release.yml

name: release

permissions: {}

on:
  push:
    tags:
      - v[0-9]+.*
  workflow_dispatch:
    inputs:
      version:
        description: "Version (without leading v)"
        required: true
        type: string

env:
  CARGO_TERM_COLOR: always
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:
  build-binaries:
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 90
    permissions:
      contents: write
    env:
      HK_REQUIRE_EMBEDDED_PKL: "1"
      # mise-action puts mise's shims on PATH, and its cargo shim routes through
      # the [wrappers.cargo] mbx wrapper. Release builds stay on cargo/cross.
      MBX_DISABLE: "1"
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            os: macos-latest
            runner: namespace-profile-endev-macos-arm64
            build-tool: cargo
            optimized: false
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            runner: namespace-profile-endev-linux-amd64
            build-tool: cross
            optimized: false
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
            runner: namespace-profile-endev-linux-amd64
            build-tool: cross
            optimized: false
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            runner: namespace-profile-endev-linux-amd64
            build-tool: cross
            optimized: true
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            runner: namespace-profile-endev-linux-amd64
            build-tool: cross
            optimized: false
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            runner: windows-latest
            build-tool: cargo
            optimized: false
          - target: aarch64-pc-windows-msvc
            os: windows-latest
            runner: windows-latest
            build-tool: cargo
            optimized: false
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          cache: false
      # No `shell:` override: mise picks gen.ps1 on Windows, where the bash
      # task early-exits.
      - name: Generate pkl builtins for the embedded package
        run: mise run pkl:gen
      - if: matrix.os == 'macos-latest'
        uses: apple-actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466 # v7
        with:
          p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
          p12-password: ${{ secrets.CERTIFICATES_P12_PASS }}
      - name: Install PGO and BOLT build tools
        if: matrix.optimized
        shell: bash
        run: |
          rustup component add llvm-tools
          cargo install cross --locked --version 0.2.5
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends wget gnupg ca-certificates
          sudo install -d -m 0755 /etc/apt/keyrings
          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key \
            | sudo gpg --dearmor -o /etc/apt/keyrings/llvm.gpg
          codename=$(. /etc/os-release && echo "$VERSION_CODENAME")
          echo "deb [signed-by=/etc/apt/keyrings/llvm.gpg] https://apt.llvm.org/${codename}/ llvm-toolchain-${codename}-18 main" \
            | sudo tee /etc/apt/sources.list.d/llvm-toolchain-18.list
          sudo apt-get update
          sudo apt-get install -y bolt-18
      - name: Build PGO+BOLT binary
        if: matrix.optimized
        shell: bash
        env:
          HK_PGO_BUILD_TOOL: ${{ matrix.build-tool }}
          HK_PGO_TARGET: ${{ matrix.target }}
        run: scripts/pgo-bolt.bash
      - name: Package PGO+BOLT binary
        if: matrix.optimized
        shell: bash
        env:
          TARGET: ${{ matrix.target }}
        run: |
          # Match upload-rust-binary-action's default Unix archive format.
          # tar.xz is disabled by default and zip is reserved for Windows.
          tar -czf "hk-${TARGET}.tar.gz" \
            -C "target/${TARGET}/serious-pgo" hk \
            -C "${GITHUB_WORKSPACE}" skills
      - if: matrix.optimized != true
        uses: taiki-e/upload-rust-binary-action@f0d45ae91ee7b8ee928de7a9d04d893a08bcbec6 # v1
        with:
          bin: hk
          include: skills
          target: ${{ matrix.target }}
          build-tool: ${{ matrix.build-tool }}
          token: ${{ secrets.GITHUB_TOKEN }}
          features: git2/vendored-libgit2,git2/vendored-openssl
          profile: serious
          codesign: "Developer ID Application: Jeffrey Dickey (4993Y37DX6)"
          codesign_prefix: dev.jdx.
          # Apple will not notarize a binary without the hardened runtime.
          codesign_options: runtime
          dry-run: true # Always dry-run to just build without uploading
      # Signing settles who built the binary; notarization is what Gatekeeper
      # demands once an archive carries the quarantine bit, which is to say
      # whenever someone downloads it in a browser rather than with curl.
      # Without a ticket it is blocked behind a "cannot be verified" dialog that
      # only a deliberate override gets past.
      #
      # The ticket lives on Apple's side and is keyed to the binary's cdhash, so
      # nothing here rewrites what was already built or uploaded -- stapling
      # would, but `stapler` only writes into bundles, disk images, and
      # installer packages, and this is a bare Mach-O in an archive. Gatekeeper
      # resolves the ticket online instead.
      - name: Notarize macOS binary
        if: matrix.os == 'macos-latest'
        shell: bash
        env:
          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
          BINARIES: target/${{ matrix.target }}/serious/hk
        run: |
          set -euo pipefail

