release.yml

name: Release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag_name:
        description: 'Release tag to attach binaries to (e.g. v0.5.0)'
        required: true
        type: string

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: Build (${{ matrix.target }})
    runs-on: arc-llama-monitor
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            artifact: local-llm-foundry-linux-x86_64
          - target: aarch64-unknown-linux-gnu
            artifact: local-llm-foundry-linux-aarch64
          - target: x86_64-pc-windows-gnu
            artifact: local-llm-foundry-windows-x86_64.zip
          - target: aarch64-apple-darwin
            artifact: local-llm-foundry-macos-aarch64.tar.gz

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          prefix-key: "v0-rust"
          shared-key: "local-llm-foundry-${{ matrix.target }}-${{ hashFiles('Cargo.lock') }}"

      - name: Preflight release toolchain
        run: bash scripts/release-preflight.sh

      - name: Build ${{ matrix.target }}
        run: bash scripts/build-single-target.sh ${{ matrix.target }}

      - name: Build sensor bridge
        if: matrix.target == 'x86_64-pc-windows-gnu'
        run: dotnet publish sensor_bridge/sensor_bridge.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true -o sensor_bridge/publish

      - name: Package artifact
        run: |
          set -euo pipefail
          case "${{ matrix.target }}" in
            x86_64-unknown-linux-gnu)
              cp target/x86_64-unknown-linux-gnu/release/local-llm-foundry local-llm-foundry-linux-x86_64
              cp target/x86_64-unknown-linux-gnu/release/llama-monitor llama-monitor-linux-x86_64
              chmod +x local-llm-foundry-linux-x86_64 llama-monitor-linux-x86_64
              ;;
            aarch64-unknown-linux-gnu)
              cp target/aarch64-unknown-linux-gnu/release/local-llm-foundry local-llm-foundry-linux-aarch64
              cp target/aarch64-unknown-linux-gnu/release/llama-monitor llama-monitor-linux-aarch64
              chmod +x local-llm-foundry-linux-aarch64 llama-monitor-linux-aarch64
              ;;
            x86_64-pc-windows-gnu)
              mkdir -p windows-bundle-canonical windows-bundle-legacy
              cp target/x86_64-pc-windows-gnu/release/local-llm-foundry.exe windows-bundle-canonical/local-llm-foundry.exe
              cp target/x86_64-pc-windows-gnu/release/llama-monitor.exe windows-bundle-legacy/llama-monitor.exe
              cp sensor_bridge/publish/sensor_bridge.exe windows-bundle-canonical/sensor_bridge.exe
              cp sensor_bridge/publish/sensor_bridge.exe windows-bundle-legacy/sensor_bridge.exe
              # The WebView2 tray popover (wry, enabled via native-tray,webview-popover)
              # dynamically links WebView2Loader.dll on the GNU target. It must ship next
              # to the exe — the WebView2 *runtime* does not place it on the system path,
              # so without it the app fails to launch (STATUS_DLL_NOT_FOUND, 0xC0000135).
              # `cross` may place dependency build output in either the target-specific
              # release tree or the shared target tree. Search the complete target root
              # so packaging does not depend on Cargo's internal artifact layout.
              webview2_dll=$(find target -type f -path '*webview2-com-sys*/out/x64/WebView2Loader.dll' -print -quit)
              if [ -z "$webview2_dll" ]; then
                cargo_registry="${CARGO_HOME:-$HOME/.cargo}/registry/src"
                webview2_dll=$(find "$cargo_registry" -type f -path '*webview2-com-sys-*/x64/WebView2Loader.dll' -print -quit)
              fi
              if [ -z "$webview2_dll" ]; then echo "ERROR: WebView2Loader.dll not found in build output" >&2; exit 1; fi
              cp "$webview2_dll" windows-bundle-canonical/WebView2Loader.dll
              cp "$webview2_dll" windows-bundle-legacy/WebView2Loader.dll
              (cd windows-bundle-canonical && zip -9 -r ../local-llm-foundry-windows-x86_64.zip .)
              (cd windows-bundle-legacy && zip -9 -r ../llama-monitor-windows-x86_64.zip .)
              ;;
            aarch64-apple-darwin)
              cp target/aarch64-apple-darwin/release/local-llm-foundry local-llm-foundry-macos-aarch64
              cp target/aarch64-apple-darwin/release/llama-monitor llama-monitor-macos-aarch64
              chmod +x local-llm-foundry-macos-aarch64 llama-monitor-macos-aarch64
              tar -czf local-llm-foundry-macos-aarch64.tar.gz local-llm-foundry-macos-aarch64
              tar -czf llama-monitor-macos-aarch64.tar.gz llama-monitor-macos-aarch64
              ;;
          esac

