release.yml

name: release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (e.g. v0.1.0-alpha.1)'
        required: true

permissions:
  contents: write   # for creating releases + uploading assets

jobs:
  build:
    name: build ${{ matrix.target }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            platform: darwin-arm64
            runner: macos-14
            zigbuild: false
          # darwin-x64 cross-compiles from macos-14 (Apple Silicon) — no need
          # for the perpetually-queued free macos-13 Intel runner pool.
          - target: x86_64-apple-darwin
            platform: darwin-x64
            runner: macos-14
            zigbuild: false
          - target: x86_64-unknown-linux-gnu
            platform: linux-x64
            runner: ubuntu-22.04
            zigbuild: true
          - target: aarch64-unknown-linux-gnu
            platform: linux-arm64
            runner: ubuntu-22.04
            zigbuild: true
          - target: x86_64-pc-windows-gnu
            platform: windows-x64
            runner: ubuntu-22.04
            zigbuild: true
            ext: .exe

    runs-on: ${{ matrix.runner }}
    steps:
      # Source is hosted elsewhere; clone the build repo via SSH.
      # CORD_SOURCE_REPO secret must be set in repo settings to the private
      # source repo URL (e.g. git@github.com:fosenai/cord-source.git).
      - name: Checkout source (private)
        uses: actions/checkout@v4
        with:
          repository: ${{ secrets.CORD_SOURCE_REPO }}
          token: ${{ secrets.CORD_SOURCE_TOKEN }}
          ref: ${{ github.event.inputs.tag || github.ref_name }}

      - name: Setup Rust nightly + rust-src
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: nightly
          components: rust-src

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust

      - name: Install cargo-zigbuild
        if: matrix.zigbuild
        run: |
          curl -L https://ziglang.org/download/0.13.0/zig-linux-x86_64-0.13.0.tar.xz | tar xJ
          sudo mv zig-linux-x86_64-0.13.0/zig /usr/local/bin/
          sudo mv zig-linux-x86_64-0.13.0/lib /usr/local/lib/zig
          cargo install cargo-zigbuild

      - name: Build hardened binary
        working-directory: rust
        run: |
          case "${{ matrix.target }}" in
            x86_64-pc-windows-gnu)         ./scripts/build-hardened.sh windows ;;
            x86_64-unknown-linux-gnu)      ./scripts/build-hardened.sh linux ;;
            aarch64-unknown-linux-gnu)     ./scripts/build-hardened.sh linux-arm64 ;;
            x86_64-apple-darwin)           ./scripts/build-hardened.sh darwin-x64 ;;
            *)                              ./scripts/build-hardened.sh host ;;
          esac

      - name: Locate binary
        id: locate
        working-directory: rust
        run: |
          EXT="${{ matrix.ext || '' }}"
          out=$(ls target/${{ matrix.target }}/release/cord${EXT} 2>/dev/null || echo "")
          if [ -z "$out" ]; then
            echo "ERROR: binary not found at target/${{ matrix.target }}/release/cord${EXT}" >&2
            exit 1
          fi
          asset_name="cord-${{ matrix.platform }}${EXT}"
          cp "$out" "$asset_name"
          ls -lh "$asset_name"
          echo "asset=rust/$asset_name" >> $GITHUB_OUTPUT

      - name: Upload to release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
          files: ${{ steps.locate.outputs.asset }}
          fail_on_unmatched_files: true
          generate_release_notes: true

  publish-npm:
    name: publish to npm
    needs: build
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: 'https://registry.npmjs.org'

      - name: Compute version from tag
        id: ver
        run: |
          VER="${{ github.event.inputs.tag || github.ref_name }}"
          VER="${VER#v}"
          echo "version=$VER" >> $GITHUB_OUTPUT
          echo "publishing as version $VER"

      - name: Bump version in all 6 npm packages
        env:
          VER: ${{ steps.ver.outputs.version }}
        run: |
          for pkg in cord cord-darwin-arm64 cord-darwin-x64 cord-linux-arm64 cord-linux-x64 cord-windows-x64; do
            node -e "
              const fs = require('fs');
              const p = 'npm/$pkg/package.json';
              const j = JSON.parse(fs.readFileSync(p, 'utf8'));
              j.version = process.env.VER;
              if (j.optionalDependencies) {
                for (const k of Object.keys(j.optionalDependencies)) {
                  j.optionalDependencies[k] = process.env.VER;
                }
              }
              fs.writeFileSync(p, JSON.stringify(j, null, 2) + '\n');
              console.log('  ' + p + ' -> ' + j.version);
            "
          done

      - name: Publish 5 platform packages first
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          for pkg in cord-darwin-arm64 cord-darwin-x64 cord-linux-arm64 cord-linux-x64 cord-windows-x64; do
            echo "=== publishing @fosenai/$pkg ==="
            (cd npm/$pkg && npm publish --access public)
          done

      - name: Publish main @fosenai/cord last
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          # main pkg depends on platform pkgs via optionalDependencies — publish last so deps resolve
          (cd npm/cord && npm publish --access public)