release.yml

name: Release

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
      - "v[0-9]+.[0-9]+.[0-9]+-*"
  workflow_dispatch:
    inputs:
      version:
        description: "Version to release, e.g. 0.1.6 (must match Cargo.toml)"
        required: true

env:
  CARGO_TERM_COLOR: always

permissions: {}

jobs:
  resolve:
    name: Resolve version
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      version: ${{ steps.v.outputs.version }}
      tag: ${{ steps.v.outputs.tag }}
      targets: ${{ steps.targets.outputs.json }}
    steps:
      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit
      # The one list of prebuilt targets: the binaries matrix builds it and
      # the assets job checks the release against it, so neither can drift.
      #
      # Mirrors soothfast-sdk's Target::DEFAULT matrix (target.rs). Intel
      # macOS cross-compiles on the arm64 runner: the macOS SDK carries both
      # architectures, and a job pinned to the retired Intel image is never
      # scheduled at all, it sits queued until GitHub times it out a day
      # later, cancelled, having produced no binary and no failure.
      - name: List the prebuilt targets
        id: targets
        run: |
          json=$(jq -c . <<'EOF'
          [
            {"target": "x86_64-unknown-linux-gnu", "runner": "ubuntu-latest"},
            {"target": "aarch64-unknown-linux-gnu", "runner": "ubuntu-24.04-arm"},
            {"target": "x86_64-apple-darwin", "runner": "macos-latest"},
            {"target": "aarch64-apple-darwin", "runner": "macos-latest"},
            {"target": "x86_64-pc-windows-msvc", "runner": "windows-latest"}
          ]
          EOF
          )
          echo "json=$json" >> "$GITHUB_OUTPUT"
      - name: Resolve and validate
        id: v
        env:
          GH_TOKEN: ${{ github.token }}
          EVENT: ${{ github.event_name }}
          REF_NAME: ${{ github.ref_name }}
          INPUT_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          if [ "$EVENT" = "workflow_dispatch" ]; then
            VERSION="${INPUT_VERSION#v}"
            if [ "$REF_NAME" != "master" ]; then
              echo "::error::Dispatch a release from master, not $REF_NAME"
              exit 1
            fi
            if gh api "repos/${{ github.repository }}/git/ref/tags/v$VERSION" >/dev/null 2>&1; then
              echo "::error::Tag v$VERSION already exists"
              exit 1
            fi
          else
            VERSION="${GITHUB_REF#refs/tags/v}"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
          echo "Releasing v$VERSION"

  checks:
    name: Pre-release checks
    runs-on: ubuntu-latest
    needs: [resolve]
    permissions:
      contents: read
    steps:
      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
        with:
          toolchain: stable
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          lookup-only: true
      - name: Verify release version matches workspace version
        env:
          TAG_VERSION: ${{ needs.resolve.outputs.version }}
        run: |
          CARGO_VERSION=$(cargo metadata --format-version 1 --no-deps \
            | grep -o '"name":"soothfast","version":"[^"]*"' \
            | head -1 | sed 's/.*"version":"\([^"]*\)".*/\1/')
          if [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
            echo "::error::Release version ($TAG_VERSION) does not match workspace version ($CARGO_VERSION)"
            exit 1
          fi
          echo "Version verified: $TAG_VERSION"
      - run: cargo fmt --all --check
      - run: cargo clippy --workspace --all-targets -- -D warnings
      - run: cargo test --workspace

  dry-run:
    name: Publish dry-run
    runs-on: ubuntu-latest
    needs: [checks]
    permissions:
      contents: read
    steps:
      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          lookup-only: true
      - name: Package each crate in dependency order
        run: |
          for crate in soothfast-macros soothfast-registry soothfast-measure \
                       soothfast-docs soothfast-spec soothfast-sdk soothfast-report \
                       soothfast-site soothfast cargo-soothfast; do
            echo "::group::cargo package -p $crate"
            cargo package --no-verify --list -p "$crate"
            echo "::endgroup::"
          done

