release.yml

# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# Consolidated workflow (behaviour-preserving merge).
# Merged from: container.yml, release.yml
name: Release & Container

on:
  # Was `push: null`, which fires on EVERY branch push. The release
  # pipeline then ran on feature branches, where `${GITHUB_REF#refs/tags/v}`
  # cannot strip its prefix and returns the ref VERBATIM -- so the archive
  # name became `hypatia-refs/heads/<branch>-<target>.tar.gz`, whose
  # embedded slashes are directories that do not exist, and tar died with
  # `Cannot write: Broken pipe` on all five targets. Releases are cut from
  # tags, so the trigger now says so.
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: "Release version (overrides tag)"
        type: string
        required: false
      dry_run:
        description: "Build only; do not push images or publish the release"
        type: boolean
        default: true

permissions: read-all

# Restored after #258 ("consolidate 37 workflows → 23") dropped it: the merge
# moved the container jobs out of container.yml into this file, but env: is
# file-scoped and didn't travel with them, leaving env.REGISTRY/env.IMAGE_NAME
# undefined (breaking ghcr login/metadata/push tags + the attest subject-name).
env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  prepare:
    name: Prepare Release
    runs-on: ubuntu-latest
    timeout-minutes: 30
    outputs:
      version: ${{ steps.version.outputs.version }}
      is_prerelease: ${{ steps.version.outputs.is_prerelease }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7.0.1

      - name: Extract version
        id: version
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" && -n "${{ inputs.version }}" ]]; then
            VERSION="${{ inputs.version }}"
          elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then
            VERSION="${GITHUB_REF#refs/tags/v}"
          else
            # `${VAR#prefix}` returns VAR UNCHANGED when the prefix is absent.
            # Relying on it to parse a tag meant a non-tag ref silently became
            # the version string. Fail loudly instead of building a nonsense name.
            echo "::error::Release requires a refs/tags/v* ref or an explicit version input; got '$GITHUB_REF'"
            exit 1
          fi
          echo "version=$VERSION" >> $GITHUB_OUTPUT

          # Check if prerelease
          if [[ "$VERSION" == *"-"* ]]; then
            echo "is_prerelease=true" >> $GITHUB_OUTPUT
          else
            echo "is_prerelease=false" >> $GITHUB_OUTPUT
          fi

          echo "Version: $VERSION"

  # ============================================================================
  # Build Rust Binaries
  # ============================================================================

  build-rust:
    name: Build Rust - ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 60
    needs: [prepare]
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux x86_64
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            artifact: hyper
            archive: tar.gz
          # Linux ARM64 (cross-compiled using cross-rs)
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            artifact: hyper
            archive: tar.gz
            cross: true
          # macOS x86_64
          - target: x86_64-apple-darwin
            os: macos-latest
            artifact: hyper
            archive: tar.gz
          # macOS ARM64
          - target: aarch64-apple-darwin
            os: macos-latest
            artifact: hyper
            archive: tar.gz
          # Windows x86_64
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            artifact: hyper.exe
            archive: zip

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@v1
        with:
          toolchain: stable
          targets: ${{ matrix.target }}

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2.9.2
        with:
          workspaces: ". -> target"
          key: ${{ matrix.target }}

      - name: Install cross for cross-compilation
        if: matrix.cross
        run: |
          cargo install cross --git https://github.com/cross-rs/cross

      - name: Build CLI binary (native)
        if: ${{ !matrix.cross }}
        run: |
          cargo build --release --package hypatia-cli --target ${{ matrix.target }}

      - name: Build adapter binary (native)
        if: ${{ !matrix.cross }}
        run: |
          cargo build --release --package hypatia-adapters --target ${{ matrix.target }}

      - name: Build CLI binary (cross-compiled)
        if: matrix.cross
        run: |
          cross build --release --package hypatia-cli --target ${{ matrix.target }}

      - name: Build adapter binary (cross-compiled)
        if: matrix.cross
        run: |
          cross build --release --package hypatia-adapters --target ${{ matrix.target }}

      - name: Create archive (Unix)
        if: matrix.archive == 'tar.gz'
        run: |
          mkdir -p dist
          cp target/${{ matrix.target }}/release/hyper dist/
          cp target/${{ matrix.target }}/release/forge-adapter dist/ || true
          cp README.adoc LICENSE dist/
          cd dist
          tar -czvf ../hypatia-${{ needs.prepare.outputs.version }}-${{ matrix.target }}.tar.gz *

      - name: Create archive (Windows)
        if: matrix.archive == 'zip'
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path dist
          Copy-Item target/${{ matrix.target }}/release/hyper.exe dist/
          Copy-Item target/${{ matrix.target }}/release/forge-adapter.exe dist/ -ErrorAction SilentlyContinue
          Copy-Item README.adoc,LICENSE dist/
          Compress-Archive -Path dist/* -DestinationPath hypatia-${{ needs.prepare.outputs.version }}-${{ matrix.target }}.zip

      - name: Upload artifact
        uses: actions/upload-artifact@v7.0.2
        with:
          name: hypatia-${{ matrix.target }}
          path: hypatia-${{ needs.prepare.outputs.version }}-${{ matrix.target }}.${{ matrix.archive }}
          retention-days: 7