          mkdir -p release-assets
          for asset in \
            local-llm-foundry-linux-x86_64 llama-monitor-linux-x86_64 \
            local-llm-foundry-linux-aarch64 llama-monitor-linux-aarch64 \
            local-llm-foundry-windows-x86_64.zip llama-monitor-windows-x86_64.zip \
            local-llm-foundry-macos-aarch64.tar.gz llama-monitor-macos-aarch64.tar.gz; do
            if [ -f "$asset" ]; then cp "$asset" release-assets/; fi
          done

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ matrix.artifact }}
          path: release-assets
          if-no-files-found: error
          retention-days: 1

  release:
    needs: build
    runs-on: arc-llama-monitor
    steps:
      - name: Generate GitHub App token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        id: app-token
        with:
          client-id: ${{ vars.GH_APP_CLIENT_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24

      - name: Download all build artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: 'local-llm-foundry-*'
          merge-multiple: true
          path: .

      - name: Determine expected release assets
        id: assets
        run: |
          set -euo pipefail
          VERSION="${{ github.event_name == 'release' && github.ref_name || github.event.inputs.tag_name }}"
          POLICY_VERSION="${VERSION#v}"
          IFS='.' read -r MAJOR MINOR _ <<< "$POLICY_VERSION"
          # Mirrors dropsLegacyAssets() in scripts/validate-release-contract.mjs:
          # llama-monitor-* legacy assets are retired starting at 2.1.0.
          if [ "$MAJOR" -gt 2 ] || { [ "$MAJOR" -eq 2 ] && [ "$MINOR" -ge 1 ]; }; then
            DROP_LEGACY=true
          else
            DROP_LEGACY=false
          fi
          ASSETS="local-llm-foundry-linux-x86_64
          local-llm-foundry-linux-aarch64
          local-llm-foundry-windows-x86_64.zip
          local-llm-foundry-macos-aarch64.tar.gz"
          if [ "$DROP_LEGACY" = "false" ]; then
            ASSETS="$ASSETS
          llama-monitor-linux-x86_64
          llama-monitor-linux-aarch64
          llama-monitor-windows-x86_64.zip
          llama-monitor-macos-aarch64.tar.gz"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          {
            echo "assets<<ASSETS_EOF"
            echo "$ASSETS"
            echo "ASSETS_EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Generate SHA-256 checksums
        run: |
          set -euo pipefail
          VERSION="${{ steps.assets.outputs.version }}"
          JSON='{"version":"'${VERSION}'","checksums":{}}'
          while IFS= read -r f; do
            [ -z "$f" ] && continue
            if [ -f "$f" ]; then
              H=$(sha256sum "$f" | awk '{print $1}')
              JSON=$(echo "$JSON" | jq --arg n "$f" --arg h "$H" \
                '.checksums[$n] = $h')
            else
              echo "ERROR: missing required release asset $f" >&2
              exit 1
            fi
          done <<< "${{ steps.assets.outputs.assets }}"
          echo "$JSON" | jq . > checksums.json
          cat checksums.json
          node scripts/validate-release-contract.mjs --dir . --version "$VERSION"

      - name: Update published release with artifacts
        if: github.event_name == 'release'
        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
        with:
          tag_name: ${{ github.ref_name }}
          body: ${{ github.event.release.body }}
          files: |
            ${{ steps.assets.outputs.assets }}
            checksums.json
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

      - name: Create manual release with generated notes
        if: github.event_name == 'workflow_dispatch'
        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
        with:
          tag_name: ${{ github.event.inputs.tag_name }}
          generate_release_notes: true
          files: |
            ${{ steps.assets.outputs.assets }}
            checksums.json
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}