From 0b6a3f2e580e22234664841df5bac6f902152948 Mon Sep 17 00:00:00 2001
From: Nav Saini <nsaini@figma.com>
Date: Thu, 14 May 2026 14:51:10 +0000
Subject: [PATCH] ci: add figma-release workflow

On push of statsig-go/v*-figma* tags, cross-builds the linux-gnu/
x86_64 cdylib and publishes a paired binaries-linux-gnu/v*-figma*
tag carrying the rebuilt .so. The paired tag is the only ref to
the release commit (no branch pointer) so source-fork main stays
clean.

See ~/nsaini/state/designs/design-statsig-fork-vendor-strategy-b.md
for full architecture.
---
 .github/workflows/figma-release.yml | 44 +++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 .github/workflows/figma-release.yml

diff --git a/.github/workflows/figma-release.yml b/.github/workflows/figma-release.yml
new file mode 100644
index 00000000..ddd7dd27
--- /dev/null
+++ b/.github/workflows/figma-release.yml
@@ -0,0 +1,44 @@
+name: figma-release
+
+on:
+  push:
+    tags: ['statsig-go/v*-figma*']
+
+permissions:
+  contents: write   # required to push commits + tags from the workflow
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with: { submodules: recursive }
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - run: cargo install cross --git https://github.com/cross-rs/cross
+
+      - name: Cross-build statsig_ffi cdylib (linux-gnu/x86_64)
+        run: cross build --release --target x86_64-unknown-linux-gnu -p statsig_ffi
+
+      - name: Publish binaries module at paired tag
+        env:
+          SOURCE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+
+          # Derive paired tag: statsig-go/X -> binaries-linux-gnu/X
+          PAIRED_TAG="binaries-linux-gnu/${SOURCE_TAG#statsig-go/}"
+
+          git config user.name  "figma-release-bot"
+          git config user.email "bot@figma.com"
+          git worktree add /tmp/release-tree HEAD
+          cd /tmp/release-tree
+
+          cp "$GITHUB_WORKSPACE/target/x86_64-unknown-linux-gnu/release/libstatsig_ffi.so" \
+             binaries-linux-gnu/linux_gnu_x86_64.so
+
+          git add binaries-linux-gnu/linux_gnu_x86_64.so
+          git commit -m "release: binaries-linux-gnu ${PAIRED_TAG}"
+          git tag "$PAIRED_TAG"
+          git push origin "$PAIRED_TAG"