release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      create_release:
        description: "Create a draft GitHub Release from build artifacts"
        type: boolean
        default: false
      macos_signing_required:
        description: "Fail the macOS job when no signing certificate is available (default: true)"
        type: boolean
        default: true

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"
  RUST_BACKTRACE: "1"
  # macOS artifacts must be signed by default; workflow_dispatch can opt out
  # (e.g. for throwaway ad-hoc builds) by passing macos_signing_required=false.
  REQUIRE_SIGNING: ${{ github.event_name == 'push' || inputs.macos_signing_required }}

jobs:
  build:
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 180
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: macOS aarch64
            os: macos-14
            target: aarch64-apple-darwin
            artifact: terry-macos-aarch64
            package: macos
          # Built on an Apple Silicon runner and cross-compiled to x86_64 with
          # the Xcode SDK (no Intel runner needed).
          - name: macOS x86_64
            os: macos-14
            target: x86_64-apple-darwin
            artifact: terry-macos-x86_64
            package: macos
            cross: true
          - name: Linux x86_64
            os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            artifact: terry-linux-x86_64
            package: linux
          - name: Windows x86_64
            os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact: terry-windows-x86_64
            package: windows

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Prepare Windows build environment
        if: matrix.package == 'windows'
        shell: pwsh
        run: |
          # Required for pet/python-environment-tools git checkouts (MAX_PATH).
          git config --system core.longpaths true
          git config --global core.longpaths true
          New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" `
            -Name "LongPathsEnabled" -Value 1 -PropertyType DWORD -Force | Out-Null

          # wasmtime / native deps expect cmake on PATH.
          if (-not (Get-Command cmake -ErrorAction SilentlyContinue)) {
            choco install cmake --installargs 'ADD_CMAKE_TO_PATH=System' -y
            $env:Path = [System.Environment]::GetEnvironmentVariable("Path","Machine") + ";" +
              [System.Environment]::GetEnvironmentVariable("Path","User")
          }
          cmake --version

      - name: Install Linux dependencies
        if: matrix.package == 'linux'
        run: |
          sudo apt-get update
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \
            build-essential \
            clang \
            cmake \
            curl \
            git \
            jq \
            libasound2-dev \
            libfontconfig-dev \
            libsqlite3-dev \
            libssl-dev \
            libwayland-dev \
            libx11-dev \
            libxcb-xfixes0-dev \
            libxkbcommon-dev \
            libxkbcommon-x11-dev \
            libzstd-dev \
            libvulkan-dev \
            pkg-config

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.95.0"
          targets: ${{ matrix.target }}

      - name: Prepare macOS x86_64 cross-compilation
        if: matrix.cross
        shell: bash
        run: |
          set -euo pipefail
          HOST="$(rustc -vV | sed -n 's/^host: //p')"
          echo "Cross-compiling ${{ matrix.target }} from ${HOST}"
          # Xcode's clang ships a universal SDK, so it can target x86_64 from an
          # arm64 runner. Route `cc`-based build scripts and cmake (aws-lc-sys)
          # at it; rustc links with the default `cc` since the objects are already
          # x86_64.
          echo "CC_x86_64_apple_darwin=clang -arch x86_64" >> "$GITHUB_ENV"
          echo "CXX_x86_64_apple_darwin=clang++ -arch x86_64" >> "$GITHUB_ENV"
          echo "CMAKE_OSX_ARCHITECTURES=x86_64" >> "$GITHUB_ENV"

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: release-${{ matrix.target }}
          cache-targets: true

      - name: Resolve version
        id: version
        shell: bash
        run: |
          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            VERSION="${GITHUB_REF_NAME#v}"
          else
            VERSION="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)"
            VERSION="${VERSION:-0.0.0}+${GITHUB_SHA::7}"
          fi
          # Zip/path-safe form (avoid '+' in Windows filenames).
          VERSION_SAFE="${VERSION//+/-}"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "version_safe=$VERSION_SAFE" >> "$GITHUB_OUTPUT"
          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
          echo "VERSION_SAFE=$VERSION_SAFE" >> "$GITHUB_ENV"