  publish:
    name: Publish to crates.io
    runs-on: ubuntu-latest
    needs: [resolve, checks, dry-run]
    environment: release # manual approval: add required reviewers in settings
    permissions:
      id-token: write # mint a short-lived crates.io token via OIDC
      contents: write # create the tag when dispatched
    steps:
      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit
      # github.token, not the app token: an app-token tag push would re-trigger
      # this workflow and release the same version twice.
      - name: Tag this release
        if: github.event_name == 'workflow_dispatch'
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.resolve.outputs.tag }}
        run: |
          gh api -X POST "repos/${{ github.repository }}/git/refs" \
            -f ref="refs/tags/$TAG" -f sha="${{ github.sha }}"
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          fetch-depth: 0 # previous-tag lookup + surface diff need history
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          lookup-only: true
      - name: Authenticate to crates.io (OIDC)
        id: auth
        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
      - name: Publish crates in dependency order
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
        run: |
          for crate in soothfast-macros soothfast-registry soothfast-measure \
                       soothfast-docs soothfast-spec soothfast-sdk soothfast-report \
                       soothfast-site soothfast cargo-soothfast; do
            echo "::group::cargo publish -p $crate"
            cargo publish -p "$crate"
            echo "::endgroup::"
            # Give the crates.io index time to pick up the new version before
            # publishing a crate that depends on it.
            sleep 30
          done

  # The release itself is authored by soothfast-bot; the broker accepts the
  # tag because its commit is already on master.
  release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs: [resolve, publish]
    environment: soothfast-bot
    permissions:
      contents: read
      id-token: write # soothfast-bot token creates the release
    outputs:
      tag: ${{ needs.resolve.outputs.tag }}
    steps:
      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          fetch-depth: 0 # previous-tag lookup + surface diff need history
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
        with:
          toolchain: stable
      - name: Pin the rustdoc toolchain
        run: |
          TC=$(make -s print-SOOTHFAST_RUSTDOC_TOOLCHAIN)
          echo "SOOTHFAST_RUSTDOC_TOOLCHAIN=$TC" >> "$GITHUB_ENV"
          rustup toolchain install "$TC"
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          lookup-only: true
      # Dogfood: release assets are produced from this tag's own measurements.
      - name: Produce release report from recorded measurements
        run: |
          for crate in soothfast-registry soothfast-measure soothfast-docs; do
            cargo run --release -p cargo-soothfast -- \
              measure -p "$crate" --save-baseline self
          done
          cargo run --release -p cargo-soothfast -- \
            report render -p soothfast --baseline self --out target/release-report

      - name: Extract CHANGELOG section for this version
        id: changelog
        env:
          TAG_VERSION: ${{ needs.resolve.outputs.version }}
        run: |
          NOTES=""
          if [ -f CHANGELOG.md ]; then
            # soothfast:notes markers anchor cargo-soothfast's changelog merge and
            # have no meaning on the published release, so they're dropped here.
            NOTES=$(awk -v ver="$TAG_VERSION" '
              $0 ~ "^## " ver "([^0-9]|$)" { found=1; next }
              found && /^## / { exit }
              found && /^<!-- \/?soothfast:notes -->$/ { next }
              found { print }
            ' CHANGELOG.md | awk '
              function trim(s) { sub(/^[[:space:]]+/, "", s); return s }
              /^```/ { if (buf != "") { print buf; buf = "" }; print; fence = !fence; next }
              fence { print; next }
              /^[[:space:]]*$/ { if (buf != "") { print buf; buf = "" }; print; next }
              /^(#{1,6} |\||[-*] |[0-9]+\. )/ { if (buf != "") { print buf }; buf = $0; next }
              { t = trim($0); buf = (buf == "" ? t : buf " " t) }
              END { if (buf != "") print buf }
            ')
          fi
          if [ -z "$NOTES" ]; then
            echo "No CHANGELOG entry found for $TAG_VERSION; using auto-generated notes"
            echo "use_auto=true" >> "$GITHUB_OUTPUT"
          else
            echo "use_auto=false" >> "$GITHUB_OUTPUT"
            printf '%s\n' "$NOTES" > /tmp/release_notes.md
          fi

