm
      - name: Build binary
        run: cargo build --release
      - name: Strip binary
        run: strip target/release/echidnabot
      - name: Build .rpm
        run: cargo generate-rpm
      - name: Upload .rpm
        uses: actions/upload-artifact@v7.0.2
        with:
          name: rpm-package
          path: target/generate-rpm/*.rpm
  release:
    name: Create Release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [build-binaries, build-deb, build-rpm]
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v7.0.1
      - name: Download all artifacts
        uses: actions/download-artifact@v8.0.2
        with:
          path: artifacts
      - name: Collect release assets
        run: |
          mkdir -p release
          find artifacts -type f \( -name "*.tar.gz" -o -name "*.zip" -o -name "*.sha256" -o -name "*.deb" -o -name "*.rpm" \) -exec cp {} release/ \;
          ls -la release/
      - name: Create Release
        uses: softprops/action-gh-release@v3.0.3
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          files: release/*
          generate_release_notes: true
          draft: false
      - name: Attest build provenance
        uses: actions/attest-build-provenance@v4.2.2
        with:
          subject-path: 'release/*'