release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"   # triggers on v1.0.0, v0.2.1-beta, etc.

permissions:
  contents: write   # needed to create GitHub Releases, upload assets, and push formula updates
  packages: write   # needed to push to GHCR
  pull-requests: write   # needed to open the Homebrew formula PR

jobs:
  source:
    name: Prepare Source Tree
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Package source tree
        run: tar --exclude='.git' -czf /tmp/source-tree.tar.gz .

      - name: Upload source tree
        uses: actions/upload-artifact@v4
        with:
          name: source-tree
          path: /tmp/source-tree.tar.gz
          retention-days: 1

  # ── 1. Run tests before releasing ─────────────────────────────────────────
  test:
    name: Pre-release Tests
    runs-on: ubuntu-latest
    needs: [source]
    steps:
      - name: Download source tree
        uses: actions/download-artifact@v4
        with:
          name: source-tree
          path: /tmp/source

      - name: Extract source tree
        run: tar -xzf /tmp/source/source-tree.tar.gz -C "$GITHUB_WORKSPACE"

      - uses: actions/setup-go@v5
        with:
          go-version: "1.26"
          cache: true
      - run: go test -race -count=1 ./...

  # ── 2. Cross-compile binaries for all target platforms ────────────────────
  build:
    name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
    runs-on: ubuntu-latest
    needs: [source, test]
    strategy:
      matrix:
        include:
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64
          - goos: darwin
            goarch: amd64
          - goos: darwin
            goarch: arm64
          - goos: windows
            goarch: amd64

    steps:
      - name: Download source tree
        uses: actions/download-artifact@v4
        with:
          name: source-tree
          path: /tmp/source

      - name: Extract source tree
        run: tar -xzf /tmp/source/source-tree.tar.gz -C "$GITHUB_WORKSPACE"

      - uses: actions/setup-go@v5
        with:
          go-version: "1.26"
          cache: true

      - name: Set version from tag
        run: echo "VERSION=${GITHUB_REF_NAME}" >> $GITHUB_ENV

      - name: Build binaries
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: "0"
        run: |
          SUFFIX=""
          if [ "${{ matrix.goos }}" = "windows" ]; then SUFFIX=".exe"; fi

          mkdir -p dist

          go build \
            -ldflags "-X main.version=${VERSION} -s -w" \
            -o "dist/tooltrust-scanner_${{ matrix.goos }}_${{ matrix.goarch }}${SUFFIX}" \
            ./cmd/tooltrust-scanner/

          go build \
            -ldflags "-X main.version=${VERSION} -s -w" \
            -o "dist/tooltrust-mcp_${{ matrix.goos }}_${{ matrix.goarch }}${SUFFIX}" \
            ./cmd/tooltrust-mcp/

      - name: Generate checksums
        run: |
          cd dist
          sha256sum tooltrust-scanner_* tooltrust-mcp_* > checksums_${{ matrix.goos }}_${{ matrix.goarch }}.txt

      - name: Upload binary artifacts
        uses: actions/upload-artifact@v4
        with:
          name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}
          path: dist/
          retention-days: 1

  # ── 3. Create GitHub Release ───────────────────────────────────────────────
  release:
    name: GitHub Release
    runs-on: ubuntu-latest
    needs: [build]

    steps:
      - name: Download all binary artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: binaries-*
          path: dist/
          merge-multiple: true

      - name: List release assets
        run: ls -lh dist/

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: |
            dist/tooltrust-scanner_*
            dist/tooltrust-mcp_*
            dist/checksums_*

  # ── 4. Build and push Docker image to GHCR ────────────────────────────────
  docker:
    name: Docker Image
    runs-on: ubuntu-latest
    needs: [source, test]

    steps:
      - name: Download source tree
        uses: actions/download-artifact@v4
        with:
          name: source-tree
          path: /tmp/source

      - name: Extract source tree
        run: tar -xzf /tmp/source/source-tree.tar.gz -C "$GITHUB_WORKSPACE"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=${{ github.ref_name }}

