release.yaml

name: Release

on:
  push:
    tags:
      - 'nightly-*'
      - 'v[0-9]+.[0-9]+.[0-9]+*'

permissions:
  contents: write

env:
  RUST_TOOLCHAIN: "1.92.0"

jobs:
  build:
    name: Build ${{ matrix.artifact }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux musl static binaries via cargo-zigbuild — zig bundles its
          # own musl + libc++, so no system clang / musl-dev / etc. is
          # required and the resulting binary is fully static.
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            artifact: movy-linux-amd64
            archive: tar.gz
          - target: aarch64-unknown-linux-musl
            os: ubuntu-24.04-arm
            artifact: movy-linux-arm64
            archive: tar.gz
          - target: x86_64-apple-darwin
            os: macos-14
            artifact: movy-macos-amd64
            archive: tar.gz
            macos_cross: true
          - target: aarch64-apple-darwin
            os: macos-14
            artifact: movy-macos-arm64
            archive: tar.gz
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            artifact: movy-windows-amd64
            archive: zip
          # Windows arm64 (aarch64-pc-windows-msvc) is intentionally omitted:
          # one of our transitive dependencies (libafl_bolts) does not yet
          # build on that target.
    runs-on: ${{ matrix.os }}
    steps:
      - name: Install Linux build deps
        if: runner.os == 'Linux'
        shell: bash
        run: |
          sudo apt-get update
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
            cmake pkg-config python3 perl

      - name: Install macOS build deps (cmake + brew LLVM)
        if: runner.os == 'macOS'
        shell: bash
        run: |
          brew install cmake llvm
          LLVM_PREFIX="$(brew --prefix llvm)"
          {
            echo "CC=${LLVM_PREFIX}/bin/clang"
            echo "CXX=${LLVM_PREFIX}/bin/clang++"
            echo "PATH=${LLVM_PREFIX}/bin:${PATH}"
          } >> "$GITHUB_ENV"

      - name: Disable Windows Defender real-time scanning
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          # Defender real-time scanning is the dominant cost in MSVC + cargo
          # builds on hosted Windows runners — every .obj/.rlib/.exe spawned
          # by cl.exe/rustc.exe/link.exe triggers a scan, and cargo touches
          # tens of thousands of files. Disable real-time scanning and add
          # belt-and-braces exclusions for workspace + toolchain dirs/procs.
          Set-MpPreference -DisableRealtimeMonitoring $true                  -ErrorAction SilentlyContinue
          Set-MpPreference -DisableArchiveScanning $true                     -ErrorAction SilentlyContinue
          Set-MpPreference -DisableBehaviorMonitoring $true                  -ErrorAction SilentlyContinue
          Set-MpPreference -DisableScriptScanning $true                      -ErrorAction SilentlyContinue
          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE"            -ErrorAction SilentlyContinue
          Add-MpPreference -ExclusionPath "$env:USERPROFILE\.cargo"          -ErrorAction SilentlyContinue
          Add-MpPreference -ExclusionPath "$env:USERPROFILE\.rustup"         -ErrorAction SilentlyContinue
          Add-MpPreference -ExclusionPath "$env:RUNNER_TEMP"                 -ErrorAction SilentlyContinue
          Add-MpPreference -ExclusionProcess "cargo.exe","rustc.exe","link.exe","cl.exe","lld-link.exe" -ErrorAction SilentlyContinue
          Get-MpPreference | Select-Object DisableRealtimeMonitoring, ExclusionPath, ExclusionProcess

      - name: Install Windows build deps
        if: runner.os == 'Windows'
        shell: pwsh
        run: choco install -y cmake

      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}
          targets: ${{ matrix.target }}

      - name: Install zig (Linux only)
        if: runner.os == 'Linux'
        uses: mlugg/setup-zig@v2
        with:
          version: 0.13.0

      - name: Install cargo-zigbuild (Linux only)
        if: runner.os == 'Linux'
        shell: bash
        run: cargo install --locked cargo-zigbuild

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
            ~/.cargo/git/db
            target
          key: ${{ matrix.target }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ matrix.target }}-cargo-

      - name: Build (Linux musl via zigbuild)
        if: runner.os == 'Linux'
        shell: bash
        run: cargo zigbuild --release --locked --target ${{ matrix.target }} -p movy

      - name: Build (macOS)
        if: runner.os == 'macOS'
        shell: bash
        run: |
          export SDKROOT="$(xcrun --sdk macosx --show-sdk-path)"
          if [[ "${{ matrix.target }}" == "x86_64-apple-darwin" ]]; then
            # Cross-compile arm64 macOS runner -> x86_64. Tell cmake to
            # build z3/openssl/rocksdb as x86_64 and bindgen's clang to
            # use the x86_64 SDK.
            export CMAKE_OSX_ARCHITECTURES=x86_64
            export BINDGEN_EXTRA_CLANG_ARGS="--target=x86_64-apple-darwin -isysroot ${SDKROOT}"
          else
            export BINDGEN_EXTRA_CLANG_ARGS="-isysroot ${SDKROOT}"
          fi
          cargo build --release --locked --target ${{ matrix.target }} -p movy

      - name: Build (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: cargo build --release --locked --target ${{ matrix.target }} -p movy

      - name: Package (tar.gz)
        if: matrix.archive == 'tar.gz'
        shell: bash
        run: |
          tar czf "${{ matrix.artifact }}.tar.gz" -C "target/${{ matrix.target }}/release" movy

      - name: Package (zip)
        if: matrix.archive == 'zip'
        shell: pwsh
        run: |
          Compress-Archive -Path "target/${{ matrix.target }}/release/movy.exe" -DestinationPath "${{ matrix.artifact }}.zip"

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: ${{ matrix.artifact }}.${{ matrix.archive }}
          if-no-files-found: error

  release:
    name: Create GitHub release
    needs: build
    runs-on: ubuntu-latest
    if: always() && !cancelled()
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: List artifacts
        run: ls -la dist/

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          files: dist/*
          prerelease: ${{ startsWith(github.ref_name, 'nightly-') }}
          generate_release_notes: true
          fail_on_unmatched_files: false