          if [ -z "$APPLE_API_KEY_P8" ] || [ -z "$APPLE_API_KEY_ID" ] || [ -z "$APPLE_API_ISSUER_ID" ]; then
            echo "::warning title=Not notarized::App Store Connect credentials are unset, so this release ships signed but un-notarized macOS binaries. Gatekeeper will block them for anyone who downloads an archive through a browser."
            exit 0
          fi

          # Outside the workspace, so no later step can sweep the key into an
          # artifact, and removed even when notarization fails.
          work="$(mktemp -d)"
          trap 'rm -rf "$work"' EXIT
          printf '%s' "$APPLE_API_KEY_P8" | base64 --decode > "$work/key.p8"

          # notarytool takes a container, never a bare executable. Copies are
          # fine: a Mach-O carries its signature inline, so the cdhash the
          # ticket is keyed to is the one already shipped.
          mkdir "$work/stage"
          for binary in $BINARIES; do
            cp "$binary" "$work/stage/"
          done
          # Apple rejects a binary without the hardened runtime or a secure
          # timestamp. Naming a missing one here turns an opaque Invalid verdict
          # into a diagnosis; Apple stays the authority on whether to accept.
          for binary in $BINARIES; do
            details="$(codesign --display --verbose=4 "$binary" 2>&1 || true)"
            case "$details" in
              *runtime*) ;;
              *) echo "::warning title=No hardened runtime::$binary is signed without --options runtime, which Apple requires; expect an Invalid verdict below." ;;
            esac
            case "$details" in
              *Timestamp=*) ;;
              *) echo "::warning title=No secure timestamp::$binary carries no secure timestamp, which Apple requires; expect an Invalid verdict below." ;;
            esac
          done

          ditto -c -k --norsrc --noextattr "$work/stage" "$work/submission.zip"

          # `--wait` is not a gate on its own: it can return zero on an Invalid
          # submission, so the reported status is what decides. plutil reads
          # JSON and ships with macOS, which keeps this off jq.
          result="$(xcrun notarytool submit "$work/submission.zip" \
            --key "$work/key.p8" \
            --key-id "$APPLE_API_KEY_ID" \
            --issuer "$APPLE_API_ISSUER_ID" \
            --output-format json \
            --timeout 30m \
            --wait)"
          echo "$result"

          status="$(printf '%s' "$result" | plutil -extract status raw -o - -)"
          id="$(printf '%s' "$result" | plutil -extract id raw -o - -)"
          if [ "$status" != "Accepted" ]; then
            echo "::error::notarization returned $status for submission $id"
            xcrun notarytool log "$id" \
              --key "$work/key.p8" \
              --key-id "$APPLE_API_KEY_ID" \
              --issuer "$APPLE_API_ISSUER_ID" || true
            exit 1
          fi
          echo "notarized: submission $id"
      - name: Upload binary artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: binary-${{ matrix.target }}
          path: |
            hk-*.tar.gz
            hk-*.tar.xz
            hk-*.zip
          retention-days: 1

  build-pkl:
    runs-on: namespace-profile-endev-linux-amd64
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          cache: false
      - name: Package Pkl
        env:
          INPUTS_VERSION: ${{ inputs.version }}
          GITHUB_REF_NAME: ${{ github.ref_name }}
        run: |
          if [[ -n "${INPUTS_VERSION}" ]]; then
            TAG_NAME="v${INPUTS_VERSION}"
          else
            TAG_NAME="${GITHUB_REF_NAME}"
          fi
          VERSION="${TAG_NAME#v}"
          echo "Building pkl package for version: $VERSION"