  # ── 5. Smoke Test Released Binaries ────────────────────────────────────────
  smoke-test:
    name: Smoke Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    needs: [release]
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            goos: linux
            goarch: amd64
            ext: ""
          - os: macos-latest
            goos: darwin
            goarch: arm64
            ext: ""
          - os: windows-latest
            goos: windows
            goarch: amd64
            ext: ".exe"

    steps:
      - name: Download binary artifacts
        uses: actions/download-artifact@v4
        with:
          name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}
          path: dist/

      - name: Make executable (Unix)
        if: runner.os != 'Windows'
        run: |
          chmod +x dist/tooltrust-scanner_${{ matrix.goos }}_${{ matrix.goarch }}${{ matrix.ext }}
          chmod +x dist/tooltrust-mcp_${{ matrix.goos }}_${{ matrix.goarch }}${{ matrix.ext }}

      - name: Create Test JSON
        shell: bash
        run: |
          mkdir -p testdata
          cat << 'EOF' > testdata/tools.json
          {
            "tools": [
              {
                "name": "test_tool",
                "description": "A simple test tool",
                "inputSchema": { "type": "object", "properties": {} }
              }
            ]
          }
          EOF

      - name: Test Scanner CLI
        shell: bash
        run: |
          BIN_PATH="dist/tooltrust-scanner_${{ matrix.goos }}_${{ matrix.goarch }}${{ matrix.ext }}"
          # Try running a basic scan to ensure it doesn't crash
          $BIN_PATH scan --input testdata/tools.json

      - name: Test MCP Server
        shell: bash
        run: |
          BIN_PATH="dist/tooltrust-mcp_${{ matrix.goos }}_${{ matrix.goarch }}${{ matrix.ext }}"
          # Send a basic initialize request and check if it replies without crashing
          echo '{"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {"protocolVersion": "2024-11-05", "capabilities": {}, "clientInfo": {"name": "test", "version": "1.0.0"}}}' | $BIN_PATH

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Test NPM Wrapper
        shell: bash
        run: |
          # Use npx to download and run the wrapper. We must use tooltrust-mcp
          # Note: Since the release was just created, the binary is already available on GitHub.
          npx -y tooltrust-mcp@latest --help

  # ── 6. Update Homebrew Formula ─────────────────────────────────────────────
  update-formula:
    name: Update Homebrew Formula
    runs-on: ubuntu-latest
    needs: [release]

    steps:
      - uses: actions/checkout@v4
        with:
          ref: main
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Compute tarball SHA256
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          URL="https://github.com/${{ github.repository }}/archive/refs/tags/${GITHUB_REF_NAME}.tar.gz"
          SHA256=$(curl -sL "$URL" | shasum -a 256 | awk '{print $1}')
          echo "VERSION=$VERSION" >> $GITHUB_ENV
          echo "SHA256=$SHA256" >> $GITHUB_ENV

      - name: Update Formula/tooltrust-scanner.rb
        run: |
          sed -i "s/version \".*\"/version \"${VERSION}\"/" Formula/tooltrust-scanner.rb
          sed -i "s/sha256 \".*\"/sha256 \"${SHA256}\"/" Formula/tooltrust-scanner.rb

      - name: Create PR for updated formula
        uses: peter-evans/create-pull-request@v7
        with:
          token: ${{ secrets.TOOLTRUST_BOT_TOKEN || secrets.GITHUB_TOKEN }}
          commit-message: "chore: update Homebrew formula to ${{ github.ref_name }}"
          branch: "ci/update-homebrew-formula-${{ github.ref_name }}"
          delete-branch: true
          title: "Update Homebrew formula for ${{ github.ref_name }}"
          body: |
            Updates `Formula/tooltrust-scanner.rb` for release `${{ github.ref_name }}`.

            - bumps the formula version
            - refreshes the source tarball SHA256
          add-paths: |
            Formula/tooltrust-scanner.rb