release.yml

name: Release

on:
  push:
    tags:
      # Matches bare semver tags: 1.2.3, 1.2.3-rc.1, etc.
      - "[0-9]*.[0-9]*.[0-9]*"
  # Manual trigger to exercise the whole pipeline (including the Windows
  # portable build) WITHOUT publishing a release: the build artifacts land on
  # the Actions run for download, and the `release` job below is gated to tag
  # pushes only, so nothing public is created.
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always
  # No global RUSTFLAGS here: a set RUSTFLAGS env overrides the target-scoped
  # rustflags in .cargo/config.toml, which would drop the Windows crt-static
  # linking. Warnings are gated in ci.yml on every push/PR.

jobs:
  # ---------------------------------------------------------------------------
  # Build matrix — one job per target
  # ---------------------------------------------------------------------------
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    # aarch64 musl is built natively on the ARM runner, so target (musl) differs
    # from host (gnu) and cc-rs treats it as a cross build: ring then looks for
    # aarch64-linux-musl-gcc, which musl-tools does not ship (only musl-gcc).
    # Point ring's C compiler and the linker at musl-gcc. These vars are
    # target-scoped, so they are inert for the x86_64 (cross) and macOS jobs.
    env:
      CC_aarch64_unknown_linux_musl: musl-gcc
      CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER: musl-gcc
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            use_cross: true

          - target: aarch64-unknown-linux-musl
            os: ubuntu-24.04-arm
            use_cross: false

          - target: x86_64-apple-darwin
            os: macos-latest
            use_cross: false

          - target: aarch64-apple-darwin
            os: macos-latest
            use_cross: false

    steps:
      - uses: actions/checkout@v7

      - name: Load build versions
        shell: bash
        run: grep -E '^[A-Za-z_]+=' versions.env >> "$GITHUB_ENV"

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }},wasm32-unknown-unknown

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}

      - name: Install cross
        if: matrix.use_cross
        uses: taiki-e/install-action@v2
        with:
          tool: cross

      # Native aarch64 musl build needs a musl C toolchain for ring (see the
      # CC_* env above).
      - name: Install musl toolchain
        if: matrix.target == 'aarch64-unknown-linux-musl'
        run: sudo apt-get update && sudo apt-get install -y musl-tools musl-dev

      - name: Install trunk
        uses: taiki-e/install-action@v2
        with:
          tool: trunk@${{ env.TRUNK_VERSION }}

      # The release binary is the complete client (web panel embedded via the
      # web-ui feature / rust-embed), matching the `latest` container image, so
      # the frontend is built first. trunk runs on the host; for the cross
      # target it then compiles the binary, reading the dist/ trunk produced.
      - name: Build frontend
        run: cd rucio-web && trunk build --release --public-url ./

      - name: Build (cross)
        if: matrix.use_cross
        run: cross build --release --target ${{ matrix.target }} --bin rucio --features emule-compat,web-ui

      - name: Build (cargo)
        if: ${{ !matrix.use_cross }}
        run: cargo build --release --target ${{ matrix.target }} --bin rucio --features emule-compat,web-ui

      - name: Package
        shell: bash
        run: |
          BINDIR=target/${{ matrix.target }}/release
          ARCHIVE=rucio-${{ github.ref_name }}-${{ matrix.target }}.tar.gz
          # `ruciod` is the daemon entrypoint: the same binary invoked under that
          # name. Ship it as a relative symlink next to the binary so extracting
          # the archive yields both commands (tar stores the link, not a copy).
          ln -sf rucio "$BINDIR/ruciod"
          tar -czf "$ARCHIVE" -C "$BINDIR" rucio ruciod
          echo "ARCHIVE=$ARCHIVE" >> "$GITHUB_ENV"

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: rucio-${{ matrix.target }}
          path: ${{ env.ARCHIVE }}
          if-no-files-found: error

  # ---------------------------------------------------------------------------
  # Static web panel — the trunk-built assets, for users who want to serve the
  # panel from their own web server (e.g. nginx + TLS) against a headless
  # daemon. The complete binary already embeds these; this is the unbundled
  # form. See docs/user/01-installation.md for the nginx reverse-proxy snippet.
  # ---------------------------------------------------------------------------
  web:
    name: Build static web panel
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Load build versions
        shell: bash
        run: grep -E '^[A-Za-z_]+=' versions.env >> "$GITHUB_ENV"

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown

      - uses: Swatinem/rust-cache@v2
        with:
          key: wasm-web

      - name: Install trunk
        uses: taiki-e/install-action@v2
        with:
          tool: trunk@${{ env.TRUNK_VERSION }}

      - name: Build frontend
        run: cd rucio-web && trunk build --release --public-url ./

      - name: Package
        shell: bash
        run: |
          ARCHIVE=rucio-web-${{ github.ref_name }}.tar.gz
          tar -czf "$ARCHIVE" -C rucio-web/dist .
          echo "ARCHIVE=$ARCHIVE" >> "$GITHUB_ENV"

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: rucio-web
          path: ${{ env.ARCHIVE }}
          if-no-files-found: error

  # ---------------------------------------------------------------------------
  # Windows portable desktop app — the Tauri shell hosting the embedded daemon
  # + web UI. Shipped as a ZIP (no installer): unzip to a writable folder, run,
  # and all state lives next to the .exe (portable mode). Relies on the
  # evergreen WebView2 runtime (preinstalled on Windows 10/11).
  # ---------------------------------------------------------------------------
  windows-desktop:
    name: Build Windows desktop (portable)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v7

