release.yml

name: Release

on:
  push:
    tags: ["v*"]

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    name: build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-latest, target: x86_64-unknown-linux-gnu, ext: "" }
          - { os: ubuntu-latest, target: x86_64-unknown-linux-musl, ext: "" }
          - { os: ubuntu-latest, target: aarch64-unknown-linux-gnu, ext: "", cross: true }
          - { os: macos-latest, target: x86_64-apple-darwin, ext: "" }
          - { os: macos-latest, target: aarch64-apple-darwin, ext: "" }
          - { os: windows-latest, target: x86_64-pc-windows-msvc, ext: ".exe" }
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}

      - name: Install musl tools
        if: matrix.target == 'x86_64-unknown-linux-musl'
        run: sudo apt-get update && sudo apt-get install -y musl-tools

      - name: Install cross
        if: matrix.cross
        run: cargo install cross --locked

      - name: Build (cross)
        if: matrix.cross
        run: cross build --release --target ${{ matrix.target }} -p codegraph

      - name: Build (native)
        if: ${{ !matrix.cross }}
        run: cargo build --release --target ${{ matrix.target }} -p codegraph

      - name: Package
        shell: bash
        run: |
          set -euo pipefail
          bin="target/${{ matrix.target }}/release/codegraph${{ matrix.ext }}"
          name="codegraph-${{ matrix.target }}"
          mkdir -p dist staging
          cp "$bin" staging/
          [ -f README.md ] && cp README.md staging/ || true
          [ -f LICENSE   ] && cp LICENSE   staging/ || true
          if [[ "${{ matrix.ext }}" == ".exe" ]]; then
            ( cd staging && 7z a "../dist/${name}.zip" . )
          else
            tar -czf "dist/${name}.tar.gz" -C staging .
          fi

      - uses: actions/upload-artifact@v6
        with:
          name: codegraph-${{ matrix.target }}
          path: dist/*

  release:
    name: GitHub Release
    needs: build
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    outputs:
      tag: ${{ steps.tag.outputs.tag }}
      version: ${{ steps.tag.outputs.version }}
    steps:
      - uses: actions/checkout@v6
      - uses: actions/download-artifact@v6
        with:
          path: artifacts
          merge-multiple: true

      - name: Resolve tag
        id: tag
        run: |
          set -euo pipefail
          tag="${GITHUB_REF#refs/tags/}"
          [[ "$tag" =~ ^v ]] || { echo "tag must start with v" >&2; exit 1; }
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          echo "version=${tag#v}" >> "$GITHUB_OUTPUT"

      - name: Create release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          tag="${{ steps.tag.outputs.tag }}"
          gh release view "$tag" >/dev/null 2>&1 \
            && gh release upload "$tag" artifacts/* --clobber \
            || gh release create "$tag" --draft --title "$tag" --generate-notes artifacts/*

  aur:
    name: Publish AUR (codegraph-rs-bin)
    needs: release
    runs-on: ubuntu-latest
    if: ${{ needs.release.outputs.tag != '' }}
    steps:
      - uses: actions/checkout@v6

      - name: Download release archives
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ needs.release.outputs.tag }}
        run: |
          set -euo pipefail
          mkdir -p dl
          gh release download "$TAG" \
            --repo "${{ github.repository }}" \
            --pattern 'codegraph-x86_64-unknown-linux-musl.tar.gz' \
            --pattern 'codegraph-aarch64-unknown-linux-gnu.tar.gz' \
            --dir dl
          cd dl
          sha256sum codegraph-x86_64-unknown-linux-musl.tar.gz | awk '{print $1}' > x86_64.sha256
          sha256sum codegraph-aarch64-unknown-linux-gnu.tar.gz | awk '{print $1}' > aarch64.sha256

      - name: Render PKGBUILD
        env:
          VERSION: ${{ needs.release.outputs.version }}
        run: |
          set -euo pipefail
          x86_sha=$(cat dl/x86_64.sha256)
          arm_sha=$(cat dl/aarch64.sha256)
          cd packaging/aur/codegraph-rs-bin

          sed -i \
            -e "s/^pkgver=.*/pkgver=$VERSION/" \
            -e "s/^pkgrel=.*/pkgrel=1/" \
            -e "s/^sha256sums_x86_64=.*/sha256sums_x86_64=('$x86_sha')/" \
            -e "s/^sha256sums_aarch64=.*/sha256sums_aarch64=('$arm_sha')/" \
            PKGBUILD
          echo "--- PKGBUILD ---"; cat PKGBUILD

      - name: Publish to AUR
        uses: KSXGitHub/github-actions-deploy-aur@v4.1.3
        with:
          pkgname: codegraph-rs-bin
          pkgbuild: packaging/aur/codegraph-rs-bin/PKGBUILD
          commit_username: ${{ secrets.AUR_USERNAME }}
          commit_email: ${{ secrets.AUR_EMAIL }}
          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
          commit_message: "Update to ${{ needs.release.outputs.tag }}"
          ssh_keyscan_types: rsa,ecdsa,ed25519