          # Use the mise task which outputs to docs/public/pkl
          VERSION="${VERSION}" mise run pkl:dist

          echo "Contents of docs/public/pkl:"
          ls -la docs/public/pkl || true
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: pkl-packages
          path: docs/public/pkl/*
          if-no-files-found: error
          retention-days: 1

  create-release:
    needs: [build-binaries, build-pkl]
    runs-on: namespace-profile-endev-linux-amd64
    permissions:
      contents: write
      # The packslip is signed with this job's OIDC identity and its
      # artifacts are attested; neither is possible without these.
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          cache: false
      - name: Extract release notes from CHANGELOG.md
        run: |
          awk '/^## \[/{if(found) exit; found=1} found{print}' CHANGELOG.md > release-notes.md
          if [[ ! -s release-notes.md ]]; then
            echo "No release notes available" > release-notes.md
          fi
      - name: Download all artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: artifacts
      - name: Prepare release assets
        run: |
          mkdir -p release-assets
          find artifacts/binary-* -type f \( -name "*.tar.gz" -o -name "*.tar.xz" -o -name "*.zip" \) -exec mv {} release-assets/ \;
          if [ -d "artifacts/pkl-packages" ]; then
            find artifacts/pkl-packages -type f -exec mv {} release-assets/ \;
          fi
          ls -la release-assets/
      - name: Create release with all assets
        env:
          INPUTS_VERSION: ${{ inputs.version }}
          GITHUB_REF_NAME: ${{ github.ref_name }}
        run: |
          if [[ -n "${INPUTS_VERSION}" ]]; then
            TAG_NAME="v${INPUTS_VERSION}"
          else
            TAG_NAME="${GITHUB_REF_NAME}"
          fi
          gh release create "$TAG_NAME" \
            --title "$TAG_NAME" \
            --notes-file release-notes.md \
            --draft \
            release-assets/*
      - name: Install completion syntax checkers
        timeout-minutes: 5
        run: |
          if [[ -f /etc/apt/apt-mirrors.txt ]]; then
            sudo sed -i 's|http://azure.archive.ubuntu.com/ubuntu|https://archive.ubuntu.com/ubuntu|g' /etc/apt/apt-mirrors.txt
          fi
          sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=15 -o Acquire::https::Timeout=15 update
          sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=15 -o Acquire::https::Timeout=15 install -y zsh fish
          # Hosted runners include PowerShell; Namespace images have its signed apt repository.
          if ! command -v pwsh >/dev/null 2>&1; then
            sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=15 -o Acquire::https::Timeout=15 install -y powershell
          fi
      # Publish native completion scripts so installers can load them without
      # a separate usage executable. Keep the CLI spec for other consumers.
      - name: Publish completions and the CLI specification
        env:
          INPUTS_VERSION: ${{ inputs.version }}
          GITHUB_REF_NAME: ${{ github.ref_name }}
        run: |
          if [[ -n "${INPUTS_VERSION}" ]]; then
            TAG_NAME="v${INPUTS_VERSION}"
          else
            TAG_NAME="${GITHUB_REF_NAME}"
          fi
          mkdir -p bin
          tar -xzf release-assets/hk-x86_64-unknown-linux-gnu.tar.gz -C bin
          bin/hk usage > hk.usage.kdl
          for shell in bash zsh fish powershell; do
            bin/hk completion "$shell" > "hk.$shell"
            test -s "hk.$shell"
            grep -Fq '__complete_word__' "hk.$shell"
            bin/hk __complete_word__ --shell "$shell" --line 'hk --ver' | grep -Fq -- '--verbose'
          done
          bash -n hk.bash
          zsh -n hk.zsh
          fish --no-execute hk.fish
          cat > completion-syntax-check.ps1 <<'POWERSHELL'
            $parseErrors = $null
            [void][System.Management.Automation.Language.Parser]::ParseFile((Join-Path $PWD "hk.powershell"), [ref]$null, [ref]$parseErrors)
            if ($parseErrors.Count) { $parseErrors | Write-Error; exit 1 }
          POWERSHELL
          pwsh -NoProfile -NonInteractive -File completion-syntax-check.ps1
          gh release upload "$TAG_NAME" hk.usage.kdl hk.bash hk.zsh hk.fish hk.powershell --clobber
      # The packslip is this release's signed inventory: every archive's
      # digest, the executable inside it, the shared objects it needs from
      # the host, and the workflow identity that signed for all of it. It
      # lets an installer check a download against jdx/hk's identity rather
      # than against a key this project would have to hold. The Pkl package
      # is not an artifact anyone installs a binary from, so it stays out.
      # See https://packslip.dev.
      - uses: jdx/packslip@a0d434ad57571c62dbd0ab5095b4eff607a71fd3 # v1.1.1
        with:
          tag: ${{ inputs.version != '' && format('v{0}', inputs.version) || github.ref_name }}
          artifacts: release-assets/hk-*.tar.gz release-assets/hk-*.tar.xz release-assets/hk-*.zip
          bin: hk
          resources: |
            completion/bash=asset:hk.bash
            completion/zsh=asset:hk.zsh
            completion/fish=asset:hk.fish
            completion/powershell=asset:hk.powershell
            cli-spec/usage=asset:hk.usage.kdl
            skill/hk-configure=archive:skills/hk-configure
            skill/hk-debug=archive:skills/hk-debug

