release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing tag to release (e.g. v0.1.0)"
        required: true
        type: string

concurrency:
  group: release-${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name }}-${{ inputs.tag || 'none' }}
  cancel-in-progress: false

jobs:
  meta:
    name: Resolve tag + validate
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      tag: ${{ steps.tag.outputs.tag }}
      version: ${{ steps.version.outputs.version }}
    steps:
      - name: Resolve tag
        id: tag
        shell: bash
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
          else
            echo "tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
          ref: ${{ steps.tag.outputs.tag }}

      - name: Validate tag matches Cargo.toml version
        id: version
        shell: bash
        env:
          TAG: ${{ steps.tag.outputs.tag }}
        run: |
          VERSION="$(python3 scripts/release/validate_tag.py --tag "$TAG")"
          echo "Validated tag $TAG for Cargo.toml version $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

  verify:
    name: Verify (${{ matrix.os }})
    needs: meta
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ needs.meta.outputs.tag }}

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
        with:
          toolchain: 1.88.0
          components: rustfmt, clippy

      - name: Rust cache
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2

      - name: Setup Go
        if: ${{ matrix.os == 'ubuntu-latest' }}
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version: "1.22.x"

      - name: Setup Node
        if: ${{ matrix.os == 'ubuntu-latest' }}
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: "20.x"

      - name: Setup uv
        if: ${{ matrix.os == 'ubuntu-latest' }}
        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3

      - name: Install core check tooling (Linux)
        if: ${{ matrix.os == 'ubuntu-latest' }}
        env:
          UV_CACHE_DIR: ${{ github.workspace }}/.uv-cache
          UV_TOOL_DIR: ${{ github.workspace }}/.uv-tools
        run: make install-tools-core

      - name: Run core checks (Linux)
        if: ${{ matrix.os == 'ubuntu-latest' }}
        env:
          UV_CACHE_DIR: ${{ github.workspace }}/.uv-cache
          UV_TOOL_DIR: ${{ github.workspace }}/.uv-tools
        run: make check-core

      - name: Run Rust checks (macOS)
        if: ${{ matrix.os == 'macos-latest' }}
        run: make check-rust

  publish-crates:
    name: Publish to crates.io
    needs: [meta, verify]
    runs-on: ubuntu-latest
    environment: crates-io
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ needs.meta.outputs.tag }}

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
        with:
          toolchain: 1.88.0

      - name: Rust cache
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2

      - name: Authenticate with crates.io (trusted publishing)
        id: crates-auth
        uses: rust-lang/crates-io-auth-action@b7e9a28eded4986ec6b1fa40eeee8f8f165559ec # v1

      - name: Verify publish payload (dry run)
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates-auth.outputs.token }}
        run: ./scripts/release/publish_crate.sh --dry-run

      - name: Publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates-auth.outputs.token }}
        run: ./scripts/release/publish_crate.sh

  github-release:
    name: Create GitHub Release
    needs: [meta, verify]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
          ref: ${{ needs.meta.outputs.tag }}

      - name: Generate release notes (git-cliff)
        id: git-cliff
        uses: orhun/git-cliff-action@e16f179f0be49ecdfe63753837f20b9531642772 # v4
        with:
          config: git-cliff.toml
          args: -vv --latest --strip header
        env:
          OUTPUT: RELEASE_NOTES.md
          GITHUB_REPO: ${{ github.repository }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create GitHub Release
        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
        with:
          tag_name: ${{ needs.meta.outputs.tag }}
          name: ${{ needs.meta.outputs.tag }}
          body: ${{ steps.git-cliff.outputs.content }}

  dispatch-homebrew-tap-pr:
    name: Dispatch Homebrew Tap PR workflow
    needs: [meta, github-release]
    runs-on: ubuntu-latest
    continue-on-error: true
    permissions:
      actions: write
      contents: read
    steps:
      - name: Dispatch Homebrew Tap PR workflow
        id: dispatch
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const tag = '${{ needs.meta.outputs.tag }}';
            const workflowId = 'homebrew-tap-pr.yml';
            const ref = context.payload.repository.default_branch;
            const { owner, repo } = context.repo;

            core.info(`Dispatching ${workflowId} for tag ${tag} on ref ${ref}`);

            try {
              await github.rest.actions.createWorkflowDispatch({
                owner,
                repo,
                workflow_id: workflowId,
                ref,
                inputs: { tag },
              });
              core.info(`Dispatched ${workflowId} with tag=${tag}`);
            } catch (error) {
              core.error(
                `Failed to dispatch ${workflowId} for tag ${tag}: ${error.message}`
              );
              core.error(
                `Manual fallback: gh workflow run ${workflowId} -R ${owner}/${repo} -f tag=${tag}`
              );
              core.error(
                "See RELEASING.md -> Homebrew tap sync flow (example) for dispatch fallback guidance."
              );
              core.setFailed(error.message);
            }

      - name: Dispatch fallback guidance
        if: ${{ failure() }}
        run: |
          echo "::warning::Homebrew tap workflow dispatch failed. Crate release remains non-blocking."
          echo "::warning::Manual fallback: gh workflow run homebrew-tap-pr.yml -R ${{ github.repository }} -f tag=${{ needs.meta.outputs.tag }}"
          echo "::warning::See RELEASING.md -> Homebrew tap sync flow (example)."

  build:
    name: Build & Upload Binaries
    needs: [meta, github-release]
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
          - windows-latest
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ needs.meta.outputs.tag }}

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
        with:
          toolchain: 1.88.0

      - name: Rust cache
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2

      - name: Build
        run: cargo build --release --locked

      - name: Package (Unix)
        if: runner.os != 'Windows'
        shell: bash
        run: |
          BIN="envgen"
          ASSET="envgen-${{ needs.meta.outputs.tag }}-${{ runner.os }}-${{ runner.arch }}.tar.gz"
          tar -czf "$ASSET" -C target/release "$BIN"
          echo "ASSET=$ASSET" >> "$GITHUB_ENV"
          echo "ASSET_PATH=$ASSET" >> "$GITHUB_ENV"

      - name: Package (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $bin = "envgen.exe"
          $asset = "envgen-${{ needs.meta.outputs.tag }}-${{ runner.os }}-${{ runner.arch }}.zip"
          Compress-Archive -Path "target/release/$bin" -DestinationPath $asset -Force
          "ASSET=$asset" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
          "ASSET_PATH=$asset" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      - name: Upload release asset
        uses: svenstaro/upload-release-action@6b7fa9f267e90b50a19fef07b3596790bb941741 # v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          tag: ${{ needs.meta.outputs.tag }}
          file: ${{ env.ASSET_PATH }}
          asset_name: ${{ env.ASSET }}
          overwrite: true

  homebrew-core:
    name: Open homebrew-core bump PR
    needs: [meta, verify, publish-crates]
    runs-on: macos-latest
    permissions:
      contents: read
    env:
      HOMEBREW_GITHUB_API_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
    steps:
      - name: Brew update
        if: ${{ env.HOMEBREW_GITHUB_API_TOKEN != '' }}
        run: brew update

      - name: Check formula exists
        id: formula
        shell: bash
        if: ${{ env.HOMEBREW_GITHUB_API_TOKEN != '' }}
        run: |
          if brew info envgen >/dev/null 2>&1; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Bump formula PR
        if: ${{ env.HOMEBREW_GITHUB_API_TOKEN != '' && steps.formula.outputs.exists == 'true' }}
        run: |
          brew bump-formula-pr \
            --tag "${{ needs.meta.outputs.tag }}" \
            --version "${{ needs.meta.outputs.version }}" \
            --no-browse \
            --no-audit \
            envgen