cd.yml

name: CD

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: read

# a tagged push builds the release binary for each target on its native host, each
# to its own self-host fixpoint, then publishes the archives + SHA256SUMS.
# correctness is CI's job — every change reaches main through a PR it gates.
#
# the darwin lane (seed cross-build + native fixpoint + self-test) lives in
# darwin-lane.yml, shared with ci.yml's dev -> main release gate; see that file.
#
# workflow_dispatch runs the darwin lane on a branch with no tag, so on-Mac
# validation needs no release; the tag-verify and publish steps are gated to tag
# pushes and stay skipped on dispatch.
jobs:
  verify:
    name: verify tag
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    steps:
      - uses: actions/checkout@v6
      - name: tag matches mach.toml version
        run: |
          set -euo pipefail
          ver="$(sed -n 's/^version = "\(.*\)"$/\1/p' mach.toml | head -1)"
          [ "v$ver" = "$GITHUB_REF_NAME" ] || { echo "::error::tag $GITHUB_REF_NAME != mach.toml version $ver"; exit 1; }

  build-linux:
    name: build ${{ matrix.target }}
    needs: verify
    runs-on: ${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-linux
            runs-on: ubuntu-latest
            seed: mach-*-x86_64-linux.tar.gz
          - target: aarch64-linux
            runs-on: ubuntu-24.04-arm
            seed: mach-*-aarch64-linux.tar.gz
    steps:
      - uses: actions/checkout@v6

      - name: fetch released mach
        env:
          GH_TOKEN: ${{ github.token }}
          SEED: ${{ matrix.seed }}
        run: |
          set -euo pipefail
          tmp="$(mktemp -d)"
          gh release download -R "$GITHUB_REPOSITORY" -p "$SEED" -D "$tmp"
          tar -xzf "$tmp"/$SEED -C /usr/local/bin mach
          chmod +x /usr/local/bin/mach

      - name: build fixpoint
        run: |
          set -euo pipefail
          mach dep pull
          mach build . --profile release -o a
          ./a build . --profile release -o b
          ./b build . --profile release -o c

          # ship the fixpoint: b == c (stage2 vs stage3) or the build is non-deterministic
          if ! cmp -s b c; then
            echo "::error::build did not converge to the fixpoint"
            exit 1
          fi

      # the whole-compiler capstone of the -g additivity guard (#1963): build the
      # compiler at release -g and release no-g with the fixpoint compiler and require
      # every PT_LOAD segment byte-identical. the compiler exercises far more of the
      # language than any fixture, so this catches any pass whose decision reads debug
      # metadata (inliner size gate #1932, mem2reg escape #1944, DCE salvage #1958,
      # param homing #1956 were four such) — the whole class at once. runs here at
      # release-cut (native x86_64 + aarch64, no emulation) rather than per-PR because
      # it costs two more full self-builds; the per-PR int debuginfo case already
      # asserts fixture additivity across the ELF ISAs. inlined here (not a script) when
      # the standalone debug harness folded into int/ (#2039) — do NOT delete as mystery
      # yaml; it is a real guard.
      - name: verify -g additivity of the compiler itself
        run: |
          set -euo pipefail
          tmp=$(mktemp -d)
          trap 'rm -rf "$tmp"' EXIT
          g="$tmp/mach.g"; nog="$tmp/mach.nog"
          # section-table bookkeeping (e_shoff @40 8B, e_shnum @60 2B, e_shstrndx @62 2B)
          # legitimately differs once -g adds named debug sections; zero it before compare.
          norm() {
            cp "$1" "$2"
            printf '\0\0\0\0\0\0\0\0' | dd of="$2" bs=1 seek=40 count=8 conv=notrunc status=none
            printf '\0\0'             | dd of="$2" bs=1 seek=60 count=2 conv=notrunc status=none
            printf '\0\0'             | dd of="$2" bs=1 seek=62 count=2 conv=notrunc status=none
          }
          ./c dep pull
          ./c build . --profile release -g -o "$g"
          ./c build . --profile release -o "$nog"
          an="$tmp/a.norm"; bn="$tmp/b.norm"
          norm "$g" "$an"; norm "$nog" "$bn"
          rc=0; n=0
          while read -r off fsz; do
            [ "$fsz" -eq 0 ] && continue
            n=$((n + 1))
            if ! cmp -s \
                <(dd if="$an" bs=1M iflag=skip_bytes,count_bytes skip="$off" count="$fsz" status=none) \
                <(dd if="$bn" bs=1M iflag=skip_bytes,count_bytes skip="$off" count="$fsz" status=none); then
              echo "FAIL: -g perturbed a loadable segment of the compiler (PT_LOAD off=$off sz=$fsz)" >&2
              rc=1
            fi
          done < <(readelf -lW "$g" 2>/dev/null | awk '/LOAD/{print strtonum($2), strtonum($5)}')
          [ "$n" -gt 0 ] || { echo "self-additive: no PT_LOAD segments read from $g" >&2; exit 1; }
          [ "$rc" -eq 0 ] || exit 1
          echo "self-additive: the compiler's own release build is -g additive ($n PT_LOAD segments identical)"

      - name: package archive
        env:
          TARGET: ${{ matrix.target }}
        run: |
          set -euo pipefail
          ver="${GITHUB_REF_NAME#v}"
          mkdir -p dist stage
          cp c stage/mach
          cp LICENSE stage/
          tar -C stage -czf "dist/mach-$ver-$TARGET.tar.gz" mach LICENSE

      - name: upload archive
        uses: actions/upload-artifact@v4
        with:
          name: release-${{ matrix.target }}
          path: dist/mach-*-${{ matrix.target }}.tar.gz
          if-no-files-found: error
          retention-days: 1

  build-windows:
    name: build ${{ matrix.target }}
    needs: verify
    runs-on: ${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-windows
            runs-on: windows-latest
            seed: mach-*-x86_64-windows.zip
    defaults:
      run:
        shell: pwsh
    steps:
      - uses: actions/checkout@v6

