release.yml

name: "Release"

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Release version"
        required: true
        type: string

permissions:
  contents: write

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release:
    runs-on: macos-26
    env:
      VERSION: ${{ inputs.version }}

    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup
        with:
          metal: true
          bindings: true

      - name: "Release: Checkout main"
        uses: actions/checkout@v6
        with:
          ref: main
          fetch-depth: 0
          persist-credentials: false

      - name: "Release: Validate version"
        run: |
          set -euo pipefail
          git fetch --tags origin

          # 1. Tag must not already exist (locally or on origin)
          if git rev-parse -q --verify "refs/tags/${VERSION}" >/dev/null \
             || git ls-remote --tags origin "refs/tags/${VERSION}" | grep -q .; then
            echo "Tag ${VERSION} already exists"; exit 1
          fi

          # 2. New version must be greater than every existing tag (semver-aware sort)
          latest=$(git tag --list | sort -V | tail -n1 || true)
          if [ -n "$latest" ]; then
            highest=$(printf '%s\n%s\n' "$latest" "${VERSION}" | sort -V | tail -n1)
            if [ "$highest" != "${VERSION}" ] || [ "$latest" = "${VERSION}" ]; then
              echo "Version ${VERSION} is not greater than latest tag $latest"; exit 1
            fi
            echo "Bumping ${latest} -> ${VERSION}"
          else
            echo "No previous tags; ${VERSION} is the first release"
          fi

      - name: "Release: Validate npm publish access"
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          set -euo pipefail

          : "${NODE_AUTH_TOKEN:?NPM_TOKEN secret is required}"

          npm_package_name="@trymirai/uzu"
          npm_username=$(npm whoami --registry=https://registry.npmjs.org)
          npm_package_owners=$(npm owner ls "$npm_package_name" --registry=https://registry.npmjs.org)
          npm_package_versions_json=$(npm view "$npm_package_name" versions --json --registry=https://registry.npmjs.org)

          NPM_PACKAGE_NAME="$npm_package_name" \
          NPM_PACKAGE_OWNERS="$npm_package_owners" \
          NPM_PACKAGE_VERSIONS_JSON="$npm_package_versions_json" \
          NPM_USERNAME="$npm_username" \
            node --input-type=module <<'NODE'
          const packageName = process.env.NPM_PACKAGE_NAME;
          const packageOwners = (process.env.NPM_PACKAGE_OWNERS ?? "")
            .split("\n")
            .map((line) => line.split(/\s+/)[0])
            .filter(Boolean);
          const packageVersionsValue = JSON.parse(process.env.NPM_PACKAGE_VERSIONS_JSON ?? "[]");
          const packageVersions = Array.isArray(packageVersionsValue) ? packageVersionsValue : [packageVersionsValue];

          if (!packageOwners.includes(process.env.NPM_USERNAME)) {
            console.error(
              `NPM user ${process.env.NPM_USERNAME} is not an owner of ${packageName}; ownership is required to publish.`,
            );
            process.exit(1);
          }

          if (packageVersions.includes(process.env.VERSION)) {
            console.error(`${packageName}@${process.env.VERSION} already exists on npm.`);
            process.exit(1);
          }

          console.log(`NPM user ${process.env.NPM_USERNAME} is an owner of ${packageName}.`);
          NODE

      - name: "Binaries: Import developer identity certificate"
        shell: bash
        env:
          TEAM_ID: ${{ secrets.APPLE_DEVELOPMENT_TEAM_ID }}
        run: |
          set -euo pipefail
          CERT_P12="$RUNNER_TEMP/dev_id_app.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/release-signing.keychain-db"
          KEYCHAIN_PASSWORD=""

          echo "${{ secrets.APPLE_DEVELOPER_ID_P12 }}" | base64 -D > "$CERT_P12"
          security delete-keychain "$KEYCHAIN_PATH" 2>/dev/null || true
          rm -f "$KEYCHAIN_PATH"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          existing_keychains=()
          while IFS= read -r existing_keychain; do
            existing_keychain=$(printf '%s\n' "$existing_keychain" | sed -E 's/^[[:space:]]*"//; s/"[[:space:]]*$//')
            if [ -n "$existing_keychain" ] && [ "$existing_keychain" != "$KEYCHAIN_PATH" ]; then
              existing_keychains+=("$existing_keychain")
            fi
          done < <(security list-keychains -d user)
          security list-keychains -d user -s "$KEYCHAIN_PATH" "${existing_keychains[@]}"

