release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:

permissions:
  contents: read

env:
  NODE_VERSION: "24"
  PNPM_VERSION: "10"

jobs:
  source-gate:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Require release commit on main
        if: github.ref_type == 'tag'
        run: |
          git fetch origin main
          git merge-base --is-ancestor "$GITHUB_SHA" origin/main

      - uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-gnu

      - run: pnpm install --frozen-lockfile
      - run: npm install --global @fission-ai/openspec@1.6.0
      - run: pnpm export:public-source --commit "$GITHUB_SHA" --output "$RUNNER_TEMP/localapp-public" --verify
      - run: pnpm exec openspec validate --all --strict

  native-adapters:
    needs: source-gate
    name: Native adapter ${{ matrix.target }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 35
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-latest
            target: linux-x64
            rust_target: x86_64-unknown-linux-gnu
            artifact_path: tmp/localapp-native/**
          - runner: macos-14
            target: darwin-arm64
            rust_target: aarch64-apple-darwin
            artifact_path: tmp/localapp-native/**
          - runner: macos-15-intel
            target: darwin-x64
            rust_target: x86_64-apple-darwin
            artifact_path: tmp/localapp-native/**
          - runner: windows-2025
            target: win32-x64
            rust_target: x86_64-pc-windows-msvc
            artifact_path: dist/windows-native/**
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rust_target }}

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: packages/localapp/native
          shared-key: native-${{ matrix.target }}

      - run: pnpm install --frozen-lockfile
      - run: pnpm -C packages/localapp test:native

      - name: Build native adapter on Unix
        if: runner.os != 'Windows'
        run: pnpm -C packages/localapp build:native

      - name: Build native adapter on Windows
        if: runner.os == 'Windows'
        shell: pwsh
        run: ./scripts/build-windows-release.ps1 -Mode Release -SkipInstall -OutputDirectory dist/windows-native

      - uses: actions/upload-artifact@v4
        with:
          name: localapp-native-${{ matrix.target }}
          if-no-files-found: error
          path: ${{ matrix.artifact_path }}

  package:
    needs: [source-gate, native-adapters]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-gnu

      - run: pnpm install --frozen-lockfile

      - uses: actions/download-artifact@v4
        with:
          pattern: localapp-native-*
          path: tmp/release-native-adapters

      - name: Pack the single product artifact
        shell: bash
        env:
          LOCALAPP_PREBUILT_NATIVE_ADAPTERS_DIR: ${{ github.workspace }}/tmp/release-native-adapters
        run: |
          pnpm package:localapp
          version="$(node -p "require('./packages/localapp/package.json').version")"
          test -f "tmp/localapp-package/localapp-${version}.tgz"
          if [[ "$(find tmp/localapp-package -maxdepth 1 -type f -name '*.tgz' | wc -l | tr -d ' ')" != "1" ]]; then
            echo "release must contain exactly one npm tarball" >&2
            exit 1
          fi

      - name: Validate npm release candidate
        shell: bash
        run: |
          version="$(node -p "require('./packages/localapp/package.json').version")"
          expected_tag="v${version}"
          if [[ "${GITHUB_REF_TYPE}" == "tag" && "${GITHUB_REF_NAME}" != "${expected_tag}" ]]; then
            echo "release tag ${GITHUB_REF_NAME} must equal ${expected_tag}" >&2
            exit 1
          fi
          node scripts/check-npm-release.mjs \
            --tarball "tmp/localapp-package/localapp-${version}.tgz" \
            --tag "${expected_tag}"

      - name: Generate release manifest and checksums
        shell: bash
        run: |
          version="$(node -p "require('./packages/localapp/package.json').version")"
          tag="${GITHUB_REF_TYPE}-${GITHUB_REF_NAME}"
          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then tag="${GITHUB_REF_NAME}"; else tag="v${version}-dry-run"; fi
          node scripts/generate-release-manifest.mjs \
            --assets-dir tmp/localapp-package \
            --output-dir tmp/localapp-package \
            --base-url "https://github.com/${GITHUB_REPOSITORY}/releases/download/${tag}" \
            --version "${version}" \
            --min-version "${version}"

      - run: node --test scripts/generate-release-manifest.node-test.mjs

      - uses: actions/upload-artifact@v4
        with:
          name: localapp-release
          if-no-files-found: error
          path: |
            tmp/localapp-package/localapp-*.tgz
            tmp/localapp-package/release-manifest.json
            tmp/localapp-package/SHA256SUMS

      - name: Publish GitHub Release assets
        if: github.ref_type == 'tag'
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "${GITHUB_REF_NAME}" tmp/localapp-package/* --verify-tag --generate-notes

  image:
    needs: package
    if: github.ref_type == 'tag'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: localapp-release
          path: tmp/localapp-package
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Normalize GHCR image name
        shell: bash
        run: echo "IMAGE=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"

      - name: Build immutable LocalApp image
        uses: docker/build-push-action@v6
        with:
          context: .
          load: true
          tags: |
            ${{ env.IMAGE }}:${{ github.ref_name }}
            ${{ env.IMAGE }}:sha-${{ github.sha }}

      - name: Smoke test packaged Server
        run: bash scripts/docker-release-smoke.sh "${IMAGE}:${GITHUB_REF_NAME}"

      - name: Push verified LocalApp image
        run: |
          docker push "${IMAGE}:${GITHUB_REF_NAME}"
          docker push "${IMAGE}:sha-${GITHUB_SHA}"