release.yml

name: Release MemoryProof / 发布 MemoryProof

on:
  push:
    tags: ["v*"]

permissions:
  contents: write

jobs:
  binaries:
    name: Build ${{ matrix.name }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            name: linux-x86_64
            archive: memoryproof-linux-x86_64.tar.gz
            shell: bash
          - os: macos-15-intel
            name: macos-x86_64
            archive: memoryproof-macos-x86_64.tar.gz
            shell: bash
          - os: macos-14
            name: macos-arm64
            archive: memoryproof-macos-arm64.tar.gz
            shell: bash
          - os: windows-latest
            name: windows-x86_64
            archive: memoryproof-windows-x86_64.zip
            shell: pwsh
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - run: cargo build --release --bins
      - name: Package Unix binaries
        if: runner.os != 'Windows'
        run: tar -czf "${{ matrix.archive }}" -C target/release memoryproof forgetproof -C "$GITHUB_WORKSPACE" python/forgetproof_adapters
      - name: Package Windows binaries
        if: runner.os == 'Windows'
        shell: pwsh
        run: Compress-Archive -Path target/release/memoryproof.exe,target/release/forgetproof.exe,python/forgetproof_adapters -DestinationPath "${{ matrix.archive }}"
      - uses: actions/upload-artifact@v7
        with:
          name: binary-${{ matrix.name }}
          path: ${{ matrix.archive }}

  python:
    name: Build Python distribution
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.11"
      - run: python -m pip install --upgrade build
      - run: python -m build
      - uses: actions/upload-artifact@v7
        with:
          name: python-package
          path: dist/

  release:
    name: Create GitHub release
    needs: [binaries, python]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v8
        with:
          path: dist
          pattern: binary-*
          merge-multiple: true
      - uses: actions/download-artifact@v8
        with:
          name: python-package
          path: dist
      - name: Create or update release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if gh release view "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
            gh release upload "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" dist/* --clobber
          else
            gh release create "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" \
              --title "MemoryProof ${GITHUB_REF_NAME}" --generate-notes dist/*
          fi

  container:
    name: Publish OCI image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v7
      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push multi-architecture image
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ghcr.io/hughhhhcoder/memoryproof:${{ github.ref_name }}
            ghcr.io/hughhhhcoder/memoryproof:1
            ghcr.io/hughhhhcoder/memoryproof:latest
          labels: |
            org.opencontainers.image.source=https://github.com/Hughhhhcoder/MemoryProof
            org.opencontainers.image.description=Evidence-driven memory assurance for AI agents
          annotations: |
            manifest:org.opencontainers.image.title=MemoryProof
            manifest:org.opencontainers.image.description=Evidence-driven memory assurance for AI agents
            manifest:org.opencontainers.image.source=https://github.com/Hughhhhcoder/MemoryProof
            manifest:org.opencontainers.image.licenses=Apache-2.0
          provenance: mode=max
          sbom: true

  publish-pypi:
    name: Publish PyPI package (opt-in)
    if: vars.PUBLISH_PYPI == 'true' && startsWith(github.ref, 'refs/tags/v')
    needs: python
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    environment:
      name: pypi
      url: https://pypi.org/p/memoryproof-adapters
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: python-package
          path: dist
      - uses: pypa/gh-action-pypi-publish@release/v1