          security import "$CERT_P12" \
            -k "$KEYCHAIN_PATH" \
            -P "${{ secrets.APPLE_DEVELOPER_ID_PASSWORD }}" \
            -T /usr/bin/codesign

          if ! security set-key-partition-list \
            -S apple-tool:,apple:,codesign: \
            -s \
            -k "$KEYCHAIN_PASSWORD" \
            "$KEYCHAIN_PATH" >/dev/null 2>&1; then
            echo "Unable to set key partition list for imported signing identity" >&2
            exit 1
          fi

          SIGNING_IDENTITY=$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" \
            | grep 'Developer ID Application:' \
            | grep "(${TEAM_ID})" \
            | sed -nE 's/.*"(.*)".*/\1/p' \
            | head -n1 || true)
          if [ -z "$SIGNING_IDENTITY" ]; then
            echo "Imported keychain does not contain a valid Developer ID Application identity for team $TEAM_ID" >&2
            security find-identity -v -p codesigning "$KEYCHAIN_PATH" || true
            exit 1
          fi

          echo "SIGNING_KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"
          echo "SIGNING_IDENTITY=$SIGNING_IDENTITY" >> "$GITHUB_ENV"

      - name: "Release: Install tools"
        run: |
          cargo tools setup
          cargo tools install rust
          cargo tools install python
          cargo tools install swift
          cargo tools install typescript

      - name: "Release: Sync"
        run: cargo tools sync

      - name: "Release: Build artifacts"
        run: cargo tools release "${VERSION}"

      - name: "Binaries: Codesign"
        shell: bash
        run: |
          set -euo pipefail

          security unlock-keychain -p "" "$SIGNING_KEYCHAIN_PATH"

          signed=0
          while IFS= read -r -d '' binary_path; do
            chmod +x "$binary_path"
            codesign --force --options runtime --timestamp \
              --sign "$SIGNING_IDENTITY" \
              "$binary_path"
            codesign --verify --strict --verbose=2 "$binary_path"
            signed=$((signed + 1))
          done < <(find workspace/release/binaries \
            -type f \
            ! -name '.DS_Store' \
            ! -name '*.zip' \
            ! -name '*.tar.gz' \
            -print0)

          if [ "$signed" -eq 0 ]; then
            echo "No binaries found under workspace/release/binaries" >&2
            exit 1
          fi

      - name: "Binaries: Package"
        shell: bash
        run: |
          set -euo pipefail

          zip_root="workspace/release/notarization"
          mkdir -p "$zip_root"

          packaged=0
          while IFS= read -r -d '' binary_path; do
            binary_dir=$(dirname "$binary_path")
            artifact_name=$(basename "$binary_path")
            zip_path="$zip_root/${artifact_name}.zip"
            tarball_path="$binary_dir/${artifact_name}.tar.gz"

            rm -f "$zip_path" "$tarball_path"
            ditto -c -k --sequesterRsrc --keepParent "$binary_path" "$zip_path"
            tar -czf "$tarball_path" -C "$binary_dir" "$artifact_name"
            packaged=$((packaged + 1))
          done < <(find workspace/release/binaries \
            -type f \
            ! -name '.DS_Store' \
            ! -name '*.zip' \
            ! -name '*.tar.gz' \
            -print0)

          if [ "$packaged" -eq 0 ]; then
            echo "No binaries found under workspace/release/binaries" >&2
            exit 1
          fi

      - name: "Binaries: Notarize"
        shell: bash
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          TEAM_ID: ${{ secrets.APPLE_DEVELOPMENT_TEAM_ID }}
        run: |
          set -euo pipefail

          notarized=0
          while IFS= read -r -d '' zip_path; do
            xcrun notarytool submit "$zip_path" \
              --apple-id "$APPLE_ID" \
              --team-id "$TEAM_ID" \
              --password "$APPLE_APP_SPECIFIC_PASSWORD" \
              --wait
            notarized=$((notarized + 1))
          done < <(find workspace/release/notarization -type f -name '*.zip' -print0)

          if [ "$notarized" -eq 0 ]; then
            echo "No notarization zips found under workspace/release/notarization" >&2
            exit 1
          fi

