release.yml

# SPDX-License-Identifier: MPL-2.0
#
# Release (ADR-019 / #260 S2). On a `v*` tag: build the AffineScript
# compiler for each supported platform, attach the raw per-platform
# binaries plus a single `SHA256SUMS` manifest to the GitHub Release.
# Releases are the CANONICAL distribution artifact; the thin Deno/JSR
# shim `@hyperpolymath/affinescript` (#260 S3) downloads + checksum-
# verifies the binary named for its host triple against SHA256SUMS.
#
# Asset contract (ADR-019; do not rename without amending the ADR + the
# shim): `affinescript-<target>` raw executables + `SHA256SUMS`
# (sha256sum format: "<hex>  affinescript-<target>"). Targets:
#   linux-x64, macos-x64, macos-arm64.  windows-x64 is a tracked
#   follow-up (native OCaml Windows CI is flaky; #260 S2 is bounded to
#   the three POSIX targets).
#
# Asset handling uses the runner-native `gh` CLI (GITHUB_TOKEN), so no
# third-party action needs SHA-pinning beyond checkout + setup-ocaml.

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  prepare:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Create the release (idempotent)
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag="${GITHUB_REF_NAME}"
          if gh release view "$tag" >/dev/null 2>&1; then
            echo "release $tag already exists; reusing"
          else
            gh release create "$tag" --generate-notes --verify-tag --title "$tag"
          fi

  build:
    needs: prepare
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: linux-x64
          - os: macos-15-intel
            target: macos-x64
          - os: macos-14
            target: macos-arm64
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up OCaml
        uses: ocaml/setup-ocaml@e32b06a3e831ff2fbc6f08cf35be2085e3918014 # v3
        with:
          ocaml-compiler: "5.1"

      - name: Install dependencies
        run: opam install . --deps-only --yes

      - name: Bake release version into source (#297)
        # Single source of truth for the compiler version string lives
        # in `lib/version.ml`; `dune-project` mirrors it for opam.  The
        # release workflow rewrites both from the tag so every emitted
        # binary self-reports the right number (--version, REPL banner,
        # LSP serverInfo, ONNX producer_version).
        run: |
          v="${GITHUB_REF_NAME#v}"
          sed -i "s/^let value = .*/let value = \"$v\"/" lib/version.ml
          sed -i "s/^(version .*)/(version $v)/" .build/dune-project
          echo "Baked version: $v"
          grep '^let value' lib/version.ml
          grep '^(version' .build/dune-project

      - name: Build release
        run: opam exec -- dune build --release

      - name: Stage the binary
        run: |
          install -m 0755 _build/default/bin/main.exe \
            "affinescript-${{ matrix.target }}"

      - name: Upload the binary to the release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release upload "${GITHUB_REF_NAME}" \
            "affinescript-${{ matrix.target }}" --clobber

  checksums:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Collect binaries and publish SHA256SUMS
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag="${GITHUB_REF_NAME}"
          mkdir -p dl
          gh release download "$tag" --repo "$GITHUB_REPOSITORY" --dir dl --pattern 'affinescript-*'
          ( cd dl && sha256sum affinescript-* | sort -k2 > SHA256SUMS )
          cat dl/SHA256SUMS
          gh release upload "$tag" --repo "$GITHUB_REPOSITORY" dl/SHA256SUMS --clobber