internal_release.yml

# Internal Release workflow — independent of upstream release.yml / release_nightly.yml.
#
# Trigger:
#   - Push a tag matching `r*` (e.g. `git tag r0.1.0 && git push origin r0.1.0`)
#   - Or manually via Actions → Internal Release → Run workflow
#
# Secrets (all optional — builds still succeed without them):
#   MACOS_CERTIFICATE / MACOS_CERTIFICATE_PASSWORD  — Apple code signing (.p12)
#   APPLE_NOTARIZATION_KEY / _KEY_ID / _ISSUER_ID   — Apple notarization
#   ZED_CLIENT_CHECKSUM_SEED                         — checksum seed baked into binary
#
# Notes:
#   - Windows builds run with CI="" to skip Azure code-signing checks.
#     To enable signing, set the AZURE_* / ACCOUNT_NAME / CERT_PROFILE_NAME /
#     ENDPOINT / FILE_DIGEST / TIMESTAMP_* secrets and remove the `CI: ""` override.
#   - Linux aarch64 requires an ARM runner. GitHub offers `ubuntu-22.04-arm` for
#     Teams/Enterprise plans. If unavailable, remove or comment out the job.

name: Internal Release

on:
  push:
    tags:
      - "r*"
  workflow_dispatch:
    inputs:
      platforms:
        description: "Platforms to build (comma-separated: mac,linux,windows)"
        required: false
        default: "mac,linux,windows"

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: "1"
  CARGO_INCREMENTAL: "0"
  ZED_CLIENT_CHECKSUM_SEED: ${{ secrets.ZED_CLIENT_CHECKSUM_SEED }}

defaults:
  run:
    shell: bash -euxo pipefail {0}

# ─── macOS ────────────────────────────────────────────────────
jobs:
  bundle_mac_aarch64:
    if: github.event_name == 'push' || contains(github.event.inputs.platforms, 'mac')
    runs-on: macos-14
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v4

      - name: Set release channel
        run: echo "nightly" > crates/zed/RELEASE_CHANNEL

      - name: Bundle macOS aarch64
        run: ./script/bundle-mac aarch64-apple-darwin
        env:
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
          APPLE_NOTARIZATION_KEY: ${{ secrets.APPLE_NOTARIZATION_KEY }}
          APPLE_NOTARIZATION_KEY_ID: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }}
          APPLE_NOTARIZATION_ISSUER_ID: ${{ secrets.APPLE_NOTARIZATION_ISSUER_ID }}

      - uses: actions/upload-artifact@v4
        with:
          name: Zed-aarch64.dmg
          path: target/aarch64-apple-darwin/release/Zed-aarch64.dmg
          if-no-files-found: error

      - uses: actions/upload-artifact@v4
        with:
          name: zed-remote-server-macos-aarch64.gz
          path: target/zed-remote-server-macos-aarch64.gz
          if-no-files-found: warn

  bundle_mac_x86_64:
    if: github.event_name == 'push' || contains(github.event.inputs.platforms, 'mac')
    runs-on: macos-13
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v4

      - name: Set release channel
        run: echo "nightly" > crates/zed/RELEASE_CHANNEL

      - name: Bundle macOS x86_64
        run: ./script/bundle-mac x86_64-apple-darwin
        env:
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
          APPLE_NOTARIZATION_KEY: ${{ secrets.APPLE_NOTARIZATION_KEY }}
          APPLE_NOTARIZATION_KEY_ID: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }}
          APPLE_NOTARIZATION_ISSUER_ID: ${{ secrets.APPLE_NOTARIZATION_ISSUER_ID }}

      - uses: actions/upload-artifact@v4
        with:
          name: Zed-x86_64.dmg
          path: target/x86_64-apple-darwin/release/Zed-x86_64.dmg
          if-no-files-found: error

      - uses: actions/upload-artifact@v4
        with:
          name: zed-remote-server-macos-x86_64.gz
          path: target/zed-remote-server-macos-x86_64.gz
          if-no-files-found: warn

  # ─── Linux ──────────────────────────────────────────────────
  bundle_linux_x86_64:
    if: github.event_name == 'push' || contains(github.event.inputs.platforms, 'linux')
    runs-on: ubuntu-22.04
    timeout-minutes: 90
    env:
      CC: clang
      CXX: clang++
    steps:
      - uses: actions/checkout@v4

      - name: Set release channel
        run: echo "nightly" > crates/zed/RELEASE_CHANNEL

      - name: Install system dependencies
        run: ./script/linux

      - name: Download WASI SDK
        run: ./script/download-wasi-sdk

      - name: Bundle Linux x86_64
        run: ./script/bundle-linux

      - uses: actions/upload-artifact@v4
        with:
          name: zed-linux-x86_64.tar.gz
          path: target/release/zed-linux-x86_64.tar.gz
          if-no-files-found: error

      - uses: actions/upload-artifact@v4
        with:
          name: zed-remote-server-linux-x86_64.gz
          path: target/zed-remote-server-linux-x86_64.gz
          if-no-files-found: warn