      # ---------------------------------------------------------------
      # Commit + tag locally now, while the workspace only contains
      # sync/build output. Publishes below write credential files and
      # clone other repos into the workspace, which would otherwise be
      # swept into `git add -A`. The push happens at the very end,
      # after every publish step has succeeded.
      # ---------------------------------------------------------------
      - name: "Release: Commit and tag"
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add -A
          if git diff --staged --quiet; then
            echo "No changes to commit"
          else
            git commit -m "Release ${VERSION}"
          fi
          git tag "${VERSION}"

      # ---------------------------------------------------------------
      # Publish Platform
      # ---------------------------------------------------------------
      - name: "Publish Platform: Authenticate to GCS"
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.PLATFORM_BUCKET_JSON_CREDENTIALS }}

      - name: "Publish Platform: Setup gcloud"
        uses: google-github-actions/setup-gcloud@v2

      - name: "Publish Platform: Upload snippets"
        run: |
          gcloud storage rsync workspace/release/platform \
            "gs://platform-bucket-0485e11/snippets" \
            --recursive --delete-unmatched-destination-objects

      # ---------------------------------------------------------------
      # Publish Swift
      # ---------------------------------------------------------------
      - name: "Publish Swift: Authenticate to GCS"
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.ARTIFACTS_BUCKET_JSON_CREDENTIALS }}

      - name: "Publish Swift: Setup gcloud"
        uses: google-github-actions/setup-gcloud@v2

      - name: "Publish Swift: Upload xcframework"
        run: |
          set -euo pipefail
          GS_URI="gs://artifacts-bucket-cd05ceb/uzu-swift/releases/${VERSION}.zip"
          if gsutil -q stat "$GS_URI"; then
            echo "Release zip already exists at $GS_URI"; exit 1
          fi
          gsutil cp "workspace/release/swift-spm/${VERSION}.zip" "$GS_URI"

      # ---------------------------------------------------------------
      # Publish TypeScript
      # ---------------------------------------------------------------
      - name: "Publish TypeScript"
        working-directory: workspace/release/typescript-npm
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: pnpm publish --access public --no-git-checks

      # ---------------------------------------------------------------
      # Publish Python
      # ---------------------------------------------------------------
      - name: "Publish Python"
        env:
          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_TOKEN }}
        run: |
          uv publish workspace/release/python-pypi/*.whl

      # ---------------------------------------------------------------
      # Publish Docs
      # ---------------------------------------------------------------
      - name: "Publish Docs: Generate GitHub App token"
        id: docs-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ vars.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          owner: trymirai
          repositories: docs

      - name: "Publish Docs: Checkout repo"
        uses: actions/checkout@v6
        with:
          repository: trymirai/docs
          ref: main
          token: ${{ steps.docs-token.outputs.token }}
          path: docs-repo
          persist-credentials: false

      - name: "Publish Docs: Sync"
        run: |
          set -euo pipefail
          rsync -a --delete \
            --exclude '.git' --exclude '.git/*' \
            workspace/release/docs/ docs-repo/snippets/generated/

      - name: "Publish Docs: Commit and push changes"
        env:
          GH_TOKEN: ${{ steps.docs-token.outputs.token }}
        run: |
          set -euo pipefail
          cd docs-repo
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add -A
          if git diff --staged --quiet; then
            echo "No docs changes to commit"
          else
            git commit -m "Release ${VERSION}"
            git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/trymirai/docs.git"
            git push origin HEAD:main
          fi

      # ---------------------------------------------------------------
      # Push the release commit and tag now that every publish has
      # succeeded. The commit and tag were created locally before any
      # publish step ran, so the workspace pollution from publishes
      # never makes it into the commit.
      # ---------------------------------------------------------------
      - name: "Release: Generate GitHub App token"
        id: release-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ vars.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          owner: trymirai
          repositories: uzu

      - name: "Release: Push"
        env:
          GH_TOKEN: ${{ steps.release-token.outputs.token }}
        run: |
          set -euo pipefail
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/trymirai/uzu.git"
          git push origin HEAD:main
          git push origin "${VERSION}"

      - name: "Release: Attach binaries"
        uses: softprops/action-gh-release@v2
        with:
          token: ${{ steps.release-token.outputs.token }}
          tag_name: ${{ env.VERSION }}
          name: ${{ env.VERSION }}
          files: workspace/release/binaries/**/*.tar.gz
          fail_on_unmatched_files: true