release.yml

name: release

on:
  push:
    tags: ["v*"]

permissions:
  contents: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - { target: aarch64-apple-darwin, os: macos-latest, name: darwin-arm64 }
          - { target: x86_64-apple-darwin, os: macos-15-intel, name: darwin-x64 }
          - { target: x86_64-unknown-linux-gnu, os: ubuntu-latest, name: linux-x64 }
          - { target: aarch64-unknown-linux-gnu, os: ubuntu-24.04-arm, name: linux-arm64 }
          - { target: x86_64-pc-windows-msvc, os: windows-latest, name: windows-x64 }
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - run: cargo build --release --locked --bin splitfire-agent --target ${{ matrix.target }}
      # The exe must not import the VC++ runtime DLLs (see .cargo/config.toml), or it fails to
      # load on a machine without the redistributable.
      - name: Check static CRT
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: ./packaging/windows/check-static-crt.ps1 -Path target/${{ matrix.target }}/release/splitfire-agent.exe
      - name: Package archive
        shell: bash
        run: |
          ARCHIVE=splitfire-agent-${{ matrix.name }}
          if [ "${{ matrix.os }}" = "windows-latest" ]; then
            # exe at the zip root, matching RelativeFilePath in the winget manifest
            (cd "target/${{ matrix.target }}/release" && 7z a "$GITHUB_WORKSPACE/$ARCHIVE.zip" splitfire-agent.exe)
            echo "asset=$ARCHIVE.zip" >> "$GITHUB_ENV"
          else
            tar -czf "$ARCHIVE.tar.gz" -C "target/${{ matrix.target }}/release" splitfire-agent
            echo "asset=$ARCHIVE.tar.gz" >> "$GITHUB_ENV"
          fi
      - name: Upload release asset
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Create the release once (first matrix job wins; others no-op).
          # Tolerate only the already-exists race: a genuinely failed create
          # makes `gh release view` fail too, so the step still fails loudly.
          gh release create "$GITHUB_REF_NAME" --verify-tag --generate-notes \
            || gh release view "$GITHUB_REF_NAME" >/dev/null
          gh release upload "$GITHUB_REF_NAME" "$asset" --clobber

  checksums:
    name: Publish checksums.txt
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Download all release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mkdir -p artifacts
          gh release download "$GITHUB_REF_NAME" \
            --repo "$GITHUB_REPOSITORY" \
            --pattern "splitfire-agent-*" \
            --dir artifacts/

      - name: Generate checksums.txt
        run: |
          cd artifacts
          sha256sum splitfire-agent-* > checksums.txt
          cat checksums.txt

      - name: Upload checksums.txt
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "$GITHUB_REF_NAME" \
            --repo "$GITHUB_REPOSITORY" \
            artifacts/checksums.txt --clobber