      - name: fetch released mach
        env:
          GH_TOKEN: ${{ github.token }}
          SEED: ${{ matrix.seed }}
        run: |
          $seed = Join-Path $env:RUNNER_TEMP 'seed'
          New-Item -ItemType Directory -Path $seed -Force | Out-Null
          gh release download -R $env:GITHUB_REPOSITORY -p $env:SEED -D $seed
          $zip = Get-ChildItem -Path $seed -Filter $env:SEED | Select-Object -First 1
          Expand-Archive -Path $zip.FullName -DestinationPath $seed -Force
          Add-Content -Path $env:GITHUB_PATH -Value $seed

      - name: build fixpoint
        run: |
          mach.exe dep pull
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          mach.exe build . --profile release -o a.exe
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          ./a.exe build . --profile release -o b.exe
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          ./b.exe build . --profile release -o c.exe
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

          # ship the fixpoint: b == c (stage2 vs stage3) or the build is non-deterministic
          if ((Get-FileHash b.exe).Hash -ne (Get-FileHash c.exe).Hash) {
            Write-Error 'build did not converge to the fixpoint'
            exit 1
          }

      - name: package archive
        env:
          TARGET: ${{ matrix.target }}
        run: |
          $ver = ($env:GITHUB_REF_NAME).TrimStart('v')
          New-Item -ItemType Directory -Path dist, stage -Force | Out-Null
          Copy-Item c.exe stage/mach.exe -Force
          Copy-Item LICENSE stage/ -Force
          Compress-Archive -Path stage/mach.exe, stage/LICENSE -DestinationPath "dist/mach-$ver-${env:TARGET}.zip" -Force

      - name: upload archive
        uses: actions/upload-artifact@v4
        with:
          name: release-${{ matrix.target }}
          path: dist/mach-*-${{ matrix.target }}.zip
          if-no-files-found: error
          retention-days: 1

  # the darwin lane (bootstrap seed cross-build + native fixpoint + self-test) is a
  # reusable workflow shared with ci.yml's dev -> main release gate — see
  # darwin-lane.yml. gated the same way build-linux/build-windows are: explicit,
  # since the default success() skips through verify's dispatch-skip.
  build-darwin:
    name: darwin lane
    needs: verify
    if: ${{ !cancelled() && (needs.verify.result == 'success' || needs.verify.result == 'skipped') }}
    uses: ./.github/workflows/darwin-lane.yml

  release:
    name: publish release
    needs: [build-linux, build-windows, build-darwin]
    # success() keeps the build gate the default if dropped when adding the event check
    if: ${{ github.event_name == 'push' && success() }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6

      - name: collect archives
        uses: actions/download-artifact@v4
        with:
          pattern: release-*
          path: dist
          merge-multiple: true

      # download-artifact with a glob pattern collects whatever matches and does
      # not fail on a missing target, so a wrong assumption anywhere upstream
      # (e.g. a package/upload step silently skipped because github.event_name
      # didn't propagate through darwin-lane.yml's workflow_call the way the
      # dev -> main gate assumes — #2179) would otherwise publish an incomplete
      # release with every job green. the expected archive set is read straight
      # out of the build matrices (cd.yml's build-linux/build-windows,
      # darwin-lane.yml's build), not hardcoded here, so it can't drift the next
      # time a target is added or dropped, as x86_64-darwin was in 3.6.1.
      - name: verify archive completeness
        run: |
          set -euo pipefail
          ver="${GITHUB_REF_NAME#v}"

          targets=$(grep -h -oP '(?<=- target: )[a-z0-9_-]+$' \
            .github/workflows/cd.yml .github/workflows/darwin-lane.yml | sort -u)
          [ -n "$targets" ] || { echo "::error::no targets found in the build matrices"; exit 1; }

          want=""
          missing=0
          for t in $targets; do
            case "$t" in
              *-windows) f="mach-$ver-$t.zip" ;;
              *)         f="mach-$ver-$t.tar.gz" ;;
            esac
            want="$want$f"$'\n'
            if [ ! -f "dist/$f" ]; then
              echo "::error::release is missing the $t archive (dist/$f)"
              missing=1
            fi
          done
          [ "$missing" -eq 0 ] || { echo "::error::incomplete release — refusing to publish"; exit 1; }

          got="$(cd dist && ls mach-*.tar.gz mach-*.zip 2>/dev/null | sort)"
          want="$(printf '%s' "$want" | sort)"
          if [ "$got" != "$want" ]; then
            echo "::error::dist/ holds archives beyond the expected set"
            printf 'expected:\n%s\n' "$want"
            printf 'got:\n%s\n' "$got"
            exit 1
          fi

          echo "release archive set complete: $(echo "$targets" | tr '\n' ' ')"

      - name: checksums
        run: |
          set -euo pipefail
          cd dist
          sha256sum mach-*.tar.gz mach-*.zip > SHA256SUMS

          # SHA256SUMS must cover exactly the set verify archive completeness
          # just proved dist/ holds — no more, no fewer.
          n_files=$(ls mach-*.tar.gz mach-*.zip | wc -l)
          n_sums=$(wc -l < SHA256SUMS)
          [ "$n_sums" -eq "$n_files" ] || {
            echo "::error::SHA256SUMS has $n_sums entries, dist/ holds $n_files archives"
            exit 1
          }

      - name: publish
        uses: softprops/action-gh-release@v3
        with:
          files: |
            dist/mach-*.tar.gz
            dist/mach-*.zip
            dist/SHA256SUMS