      - name: Load build versions
        shell: bash
        run: grep -E '^[A-Za-z_]+=' versions.env >> "$GITHUB_ENV"

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown,x86_64-pc-windows-msvc

      - uses: Swatinem/rust-cache@v2
        with:
          key: windows-desktop

      - name: Install trunk
        uses: taiki-e/install-action@v2
        with:
          tool: trunk@${{ env.TRUNK_VERSION }}

      # The embedded daemon serves the web UI (web-ui feature / rust-embed), so
      # the frontend has to be built before the crate is compiled.
      - name: Build frontend
        run: cd rucio-web && trunk build --release --public-url ./

      # Explicit --target so the crt-static rustflags in .cargo/config.toml apply
      # only to the final binary, not to host proc-macros / build scripts.
      - name: Build desktop app
        run: cargo build --release -p rucio-tauri --target x86_64-pc-windows-msvc

      - name: Package (portable ZIP)
        shell: pwsh
        run: |
          $archive = "rucio-${{ github.ref_name }}-windows-x86_64-portable.zip"
          New-Item -ItemType Directory -Force stage | Out-Null
          Copy-Item target/x86_64-pc-windows-msvc/release/rucio-tauri.exe stage/Rucio.exe
          @"
          Rucio - portable build.

          Extract this folder somewhere you can write to (Desktop, Documents -
          NOT Program Files) and run Rucio.exe. All data (settings, database,
          downloads, identity) lives in this same folder, so deleting the folder
          removes everything.

          On first run Windows Firewall will ask whether to allow Rucio to
          communicate on your networks - click Allow for full connectivity
          (incoming connections / High-ID). If you decline, downloads still
          work but the node runs as Low-ID (no incoming connections).

          Requires the Microsoft Edge WebView2 runtime, preinstalled on
          Windows 10/11.
          "@ | Set-Content -Encoding UTF8 stage/README.txt
          Compress-Archive -Path stage/* -DestinationPath $archive -Force
          "ARCHIVE=$archive" | Out-File -FilePath $env:GITHUB_ENV -Append

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: rucio-windows-desktop
          path: ${{ env.ARCHIVE }}
          if-no-files-found: error

  # ---------------------------------------------------------------------------
  # Linux desktop app — the Tauri shell as a Flatpak (own bundle). Builds the
  # release binary on the runner (like rucio-tauri/flatpak/build.sh), then packs
  # it with flatpak-builder into a single-file .flatpak bundle. Pinned to
  # ubuntu-24.04 so the host glibc stays compatible with the GNOME runtime the
  # binary runs against; the runtime version is read from the manifest so the
  # two never drift.
  # ---------------------------------------------------------------------------
  linux-flatpak:
    name: Build Linux desktop (Flatpak)
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7

      - name: Load build versions
        shell: bash
        run: grep -E '^[A-Za-z_]+=' versions.env >> "$GITHUB_ENV"

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown

      - uses: Swatinem/rust-cache@v2
        with:
          key: linux-flatpak

      - name: Install trunk
        uses: taiki-e/install-action@v2
        with:
          tool: trunk@${{ env.TRUNK_VERSION }}

      # WebKitGTK dev libraries to link the Tauri shell (pulls in GTK3, libsoup
      # and JavaScriptCore). The tray backend (libappindicator) is dlopened at
      # runtime, not linked, so it is not needed at build time.
      - name: Install build dependencies
        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev librsvg2-dev

      # The embedded daemon serves the web UI (web-ui feature / rust-embed), so
      # the frontend is built before the crate is compiled.
      - name: Build frontend
        run: cd rucio-web && trunk build --release --public-url ./

      - name: Build desktop app
        run: cargo build --release -p rucio-tauri

      # Ubuntu 24.04 restricts unprivileged user namespaces via AppArmor, which
      # breaks bubblewrap (used by flatpak-builder). Re-enable it on the runner.
      - name: Allow unprivileged user namespaces
        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

      - name: Install Flatpak tooling and the GNOME runtime
        run: |
          sudo apt-get install -y flatpak flatpak-builder
          GNOME_VERSION=$(grep '^runtime-version:' rucio-tauri/flatpak/me.ogarcia.rucio.yml | grep -oE '[0-9]+')
          flatpak remote-add --if-not-exists --user flathub https://flathub.org/repo/flathub.flatpakrepo
          flatpak install -y --user flathub "org.gnome.Platform//$GNOME_VERSION" "org.gnome.Sdk//$GNOME_VERSION"

      - name: Build Flatpak bundle
        shell: bash
        run: |
          flatpak-builder --user --force-clean --repo=repo build-dir \
            rucio-tauri/flatpak/me.ogarcia.rucio.yml
          BUNDLE=rucio-${{ github.ref_name }}-linux-x86_64.flatpak
          flatpak build-bundle repo "$BUNDLE" me.ogarcia.rucio
          echo "ARCHIVE=$BUNDLE" >> "$GITHUB_ENV"

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: rucio-linux-flatpak
          path: ${{ env.ARCHIVE }}
          if-no-files-found: error

  # ---------------------------------------------------------------------------
  # Create GitHub Release and attach all binaries
  # ---------------------------------------------------------------------------
  release:
    name: GitHub Release
    needs: [build, web, windows-desktop, linux-flatpak]
    # Only publish on a real tag push. On manual workflow_dispatch this job is
    # skipped, so the build/web/windows artifacts are produced for download but
    # no release is created.
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - uses: actions/download-artifact@v8
        with:
          path: artifacts
          merge-multiple: true

      - name: Create release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}
          generate_release_notes: true
          files: artifacts/*