release.yml

name: Release

on:
  push:
    tags:
      - "v*"

env:
  CARGO_TERM_COLOR: always

permissions:
  contents: write
  packages: write

jobs:
  build-binaries:
    name: Build (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            archive: tar.gz
            use_cross: false
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            archive: tar.gz
            use_cross: true
          - os: macos-latest
            target: x86_64-apple-darwin
            archive: tar.gz
            use_cross: false
          - os: macos-latest
            target: aarch64-apple-darwin
            archive: tar.gz
            use_cross: false
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            archive: zip
            use_cross: false
          # aarch64-pc-windows-msvc removed: cross-compilation from Linux
          # fails for crypto crates (ring, aws-lc-sys) that require
          # Windows ARM64 SDK headers unavailable in cross containers.
          # Re-enable when GitHub provides hosted Windows ARM64 runners.
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
        with:
          cache-targets: "false"
      - uses: mozilla-actions/sccache-action@v0.0.9
      - uses: taiki-e/install-action@cross
      - name: Build binary (cross)
        if: matrix.use_cross
        run: cross build --release --target ${{ matrix.target }}
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
      - name: Build binary (native)
        if: "!matrix.use_cross"
        run: cargo build --release --target ${{ matrix.target }}
        env:
          RUSTC_WRAPPER: sccache
          SCCACHE_GHA_ENABLED: "true"
      - name: Strip binary (Unix)
        if: "!matrix.use_cross && runner.os != 'Windows'"
        run: strip target/${{ matrix.target }}/release/zeph
      - name: Create archive (tar.gz)
        if: matrix.archive == 'tar.gz'
        run: |
          cd target/${{ matrix.target }}/release
          tar czf ../../../zeph-${{ matrix.target }}.tar.gz zeph
          cd ../../..
          shasum -a 256 zeph-${{ matrix.target }}.tar.gz > zeph-${{ matrix.target }}.tar.gz.sha256
      - name: Create archive (zip)
        if: matrix.archive == 'zip'
        shell: bash
        run: |
          cd target/${{ matrix.target }}/release
          if [ -f zeph.exe ]; then
            7z a ../../../zeph-${{ matrix.target }}.zip zeph.exe
          else
            7z a ../../../zeph-${{ matrix.target }}.zip zeph
          fi
          cd ../../..
          if command -v shasum &> /dev/null; then
            shasum -a 256 zeph-${{ matrix.target }}.zip > zeph-${{ matrix.target }}.zip.sha256
          else
            sha256sum zeph-${{ matrix.target }}.zip > zeph-${{ matrix.target }}.zip.sha256
          fi
      - name: Upload archive
        uses: actions/upload-artifact@v6
        with:
          name: binary-${{ matrix.target }}
          path: |
            zeph-${{ matrix.target }}.tar.gz
            zeph-${{ matrix.target }}.tar.gz.sha256
            zeph-${{ matrix.target }}.zip
            zeph-${{ matrix.target }}.zip.sha256
          retention-days: 3

  create-release:
    name: Create GitHub Release
    needs: [build-binaries]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Verify version matches tag
        run: |
          TAG_VERSION="${GITHUB_REF#refs/tags/v}"
          CARGO_VERSION=$(grep '^version' Cargo.toml | grep -m1 'version' | sed 's/.*version = "\(.*\)".*/\1/')
          if [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
            echo "Tag version ($TAG_VERSION) does not match Cargo.toml version ($CARGO_VERSION)"
            exit 1
          fi
      - name: Download all artifacts
        uses: actions/download-artifact@v7
        with:
          path: artifacts
      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: |
            artifacts/**/*.tar.gz
            artifacts/**/*.zip
            artifacts/**/*.sha256

  docker-publish:
    name: Publish Docker Image
    needs: [build-binaries]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6
      - name: Download Linux binaries
        uses: actions/download-artifact@v7
        with:
          pattern: binary-*-unknown-linux-gnu
          path: artifacts
      - name: Extract and prepare binaries
        run: |
          mkdir -p binaries
          tar -xzf artifacts/binary-x86_64-unknown-linux-gnu/zeph-x86_64-unknown-linux-gnu.tar.gz -C binaries
          mv binaries/zeph binaries/zeph-amd64
          tar -xzf artifacts/binary-aarch64-unknown-linux-gnu/zeph-aarch64-unknown-linux-gnu.tar.gz -C binaries
          mv binaries/zeph binaries/zeph-arm64
          chmod +x binaries/zeph-*
          ls -lh binaries/
      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable={{is_default_branch}}
      - uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max