release.yml

name: Release

on:
  push:
    tags:
      - 'v3.*'
  workflow_dispatch:
    inputs:
      publish_release:
        description: 'Publish a GitHub release with the artifacts'
        type: boolean
        default: false

permissions:
  contents: write

env:
  PYTHON_VERSION: '3.12.13'
  PBS_RELEASE: '20260414'
  UV_VERSION: '0.11.8'

jobs:
  guard:
    name: Verify tag is on v3 branch
    # Skip the branch check on manual dispatch — the user picks the ref
    # themselves in the dispatch UI, and there is no tag to verify.
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Check tag reachable from origin/v3
        run: |
          set -euo pipefail
          git fetch origin v3
          if ! git merge-base --is-ancestor "${GITHUB_SHA}" origin/v3; then
            echo "tag ${GITHUB_REF} commit ${GITHUB_SHA} is not on the v3 branch" >&2
            exit 1
          fi

  build:
    needs: guard
    if: ${{ always() && (needs.guard.result == 'success' || needs.guard.result == 'skipped') }}
    name: ${{ matrix.target }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux: ubuntu-22.04 keeps glibc old enough that the binaries
          # run on most user machines without forced glibc upgrades.
          - os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
          - os: macos-14
            target: aarch64-apple-darwin
          - os: windows-latest
            target: x86_64-pc-windows-msvc
    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v4

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      # macos-14 ships a Homebrew `cargo` shim at /opt/homebrew/bin/cargo
      # that forwards to `rustup-init`, and Homebrew's bin precedes
      # ~/.cargo/bin in PATH — so plain `cargo <subcmd>` (including
      # `cargo tauri build`) resolves to rustup-init and fails with
      # "unexpected argument 'tauri'". Prepend the dtolnay-installed cargo
      # to GITHUB_PATH so every later step sees the real binary first.
      - name: Prefer ~/.cargo/bin over Homebrew rustup-init (macOS)
        if: runner.os == 'macOS'
        shell: bash
        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ${{ matrix.target }}

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      # build.rs runs prost-build to compile liqi.proto and needs protoc
      # on PATH. arduino/setup-protoc handles all three OSes.
      - name: Setup protoc
        uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      # tauri-cli build is slow (~3 min). Pull the prebuilt binary via
      # taiki-e/install-action instead — sidesteps GitHub Actions' cache
      # scope rules (tag pushes can only read caches from the tag ref or
      # the default branch, which here is v2 and never runs this workflow,
      # so a cargo-install cache never hits). We previously used
      # cargo-bins/cargo-binstall directly, but on macos-14 runners with
      # Homebrew rustup pre-installed the `cargo` proxy resolves to
      # rustup-init and `cargo binstall` fails; taiki-e/install-action
      # invokes the binstall binary with an absolute path and avoids that.
      - name: Install tauri-cli
        uses: taiki-e/install-action@v2
        with:
          tool: tauri-cli@2.11.1

      - name: Linux system deps
        if: runner.os == 'Linux'
        # Hard cap the step: apt has no stall-timeout for downloads, so a
        # single wedged mirror connection can hang until the 6 h runner
        # limit (it did on the v3.2.0 run, stuck mid-fetch of the 27 MB
        # libwebkit2gtk package). 12 min is ample for a ~55 MB install.
        timeout-minutes: 12
        env:
          DEBIAN_FRONTEND: noninteractive
        run: |
          set -euo pipefail
          # Bound each socket to 30 s and retry, so a stalled download
          # aborts and re-fetches instead of trickling forever.
          apt_opts=(-o Acquire::Retries=3 -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30)
          sudo apt-get "${apt_opts[@]}" update
          sudo apt-get "${apt_opts[@]}" install -y \
            libwebkit2gtk-4.1-dev \
            libappindicator3-dev \
            librsvg2-dev \
            libsoup-3.0-dev \
            libssl-dev \
            patchelf \
            libfuse2

      # Cache fetched python + uv tarballs by version triple. The runtime
      # is shipped inside every zip, so the fetch is unconditional.
      - name: Cache bundled runtime
        uses: actions/cache@v4
        with:
          path: |
            runtime/python/${{ matrix.target }}
            runtime/uv/${{ matrix.target }}
          key: runtime-${{ matrix.target }}-py${{ env.PYTHON_VERSION }}-pbs${{ env.PBS_RELEASE }}-uv${{ env.UV_VERSION }}

      - name: Fetch python+uv
        shell: bash
        env:
          PYTHON_VERSION: ${{ env.PYTHON_VERSION }}
          PBS_RELEASE: ${{ env.PBS_RELEASE }}
          UV_VERSION: ${{ env.UV_VERSION }}
        run: bash scripts/fetch-runtime.sh "${{ matrix.target }}"

      # `--no-bundle` skips the (now empty) installer phase. We keep
      # `cargo tauri build` (vs. plain `cargo build`) so the
      # `beforeBuildCommand` in tauri.conf.json — `npm ci && npm run
      # build` — still runs and the frontend is rebuilt fresh.
      - name: Build
        shell: bash
        env:
          NO_STRIP: '1'
        run: cargo tauri build --no-bundle --target ${{ matrix.target }}

      - name: Package zip
        shell: bash
        run: bash scripts/package-zip.sh "${{ matrix.target }}"

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: akagi-${{ matrix.target }}
          path: dist/*.zip
          if-no-files-found: error
          retention-days: 14

  release:
    name: Publish GitHub release
    needs: build
    # Only publish on tag push, or when manually dispatched with the
    # publish_release input checked. Plain workflow_dispatch (no tag, no
    # input) just leaves artifacts on the run page.
    if: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.publish_release) }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true
      - run: ls -la artifacts
      - uses: softprops/action-gh-release@v2
        with:
          files: artifacts/**/*
          generate_release_notes: true
          fail_on_unmatched_files: true
          # make_latest: false