release-github.yml

name: GitHub Release

# Dispatched by release-crates.yml once the crate publish succeeds.
on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g. v0.4.0)"
        required: true

permissions:
  contents: write
  actions: write

env:
  PROJECT_NAME: onde
  CARGO_TERM_COLOR: always
  ONDE_APP_ID: ${{ secrets.ONDE_APP_ID }}
  ONDE_APP_SECRET: ${{ secrets.ONDE_APP_SECRET }}
  GRESIQ_API_KEY: ${{ secrets.GRESIQ_API_KEY }}
  GRESIQ_API_SECRET: ${{ secrets.GRESIQ_API_SECRET }}
  HF_TOKEN: ${{ secrets.HF_TOKEN }}

jobs:
  build:
    name: Build binary (${{ matrix.name }})
    runs-on: ${{ matrix.runner }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux-amd64
            runner: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - name: linux-arm64
            runner: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
          - name: win-amd64
            runner: windows-latest
            target: x86_64-pc-windows-msvc
          - name: win-arm64
            runner: windows-latest
            target: aarch64-pc-windows-msvc
          - name: macos-amd64
            runner: macos-26-intel
            target: x86_64-apple-darwin
          - name: macos-arm64
            runner: macos-26
            target: aarch64-apple-darwin

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.inputs.tag || github.ref }}

      - name: Set the release version
        shell: bash
        run: |
          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            release_version="${GITHUB_REF_NAME#v}"
          else
            release_version="${{ github.event.inputs.tag }}"
            release_version="${release_version#v}"
          fi
          echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV"

      - name: Read Rust toolchain
        shell: bash
        run: |
          rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)"
          if [ -z "$rust_toolchain" ]; then
            echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2
            exit 1
          fi
          echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV"

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          targets: ${{ matrix.target }}

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          key: github-${{ matrix.target }}

      - name: Build binary
        shell: bash
        run: cargo build --locked --release --target ${{ matrix.target }}

      # The exe must not import the VC++ runtime DLLs (see .cargo/config.toml), or it fails to
      # load on a machine without the redistributable. Hostx64 dumpbin reads arm64 PE files too.
      - name: Check static CRT
        if: matrix.runner == 'windows-latest'
        shell: pwsh
        run: ./packaging/windows/check-static-crt.ps1 -Path target/${{ matrix.target }}/release/onde.exe

      - name: Package binary
        shell: bash
        run: |
          BIN_SUFFIX=""
          if [[ "${{ matrix.runner }}" == "windows-latest" ]]; then
            BIN_SUFFIX=".exe"
          fi

          BIN_OUTPUT="target/${{ matrix.target }}/release/${PROJECT_NAME}${BIN_SUFFIX}"
          BIN_RELEASE="${PROJECT_NAME}-${{ matrix.name }}${BIN_SUFFIX}"

          mkdir -p ./release
          mv "${BIN_OUTPUT}" "./release/${BIN_RELEASE}"

      - name: Package macOS tarball for Homebrew
        if: contains(matrix.target, 'apple-darwin')
        shell: bash
        run: |
          ARCHIVE_NAME="${PROJECT_NAME}-${{ matrix.name }}.tar.gz"

          mkdir -p staging-brew
          cp "./release/${PROJECT_NAME}-${{ matrix.name }}" "staging-brew/${PROJECT_NAME}"
          strip "staging-brew/${PROJECT_NAME}"

          tar -C staging-brew -czf "${ARCHIVE_NAME}" "${PROJECT_NAME}"

          shasum -a 256 "${ARCHIVE_NAME}" | awk '{print $1}' > "${ARCHIVE_NAME}.sha256"

          echo "Archive: ${ARCHIVE_NAME}"
          echo "SHA256:  $(cat "${ARCHIVE_NAME}.sha256")"

      # Scoop and winget consume the raw Windows binaries rather than a
      # tarball, and both need a SHA256 sidecar. Windows runners use bash from
      # Git for Windows, which has sha256sum; macOS only has shasum.
      - name: Checksum release assets
        shell: bash
        run: |
          cd release
          for asset in *; do
            case "${asset}" in *.sha256) continue ;; esac

            if command -v sha256sum >/dev/null 2>&1; then
              sha256sum "${asset}" | awk '{print $1}' > "${asset}.sha256"
            else
              shasum -a 256 "${asset}" | awk '{print $1}' > "${asset}.sha256"
            fi

            echo "${asset}: $(cat "${asset}.sha256")"
          done

      - name: Upload binary artifact
        uses: actions/upload-artifact@v4
        with:
          name: binary-${{ matrix.name }}
          path: release/*

      - name: Upload macOS Homebrew artifacts
        if: contains(matrix.target, 'apple-darwin')
        uses: actions/upload-artifact@v4
        with:
          name: homebrew-${{ matrix.name }}
          path: |
            ${{ env.PROJECT_NAME }}-${{ matrix.name }}.tar.gz
            ${{ env.PROJECT_NAME }}-${{ matrix.name }}.tar.gz.sha256

  release:
    name: Create GitHub Release
    needs: build
    runs-on: ubuntu-latest
    if: github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'

    steps:
      - name: Resolve tag
        id: tag
        shell: bash
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            echo "tag=${{ github.event.inputs.tag }}" >> "$GITHUB_OUTPUT"
          else
            echo "tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Download binary artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: "binary-*"
          path: release
          merge-multiple: true

      - name: Download Homebrew artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: "homebrew-*"
          path: release
          merge-multiple: true

      - name: Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.tag.outputs.tag }}
          files: release/*

      - name: Trigger Homebrew release
        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.actions.createWorkflowDispatch({
              owner: context.repo.owner,
              repo: context.repo.repo,
              workflow_id: 'release-homebrew.yml',
              ref: '${{ steps.tag.outputs.tag }}',
              inputs: {
                tag: '${{ steps.tag.outputs.tag }}'
              }
            })
            console.log('Dispatched release-homebrew.yml for tag ${{ steps.tag.outputs.tag }}')

      - name: Trigger pub.dev release
        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.actions.createWorkflowDispatch({
              owner: context.repo.owner,
              repo: context.repo.repo,
              workflow_id: 'release-pub.yml',
              ref: '${{ steps.tag.outputs.tag }}',
              inputs: {
                tag: '${{ steps.tag.outputs.tag }}'
              }
            })
            console.log('Dispatched release-pub.yml for tag ${{ steps.tag.outputs.tag }}')

      # These channels publish outside this repo (a Scoop bucket,
      # microsoft/winget-pkgs) and read checksums off the release created
      # above, so they hang off this job rather than firing on the tag
      # directly.
      - name: Trigger OS package manager releases
        uses: actions/github-script@v7
        with:
          script: |
            const tag = '${{ steps.tag.outputs.tag }}'
            const workflows = [
              'release-scoop.yml',
              'release-winget.yml',
            ]

            for (const workflow_id of workflows) {
              try {
                await github.rest.actions.createWorkflowDispatch({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  workflow_id,
                  ref: tag,
                  inputs: { tag },
                })
                console.log(`Dispatched ${workflow_id} for tag ${tag}`)
              } catch (error) {
                // One packaging channel being unconfigured (a missing secret,
                // a bucket repo that does not exist yet) should not take the
                // rest of the fan-out down with it.
                core.warning(`Failed to dispatch ${workflow_id}: ${error.message}`)
              }
            }