  # Requires ARM runner — GitHub Teams/Enterprise plan, or self-hosted.
  # Comment out this job if ARM runners are unavailable.
  bundle_linux_aarch64:
    if: github.event_name == 'push' || contains(github.event.inputs.platforms, 'linux')
    runs-on: ubuntu-22.04-arm
    timeout-minutes: 90
    env:
      CC: clang
      CXX: clang++
    steps:
      - uses: actions/checkout@v4

      - name: Set release channel
        run: echo "nightly" > crates/zed/RELEASE_CHANNEL

      - name: Install system dependencies
        run: ./script/linux

      - name: Download WASI SDK
        run: ./script/download-wasi-sdk

      - name: Bundle Linux aarch64
        run: ./script/bundle-linux

      - uses: actions/upload-artifact@v4
        with:
          name: zed-linux-aarch64.tar.gz
          path: target/release/zed-linux-aarch64.tar.gz
          if-no-files-found: error

      - uses: actions/upload-artifact@v4
        with:
          name: zed-remote-server-linux-aarch64.gz
          path: target/zed-remote-server-linux-aarch64.gz
          if-no-files-found: warn

  # ─── Windows ────────────────────────────────────────────────
  bundle_windows_x86_64:
    if: github.event_name == 'push' || contains(github.event.inputs.platforms, 'windows')
    runs-on: windows-2022
    timeout-minutes: 90
    env:
      CI: ""
    steps:
      - uses: actions/checkout@v4

      - name: Set release channel
        run: |
          $ErrorActionPreference = "Stop"
          "nightly" | Set-Content -Path "crates/zed/RELEASE_CHANNEL" -NoNewline
        shell: pwsh

      - name: Bundle Windows x86_64
        run: script/bundle-windows.ps1 -Architecture x86_64
        shell: pwsh

      - uses: actions/upload-artifact@v4
        with:
          name: Zed-x86_64.exe
          path: target/Zed-x86_64.exe
          if-no-files-found: error

      - uses: actions/upload-artifact@v4
        with:
          name: zed-remote-server-windows-x86_64.zip
          path: target/zed-remote-server-windows-x86_64.zip
          if-no-files-found: warn

  bundle_windows_aarch64:
    if: github.event_name == 'push' || contains(github.event.inputs.platforms, 'windows')
    runs-on: windows-2022
    timeout-minutes: 90
    env:
      CI: ""
    steps:
      - uses: actions/checkout@v4

      - name: Set release channel
        run: |
          $ErrorActionPreference = "Stop"
          "nightly" | Set-Content -Path "crates/zed/RELEASE_CHANNEL" -NoNewline
        shell: pwsh

      - name: Bundle Windows aarch64
        run: script/bundle-windows.ps1 -Architecture aarch64
        shell: pwsh

      - uses: actions/upload-artifact@v4
        with:
          name: Zed-aarch64.exe
          path: target/Zed-aarch64.exe
          if-no-files-found: error

      - uses: actions/upload-artifact@v4
        with:
          name: zed-remote-server-windows-aarch64.zip
          path: target/zed-remote-server-windows-aarch64.zip
          if-no-files-found: warn

  # ─── GitHub Release ─────────────────────────────────────────
  create_release:
    needs:
      - bundle_mac_aarch64
      - bundle_mac_x86_64
      - bundle_linux_x86_64
      - bundle_linux_aarch64
      - bundle_windows_x86_64
      - bundle_windows_aarch64
    if: always() && !cancelled() && startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: ./artifacts/

      - name: Collect release artifacts
        run: |
          mkdir -p release/
          for dir in ./artifacts/*/; do
            for file in "$dir"*; do
              [ -f "$file" ] && cp "$file" release/
            done
          done
          echo "=== Release artifacts ==="
          ls -lh release/

      - name: Create draft GitHub Release
        run: |
          TAG="${GITHUB_REF_NAME}"
          gh release create "$TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --title "Internal Release ${TAG}" \
            --notes "$(cat <<'EOF'
          Build from ${{ github.sha }}

          | Platform | Client | Remote Server |
          |----------|--------|---------------|
          | macOS Apple Silicon | Zed-aarch64.dmg | zed-remote-server-macos-aarch64.gz |
          | macOS Intel | Zed-x86_64.dmg | zed-remote-server-macos-x86_64.gz |
          | Linux x86_64 | zed-linux-x86_64.tar.gz | zed-remote-server-linux-x86_64.gz |
          | Linux aarch64 | zed-linux-aarch64.tar.gz | zed-remote-server-linux-aarch64.gz |
          | Windows x86_64 | Zed-x86_64.exe | zed-remote-server-windows-x86_64.zip |
          | Windows aarch64 | Zed-aarch64.exe | zed-remote-server-windows-aarch64.zip |
          EOF
          )" \
            --draft \
            release/* 2>/dev/null || true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}