      - name: Import macOS signing certificate
        if: matrix.package == 'macos'
        env:
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
          REQUIRE_SIGNING: ${{ env.REQUIRE_SIGNING }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${MACOS_CERTIFICATE}" ]]; then
            if [[ "${REQUIRE_SIGNING}" == "true" ]]; then
              echo "::error::MACOS_CERTIFICATE secret is not set, but macOS signing is required. " \
                "Configure the secret (base64-encoded Developer ID Application .p12) or run " \
                "with macos_signing_required=false for an ad-hoc build." >&2
              exit 1
            fi
            echo "::warning::MACOS_CERTIFICATE secret not set; the macOS package will be ad-hoc signed (not a distribution signature)"
            exit 0
          fi
          KEYCHAIN_PATH="$RUNNER_TEMP/terry-signing.keychain-db"
          KEYCHAIN_PASSWORD="$(openssl rand -base64 32)"
          CERTIFICATE_PATH="$RUNNER_TEMP/certificate.p12"
          echo "$MACOS_CERTIFICATE" | base64 --decode > "$CERTIFICATE_PATH"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          # Import the whole identity (certificate + private key) from the p12.
          # `-t cert` would import only the certificate, leaving codesign without
          # the private key it needs to produce a signature.
          security import "$CERTIFICATE_PATH" -P "$MACOS_CERTIFICATE_PASSWORD" \
            -A -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s \
            -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"
          IDENTITY="$(
            security find-identity -v -p codesigning "$KEYCHAIN_PATH" \
              | sed -n 's/.*"\(Developer ID Application: .*\)"/\1/p' \
              | head -1
          )"
          if [[ -z "$IDENTITY" ]]; then
            echo "error: no Developer ID Application identity found in imported certificate" >&2
            security find-identity -v -p codesigning "$KEYCHAIN_PATH" >&2 || true
            exit 1
          fi
          echo "MACOS_SIGNING_IDENTITY=$IDENTITY" >> "$GITHUB_ENV"
          echo "Imported signing identity: $IDENTITY"

      - name: Package macOS
        if: matrix.package == 'macos'
        shell: bash
        env:
          REQUIRE_SIGNING: ${{ env.REQUIRE_SIGNING }}
          APPLE_NOTARIZATION_KEY: ${{ secrets.APPLE_NOTARIZATION_KEY }}
          APPLE_NOTARIZATION_KEY_ID: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }}
          APPLE_NOTARIZATION_ISSUER_ID: ${{ secrets.APPLE_NOTARIZATION_ISSUER_ID }}
        run: |
          chmod +x script/package-macos.sh
          ZIP="$(script/package-macos.sh "${{ matrix.target }}" | tee /dev/stderr | tail -n 1)"
          mkdir -p dist
          cp -f "$ZIP" dist/

      - name: Package Linux
        if: matrix.package == 'linux'
        shell: bash
        run: |
          chmod +x script/package-linux.sh
          ARCHIVE="$(script/package-linux.sh "${{ matrix.target }}" | tee /dev/stderr | tail -n 1)"
          mkdir -p dist
          cp -f "$ARCHIVE" dist/

      - name: Package Windows
        if: matrix.package == 'windows'
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $version = if ($env:VERSION_SAFE) { $env:VERSION_SAFE } else { $env:VERSION }
          $zip = & ".\script\package-windows.ps1" -Target "${{ matrix.target }}" -Version $version
          if (-not $zip) { throw "package-windows.ps1 produced no zip path" }
          if ($zip -is [array]) { $zip = ($zip | Where-Object { $_ })[-1] }
          Write-Host "Artifact: $zip"
          if (-not (Test-Path $zip)) { throw "Zip not found: $zip" }
          New-Item -ItemType Directory -Force -Path dist | Out-Null
          Copy-Item -Force $zip dist/

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: dist/*
          if-no-files-found: error
          retention-days: 14

  release:
    name: Publish GitHub Release
    needs: build
    runs-on: ubuntu-latest
    if: |
      always() &&
      needs.build.result == 'success' &&
      (
        (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) ||
        (github.event_name == 'workflow_dispatch' && inputs.create_release == true)
      )
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: List artifacts
        run: find artifacts -type f | sort

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ startsWith(github.ref, 'refs/tags/v') && github.ref_name || format('build-{0}', github.run_id) }}
          name: ${{ startsWith(github.ref, 'refs/tags/v') && github.ref_name || format('Terry build {0}', github.run_id) }}
          draft: ${{ !startsWith(github.ref, 'refs/tags/v') }}
          generate_release_notes: ${{ startsWith(github.ref, 'refs/tags/v') }}
          files: artifacts/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}