release.yml

name: release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  quality-preflight:
    name: quality preflight
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: false

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm

      - name: Install repo utilities
        run: |
          if ! command -v rg >/dev/null 2>&1; then
            sudo apt-get update
            sudo apt-get install -y ripgrep
          fi

      - name: Install
        run: npm ci

      - name: Drawlist codegen guardrail
        run: npm run codegen:check

      - name: Lint
        run: npm run lint

      - name: Typecheck
        run: npm run typecheck

      - name: Build
        run: npm run build

      - name: Tests
        run: npm run test

      - name: Full TS project graph
        run: npm run typecheck:ci

      - name: Strict publishable source TS pass
        run: npm run typecheck:strict

      - name: Check core portability
        run: npm run check:core-portability

      - name: Check native vendor integrity
        run: npm run check:native-vendor

      - name: Check Unicode pins (submodule sync)
        run: npm run check:unicode

      - name: Repo guardrails
        run: npm run quality:guardrails

      - name: Dependency graph guardrail
        run: npm run quality:deps

      - name: API surface guardrail
        run: npm run quality:api

      - name: Dead code advisory
        id: quality_deadcode
        continue-on-error: true
        run: npm run quality:deadcode

      - name: Dead code advisory summary
        if: ${{ steps.quality_deadcode.outcome != 'success' }}
        run: echo "::warning::Knip remains advisory in release preflight. Review the dead-code report separately from the blocking publish gates."

  template-smoke:
    name: create-rezi smoke
    needs: [quality-preflight]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: false

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm

      - name: Install
        run: npm ci

      - name: Build
        run: npm run build

      - name: Smoke scaffolded templates
        run: npm run smoke:create-rezi-templates

  release-ci:
    name: node ${{ matrix.node-version }} / ${{ matrix.os }}
    needs: [quality-preflight]
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: ["ubuntu-latest", "macos-latest", "windows-latest"]
        node-version: ["18", "20", "22"]

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: false

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm

      - name: Install
        run: npm ci

      - name: Build
        run: npm run build

      - name: Tests
        run: npm run test

      - name: Repro replay fixtures (headless, explicit gate)
        if: runner.os == 'Linux'
        run: |
          CONCURRENCY=$(node -p "parseInt(process.versions.node)>=19?'--test-concurrency=1':''")
          # shellcheck disable=SC2086 -- empty expansion intentionally omits the extra flag
          node --test $CONCURRENCY packages/core/dist/repro/__tests__/replay.harness.test.js

      - name: Setup Rust (stable)
        uses: dtolnay/rust-toolchain@stable

      - name: Build native addon
        run: npm run build:native

      - name: Terminal e2e (Linux full)
        if: runner.os == 'Linux'
        run: npm run test:e2e

      - name: Terminal e2e (Linux reduced)
        if: runner.os == 'Linux'
        run: npm run test:e2e:reduced

      - name: Terminal e2e equivalent (non-Linux reduced)
        if: runner.os != 'Linux'
        run: npm run test:e2e:reduced

      - name: Native smoke + worker integration (Unix PTY)
        if: runner.os != 'Windows'
        run: |
          python3 - <<'PY'
          import os
          import pty
          import sys

          status = pty.spawn(["bash", "-lc", "npm run test:native:smoke"])
          if os.WIFEXITED(status):
              sys.exit(os.WEXITSTATUS(status))
          if os.WIFSIGNALED(status):
              sys.exit(128 + os.WTERMSIG(status))
          sys.exit(1)
          PY

      - name: Native smoke + worker integration (Windows)
        if: runner.os == 'Windows'
        run: npm run test:native:smoke

  bun:
    name: bun / ubuntu-latest
    needs: [quality-preflight]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: false

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.9"

      - name: Install
        run: bun install

      - name: Build
        run: bun run build

      - name: Tests
        run: bun run test

      - name: Terminal e2e (reduced)
        run: bun run test:e2e:reduced

  create-release:
    name: create release
    runs-on: ubuntu-latest
    needs: [quality-preflight, template-smoke, release-ci, bun]
    steps:
      - uses: actions/checkout@v4
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true

  native-prebuild:
    name: native prebuild (${{ matrix.id }})
    needs: create-release
    runs-on: ${{ matrix.runsOn }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - id: linux-x64-gnu
            runsOn: ubuntu-latest
            rustTarget: x86_64-unknown-linux-gnu
            nodeFile: rezi_ui_native.linux-x64-gnu.node
            runSmoke: true
          - id: darwin-x64
            runsOn: macos-latest
            rustTarget: x86_64-apple-darwin
            nodeFile: rezi_ui_native.darwin-x64.node
            runSmoke: false
          - id: darwin-arm64
            runsOn: macos-latest
            rustTarget: aarch64-apple-darwin
            nodeFile: rezi_ui_native.darwin-arm64.node
            runSmoke: true
          - id: win32-x64-msvc
            runsOn: windows-latest
            rustTarget: x86_64-pc-windows-msvc
            nodeFile: rezi_ui_native.win32-x64-msvc.node
            runSmoke: true
          - id: win32-arm64-msvc
            runsOn: windows-latest
            rustTarget: aarch64-pc-windows-msvc
            nodeFile: rezi_ui_native.win32-arm64-msvc.node
            runSmoke: false
            msvcArch: amd64_arm64