  # ============================================================================
  # Build Docker Images
  # ============================================================================

  build-docker:
    name: Build Container Images
    runs-on: ubuntu-latest
    timeout-minutes: 60
    needs: [prepare, build-rust]
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    strategy:
      matrix:
        component:
          # Only the CLI image remains. The adapter/registry/engine images were
          # retired: their Containerfiles were deleted (deploy/Containerfile.*),
          # the Haskell `registry/` and Logtalk `engine/` sources removed, and the
          # ghcr registry package archived (see note at end of file). The adapter
          # still ships as the `forge-adapter` binary via build-rust; recover its
          # image with `git show f2fe2df^:deploy/Containerfile.adapter` if wanted.
          - name: cli
            dockerfile: deploy/Containerfile
            context: .

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7.0.1

      - name: Download Rust artifacts
        uses: actions/download-artifact@v8.0.2
        with:
          pattern: hypatia-x86_64-*
          path: artifacts

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4.4.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4.4.1

      - name: Log in to Container Registry
        if: ${{ !inputs.dry_run }}
        uses: docker/login-action@v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v6.2.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-${{ matrix.component.name }}
          tags: |
            type=semver,pattern={{version}},value=${{ needs.prepare.outputs.version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ needs.prepare.outputs.version }}
            type=semver,pattern={{major}},value=${{ needs.prepare.outputs.version }}
            type=raw,value=latest,enable=${{ needs.prepare.outputs.is_prerelease == 'false' }}

      - name: Build and push Docker image
        id: push
        uses: docker/build-push-action@v7.4.0
        with:
          context: ${{ matrix.component.context }}
          file: ${{ matrix.component.dockerfile }}
          platforms: linux/amd64,linux/arm64
          push: ${{ !inputs.dry_run }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=${{ needs.prepare.outputs.version }}

      - name: Attest container provenance
        if: ${{ !inputs.dry_run }}
        uses: actions/attest-build-provenance@v4.2.2
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-${{ matrix.component.name }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true

  # ============================================================================
  # Create GitHub Release
  # ============================================================================

  github-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    timeout-minutes: 60
    needs: [prepare, build-rust, build-docker]
    if: ${{ !inputs.dry_run }}
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7.0.1

      - name: Download all artifacts
        uses: actions/download-artifact@v8.0.2
        with:
          path: artifacts

      - name: Prepare release assets
        run: |
          mkdir -p release-assets
          find artifacts -type f \( -name "*.tar.gz" -o -name "*.zip" \) -exec cp {} release-assets/ \;
          ls -la release-assets/

      - name: Generate release notes
        id: release_notes
        run: |
          cat << 'EOF' > release-notes.md
          ## Hypatia v${{ needs.prepare.outputs.version }}

          ### Components
          - **CLI** (`hyper`): Command-line interface for CI/CD operations
          - **Adapters** (`forge-adapter`): Multi-forge adapters (GitHub, GitLab, Bitbucket) — shipped as a binary in the release archives

          ### Docker Images
          ```bash
          docker pull ghcr.io/${{ github.repository }}-cli:${{ needs.prepare.outputs.version }}
          ```

          ### Installation

          #### Linux (x86_64)
          ```bash
          curl -sSL https://github.com/${{ github.repository }}/releases/download/v${{ needs.prepare.outputs.version }}/hypatia-${{ needs.prepare.outputs.version }}-x86_64-unknown-linux-gnu.tar.gz | tar xz
          sudo mv hyper /usr/local/bin/
          ```

          #### macOS (Apple Silicon)
          ```bash
          curl -sSL https://github.com/${{ github.repository }}/releases/download/v${{ needs.prepare.outputs.version }}/hypatia-${{ needs.prepare.outputs.version }}-aarch64-apple-darwin.tar.gz | tar xz
          sudo mv hyper /usr/local/bin/
          ```

          ### Checksums
          See `checksums.txt` for SHA256 checksums of all release artifacts.
          EOF

      - name: Generate checksums
        run: |
          cd release-assets
          sha256sum * > checksums.txt
          cat checksums.txt

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3.0.3
        with:
          name: Hypatia v${{ needs.prepare.outputs.version }}
          body_path: release-notes.md
          prerelease: ${{ needs.prepare.outputs.is_prerelease == 'true' }}
          files: |
            release-assets/*
          fail_on_unmatched_files: false

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v4.2.2
        with:
          subject-path: 'release-assets/*'


  # NOTE: The adapter/registry/engine container images were retired; this workflow
  # now builds only the CLI image.
  #   - registry (Haskell) + engine (SWI-Prolog/Logtalk): sources deleted (f2fe2df).
  #     Logtalk was an early idea for the rule engine, superseded by the native
  #     Elixir ruleset. The hypatia-registry package on ghcr.io is now archived.
  #   - adapter (Rust): still ships as the `forge-adapter` binary via build-rust;
  #     only its service image was dropped. Recover it if ever wanted again with
  #     `git show f2fe2df^:deploy/Containerfile.adapter`.