release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"
      - "v*.*.*-*"

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0

jobs:
  build:
    name: Build (${{ matrix.target }})
    environment: release
    strategy:
      fail-fast: false
      matrix:
        include:
          - runs-on: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            archive: tar

          - runs-on: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            archive: tar

          - runs-on: windows-2025
            target: x86_64-pc-windows-msvc
            archive: zip

          - runs-on: windows-11-arm
            target: aarch64-pc-windows-msvc
            archive: zip

          - runs-on: macos-15-intel
            target: x86_64-apple-darwin
            archive: tar

          - runs-on: macos-15
            target: aarch64-apple-darwin
            archive: tar

    runs-on: ${{ matrix.runs-on }}

    steps:
      - uses: actions/checkout@v6
        with:
          token: ${{ secrets.JOLTERBOT_TOKEN }}

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Build release
        run: make build-release ARGS="--target ${{ matrix.target }}"

      - name: Package Unix artifact
        if: matrix.archive == 'tar'
        shell: bash
        run: |
          set -euo pipefail

          name="jolter-${GITHUB_REF_NAME}-${{ matrix.target }}"
          mkdir -p "dist/$name"

          cp "target/${{ matrix.target }}/release/jolter" \
            "target/${{ matrix.target }}/release/jolter-shim" \
            README.md LICENSE "dist/$name/"

          test -x "dist/$name/jolter"
          test -x "dist/$name/jolter-shim"

          tar -C dist -czf "dist/$name.tar.gz" "$name"

          sha256sum "dist/$name.tar.gz" > "dist/$name.tar.gz.sha256"

      - name: Code Sign Windows Binaries
        if: matrix.archive == 'zip' && env.WINDOWS_CODESIGN_CERTIFICATE_BASE64 != ''
        env:
          WINDOWS_CODESIGN_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CODESIGN_CERTIFICATE_BASE64 }}
          WINDOWS_CODESIGN_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CODESIGN_CERTIFICATE_PASSWORD }}
        shell: pwsh
        run: |
          $certBytes = [System.Convert]::FromBase64String($env:WINDOWS_CODESIGN_CERTIFICATE_BASE64)
          $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
          $cert.Import(
            $certBytes,
            $env:WINDOWS_CODESIGN_CERTIFICATE_PASSWORD,
            [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable
          )

          Set-AuthenticodeSignature `
            -FilePath "target/${{ matrix.target }}/release/jolter.exe" `
            -Certificate $cert `
            -TimestampServer "http://timestamp.digicert.com"

          Set-AuthenticodeSignature `
            -FilePath "target/${{ matrix.target }}/release/jolter-shim.exe" `
            -Certificate $cert `
            -TimestampServer "http://timestamp.digicert.com"

      - name: Package Windows artifact
        if: matrix.archive == 'zip'
        shell: pwsh
        run: |
          $name = "jolter-$env:GITHUB_REF_NAME-${{ matrix.target }}"
          $dir = "dist/$name"
          New-Item -ItemType Directory -Force $dir | Out-Null

          Copy-Item `
            "target/${{ matrix.target }}/release/jolter.exe", `
            "target/${{ matrix.target }}/release/jolter-shim.exe", `
            "README.md", `
            "LICENSE" `
            $dir

          if (-not (Test-Path (Join-Path $dir "jolter.exe"))) {
            throw "missing jolter.exe"
          }

          if (-not (Test-Path (Join-Path $dir "jolter-shim.exe"))) {
            throw "missing jolter-shim.exe"
          }

          $zip = "dist/$name.zip"
          Compress-Archive "$dir/*" $zip

          $hash = (Get-FileHash -Algorithm SHA256 $zip).Hash.ToLower()
          "$hash  $name.zip" | Set-Content "$zip.sha256"

      - uses: actions/upload-artifact@v4
        with:
          name: jolter-${{ matrix.target }}
          path: |
            dist/*.tar.gz
            dist/*.tar.gz.sha256
            dist/*.zip
            dist/*.zip.sha256

  release:
    name: Create Release
    needs: build
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          token: ${{ secrets.JOLTERBOT_TOKEN }}

      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist
          pattern: jolter-*
          merge-multiple: true

      - name: Extract release notes from CHANGELOG.md
        shell: bash
        run: |
          set -euo pipefail

          VER="${GITHUB_REF_NAME#v}"
          export VER

          node -e '
            const fs = require("fs");
            const changelog = fs.readFileSync("CHANGELOG.md", "utf8");
            const version = process.env.VER;
            const lines = changelog.split("\n");
            let active = false;
            const notes = [];
            for (const line of lines) {
              if (/^##\s+/.test(line)) {
                if (line.includes(" " + version + " ") || line.startsWith("## " + version + " ") || line.startsWith("## " + version + "-")) {
                  active = true;
                  continue;
                } else if (active) {
                  break;
                }
              }
              if (active) {
                notes.push(line);
              }
            }
            const content = notes.join("\n").trim();
            if (!content) {
              if (version.includes("nightly")) {
                fs.writeFileSync("RELEASE_NOTES.md", "Nightly release " + process.env.GITHUB_REF_NAME + "\n");
              } else {
                console.error("No changelog entry found for version " + version);
                process.exit(1);
              }
            } else {
              fs.writeFileSync("RELEASE_NOTES.md", content + "\n");
            }
          '

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.JOLTERBOT_TOKEN }}
        run: |
          set -euo pipefail

          FLAGS=()
          if [[ "${GITHUB_REF_NAME}" == *"-nightly."* ]] || [[ "${GITHUB_REF_NAME}" == *"nightly"* ]]; then
            FLAGS+=("--prerelease")
          fi

          gh release create "${GITHUB_REF_NAME}" \
            dist/* \
            --title "${GITHUB_REF_NAME}" \
            --notes-file RELEASE_NOTES.md \
            "${FLAGS[@]}"