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm

      - name: Install
        run: npm ci

      - name: Setup Rust (stable)
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rustTarget }}

      - name: Setup MSVC (cross)
        if: runner.os == 'Windows' && matrix.id == 'win32-arm64-msvc'
        uses: ilammy/msvc-dev-cmd@v1
        with:
          arch: ${{ matrix.msvcArch }}

      - name: Build prebuild
        run: npx napi build --platform --release --target "${{ matrix.rustTarget }}" --js false
        working-directory: packages/native

      - name: Smoke test (host)
        if: matrix.runSmoke
        run: npm -w @rezi-ui/native run test:native:smoke

      - name: Upload prebuild
        uses: actions/upload-artifact@v4
        with:
          name: native-prebuild-${{ matrix.id }}
          if-no-files-found: error
          path: packages/native/${{ matrix.nodeFile }}

  linux-arm64-gnu:
    name: native prebuild (linux-arm64-gnu)
    needs: create-release
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64

      - name: Build + smoke (docker, linux/arm64 glibc)
        run: |
          docker run --rm --platform linux/arm64 \
            -v "$PWD:/w" -w /w \
            node:22-bullseye bash -lc '
              set -euo pipefail
              apt-get update
              apt-get install -y curl build-essential git
              curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
              . "$HOME/.cargo/env"
              npm ci
              (cd packages/native && npx napi build --platform --release --target aarch64-unknown-linux-gnu --js false)
              npm -w @rezi-ui/native run test:native:smoke
            '

      - name: Upload prebuild
        uses: actions/upload-artifact@v4
        with:
          name: native-prebuild-linux-arm64-gnu
          if-no-files-found: error
          path: packages/native/rezi_ui_native.linux-arm64-gnu.node

  publish:
    name: publish (npm)
    runs-on: ubuntu-latest
    needs:
      - native-prebuild
      - linux-arm64-gnu
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Extract version from tag
        id: version
        run: |
          TAG="${GITHUB_REF#refs/tags/v}"
          echo "value=$TAG" >> "$GITHUB_OUTPUT"
          echo "Publishing version: $TAG"

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          registry-url: https://registry.npmjs.org

      - name: Install
        run: npm ci

      - name: Sync package versions to tag
        run: node scripts/release-set-version.mjs "${{ steps.version.outputs.value }}"

      - name: Build TypeScript
        run: npm run build

      - name: Download native prebuilds
        uses: actions/download-artifact@v4
        with:
          path: .artifacts/native-prebuilds
          merge-multiple: true

      - name: Assemble binaries into packages/native
        run: |
          rm -f packages/native/*.node
          cp .artifacts/native-prebuilds/*.node packages/native/
          ls -la packages/native/*.node

      - name: Verify npm pack contents + install smoke
        run: node scripts/verify-native-pack.mjs

      # Publish in dependency order. Separate steps so a single failure
      # doesn't block the rest and each package gets its own status in the UI.
      - name: Publish @rezi-ui/core
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish -w @rezi-ui/core --access public

      - name: Publish @rezi-ui/native
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish -w @rezi-ui/native --access public

      - name: Publish @rezi-ui/testkit
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish -w @rezi-ui/testkit --access public

      - name: Publish @rezi-ui/node
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish -w @rezi-ui/node --access public

      - name: Publish @rezi-ui/jsx
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish -w @rezi-ui/jsx --access public

      - name: Publish @rezi-ui/ink-compat
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish ./packages/ink-compat --access public

      - name: Publish ink-gradient-shim
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish ./packages/ink-gradient-shim --access public

      - name: Publish ink-spinner-shim
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish ./packages/ink-spinner-shim --access public

      - name: Publish @rezi-ui/ink-gradient-shim
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish ./packages/rezi-ink-gradient-shim --access public

      - name: Publish @rezi-ui/ink-spinner-shim
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish ./packages/rezi-ink-spinner-shim --access public

      - name: Publish create-rezi
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish -w create-rezi --access public