  publish-crate:
    needs: [create-release]
    if: github.repository == 'jdx/hk'
    runs-on: namespace-profile-endev-linux-amd64
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          cache: false
      - run: cargo publish # zizmor: ignore[use-trusted-publishing]
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  enhance-release:
    needs: [create-release]
    runs-on: namespace-profile-endev-linux-amd64
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          cache: false
      - name: Enhance release notes with communique
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          INPUTS_VERSION: ${{ inputs.version }}
          GITHUB_REF_NAME: ${{ github.ref_name }}
        run: |
          if [[ -n "${INPUTS_VERSION}" ]]; then
            TAG_NAME="v${INPUTS_VERSION}"
          else
            TAG_NAME="${GITHUB_REF_NAME}"
          fi
          communique generate "$TAG_NAME" --github-release
      - name: Append jdx.dev sponsor blurb
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          INPUTS_VERSION: ${{ inputs.version }}
          GITHUB_REF_NAME: ${{ github.ref_name }}
        run: |
          if [[ -n "${INPUTS_VERSION}" ]]; then
            TAG_NAME="v${INPUTS_VERSION}"
          else
            TAG_NAME="${GITHUB_REF_NAME}"
          fi
          gh release view "$TAG_NAME" --json body --jq .body \
            | perl -0pe 's/\n*^##[^\n]*Sponsor hk\b.*\z//ms' \
            > /tmp/release-notes.md
          printf '\n\n' >> /tmp/release-notes.md
          cat <<'EOF' >> /tmp/release-notes.md
          ## 💚 Sponsor hk

          hk is built and maintained by [@jdx](https://github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.

          If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep hk fast, free, and independent.
          EOF

          gh release edit "$TAG_NAME" --notes-file /tmp/release-notes.md

  publish-release:
    needs: [publish-crate, enhance-release]
    if: ${{ !cancelled() && needs.enhance-release.result == 'success' && (needs.publish-crate.result == 'success' || needs.publish-crate.result == 'skipped') }}
    runs-on: namespace-profile-endev-linux-amd64
    permissions:
      contents: write
    steps:
      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          INPUTS_VERSION: ${{ inputs.version }}
          GITHUB_REF_NAME: ${{ github.ref_name }}
        run: |
          if [[ -n "${INPUTS_VERSION}" ]]; then
            TAG_NAME="v${INPUTS_VERSION}"
          else
            TAG_NAME="${GITHUB_REF_NAME}"
          fi
          gh release edit "$TAG_NAME" --draft=false