release.yml

name: Release

on:
  push:
    tags: ["v*"]

permissions:
  contents: write

jobs:
  build:
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            artifact: usageguard-linux-x86_64
            ext: ""
            can_smoke_test: true
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            artifact: usageguard-linux-aarch64
            ext: ""
            can_smoke_test: false  # cross-compiled, can't run on x86_64 host
          - target: aarch64-apple-darwin
            os: macos-latest
            artifact: usageguard-macos-aarch64
            ext: ""
            can_smoke_test: true
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            artifact: usageguard-windows-x86_64.exe
            ext: ".exe"
            can_smoke_test: true

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install cross-compilation tools (Linux aarch64)
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu
          echo '[target.aarch64-unknown-linux-gnu]' >> ~/.cargo/config.toml
          echo 'linker = "aarch64-linux-gnu-gcc"' >> ~/.cargo/config.toml

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}

      - name: Build release binary
        run: cargo build --release --target ${{ matrix.target }}

      - name: Package binary (Unix)
        if: runner.os != 'Windows'
        run: |
          mkdir -p dist
          cp target/${{ matrix.target }}/release/usageguard dist/${{ matrix.artifact }}
          chmod +x dist/${{ matrix.artifact }}

      - name: Package binary (Windows)
        if: runner.os == 'Windows'
        run: |
          mkdir dist
          copy target\${{ matrix.target }}\release\usageguard.exe dist\${{ matrix.artifact }}

      - name: Generate SHA256 checksum
        shell: bash
        run: |
          cd dist
          sha256sum ${{ matrix.artifact }} > ${{ matrix.artifact }}.sha256
          echo "Checksum:"
          cat ${{ matrix.artifact }}.sha256

      - name: Verify checksum matches binary
        shell: bash
        run: |
          cd dist
          sha256sum -c ${{ matrix.artifact }}.sha256

      - name: Smoke test — run demo (native builds only)
        if: matrix.can_smoke_test
        shell: bash
        run: |
          ./dist/${{ matrix.artifact }} demo
          ./dist/${{ matrix.artifact }} --version
          ./dist/${{ matrix.artifact }} describe > /dev/null

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: |
            dist/${{ matrix.artifact }}
            dist/${{ matrix.artifact }}.sha256

  release:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Collect all binaries and checksums
        run: |
          mkdir -p release
          find artifacts -type f | while read f; do cp "$f" release/; done

      - name: Verify all expected artifacts exist
        run: |
          echo "=== Release contents ==="
          ls -la release/
          echo ""

          expected_binaries=(
            "usageguard-linux-x86_64"
            "usageguard-linux-aarch64"
            "usageguard-macos-aarch64"
            "usageguard-windows-x86_64.exe"
          )

          for bin in "${expected_binaries[@]}"; do
            if [ ! -f "release/$bin" ]; then
              echo "MISSING binary: $bin"
              exit 1
            fi
            echo "OK: $bin ($(wc -c < release/$bin) bytes)"

            if [ ! -f "release/${bin}.sha256" ]; then
              echo "MISSING checksum: ${bin}.sha256"
              exit 1
            fi
            echo "OK: ${bin}.sha256"
          done

          echo ""
          echo "=== All 4 binaries + 4 checksums present ==="

      - name: Verify all checksums are valid
        run: |
          cd release
          for f in *.sha256; do
            echo "Checking $f..."
            sha256sum -c "$f"
          done
          echo "All checksums verified."

      - name: Smoke test Linux x86_64 binary
        run: |
          chmod +x release/usageguard-linux-x86_64
          ./release/usageguard-linux-x86_64 demo
          ./release/usageguard-linux-x86_64 --version
          ./release/usageguard-linux-x86_64 verify examples/dispute/evidence.json

      - name: Create release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create ${{ github.ref_name }} \
            --title "${{ github.ref_name }}" \
            --notes "$(cat <<'EOF'
          ## UsageGuard ${{ github.ref_name }}

          ### Install (no Rust required)

          **Linux x86_64:**
          ```bash
          curl -L https://github.com/verityengine/usageguard/releases/download/${{ github.ref_name }}/usageguard-linux-x86_64 -o usageguard
          curl -L https://github.com/verityengine/usageguard/releases/download/${{ github.ref_name }}/usageguard-linux-x86_64.sha256 -o usageguard.sha256
          sha256sum -c usageguard.sha256
          chmod +x usageguard
          ./usageguard demo
          ```

          **Linux aarch64:**
          ```bash
          curl -L https://github.com/verityengine/usageguard/releases/download/${{ github.ref_name }}/usageguard-linux-aarch64 -o usageguard
          curl -L https://github.com/verityengine/usageguard/releases/download/${{ github.ref_name }}/usageguard-linux-aarch64.sha256 -o usageguard.sha256
          sha256sum -c usageguard.sha256
          chmod +x usageguard
          ./usageguard demo
          ```

          **macOS (Apple Silicon):**
          ```bash
          curl -L https://github.com/verityengine/usageguard/releases/download/${{ github.ref_name }}/usageguard-macos-aarch64 -o usageguard
          curl -L https://github.com/verityengine/usageguard/releases/download/${{ github.ref_name }}/usageguard-macos-aarch64.sha256 -o usageguard.sha256
          shasum -a 256 -c usageguard.sha256
          chmod +x usageguard
          ./usageguard demo
          ```

          **Windows (PowerShell):**
          ```powershell
          Invoke-WebRequest -Uri https://github.com/verityengine/usageguard/releases/download/${{ github.ref_name }}/usageguard-windows-x86_64.exe -OutFile usageguard.exe
          .\usageguard.exe demo
          ```

          ### Verify from source
          ```bash
          git clone https://github.com/verityengine/usageguard.git usageguard-repo
          cd usageguard-repo
          cargo test
          cargo run -- demo
          ```
          EOF
          )" \
            release/*