      - name: Mint a soothfast-bot token
        id: bot
        run: action/bot-token.sh
      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ steps.bot.outputs.token }}
          TAG: ${{ needs.resolve.outputs.tag }}
          USE_AUTO: ${{ steps.changelog.outputs.use_auto }}
        run: |
          ASSETS=""
          [ -f target/release-report/summary.md ] && ASSETS="$ASSETS target/release-report/summary.md"
          [ -f target/release-report/llms.txt ] && ASSETS="$ASSETS target/release-report/llms.txt"
          if [ "$USE_AUTO" = "true" ]; then
            gh release create "$TAG" --verify-tag --title "$TAG" --generate-notes $ASSETS
          else
            gh release create "$TAG" --verify-tag --title "$TAG" --notes-file /tmp/release_notes.md $ASSETS
          fi
      - name: Revoke the soothfast-bot token
        if: always() && steps.bot.outputs.token != ''
        env:
          GH_TOKEN: ${{ steps.bot.outputs.token }}
        run: gh api -X DELETE /installation/token

  binaries:
    name: Prebuilt cargo-soothfast (${{ matrix.target }})
    runs-on: ${{ matrix.runner }}
    needs: [resolve, release]
    permissions:
      contents: write # upload the release asset
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(needs.resolve.outputs.targets) }}
    steps:
      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
        with:
          toolchain: stable
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: ${{ matrix.target }}
          lookup-only: true
      - name: Build release binary
        run: cargo build --release --locked -p cargo-soothfast --target ${{ matrix.target }}
      # Asset name follows cargo-binstall's default convention, matched by
      # [package.metadata.binstall] in cargo-soothfast/Cargo.toml.
      - name: Package and upload release asset
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.resolve.outputs.tag }}
          VERSION: ${{ needs.resolve.outputs.version }}
          TARGET: ${{ matrix.target }}
        run: |
          BIN=cargo-soothfast
          [ "$TARGET" = x86_64-pc-windows-msvc ] && BIN=cargo-soothfast.exe
          ASSET="cargo-soothfast-v${VERSION}-${TARGET}.tgz"
          tar -C "target/${TARGET}/release" -czf "$ASSET" "$BIN"
          gh release upload "$TAG" "$ASSET" --clobber

  # A cancelled matrix job uploads nothing and fails nothing, so a release can
  # complete a binary short. Count what actually landed instead of trusting
  # the run's colour. `always()` because a cancelled dependency would
  # otherwise skip this job — the exact case it exists to catch.
  assets:
    name: Every prebuilt binary is attached
    runs-on: ubuntu-latest
    needs: [resolve, binaries]
    if: always() && needs.resolve.result == 'success'
    permissions:
      contents: read
    steps:
      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit
      - name: Every target's binary is attached
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          TAG: ${{ needs.resolve.outputs.tag }}
          VERSION: ${{ needs.resolve.outputs.version }}
          TARGETS: ${{ needs.resolve.outputs.targets }}
        run: |
          expected=$(jq -r --arg v "$VERSION" '.[] | "cargo-soothfast-v\($v)-\(.target).tgz"' <<<"$TARGETS" | sort)
          attached=$(gh release view "$TAG" --repo "$REPO" --json assets \
            --jq '.assets[].name | select(endswith(".tgz"))' | sort)
          missing=$(comm -23 <(echo "$expected") <(echo "$attached"))
          extra=$(comm -13 <(echo "$expected") <(echo "$attached"))
          echo "attached: $(grep -c . <<<"$attached"), expected: $(grep -c . <<<"$expected")"
          if [ -n "$extra" ]; then
            echo "::warning::$TAG has binaries no target produced:"
            echo "$extra"
          fi
          if [ -n "$missing" ]; then
            echo "::error::$TAG is missing prebuilt binaries:"
            echo "$missing"
            exit 1
          fi