release-cli.yml

name: Release Lapdev CLI

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Lapdev CLI version (e.g. 0.1.0). Must match Cargo.toml."
        required: true
  push:
    tags:
      - "lapdev-cli-v*"

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.vars.outputs.version }}
      tag_name: ${{ steps.vars.outputs.tag_name }}
    steps:
      - uses: actions/checkout@v4

      - id: vars
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            VERSION="${{ github.event.inputs.version }}"
          else
            VERSION="${GITHUB_REF_NAME#lapdev-cli-v}"
          fi

          VERSION="${VERSION#v}"
          if [[ -z "$VERSION" ]]; then
            echo "Unable to determine version" >&2
            exit 1
          fi

          TAG_NAME="lapdev-cli-v${VERSION}"

          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "tag_name=$TAG_NAME" >> "$GITHUB_OUTPUT"

      - name: Verify Cargo version matches release version
        run: |
          FILE_VERSION=$(python - <<'PY'
          import pathlib, tomllib
          data = tomllib.loads(pathlib.Path("Cargo.toml").read_text())
          print(data["workspace"]["package"]["version"])
          PY
          )
          if [[ "$FILE_VERSION" != "${{ steps.vars.outputs.version }}" ]]; then
            echo "Cargo workspace version ${FILE_VERSION} does not match requested version ${{ steps.vars.outputs.version }}" >&2
            exit 1
          fi

  build:
    needs: prepare
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            archive: tar.gz
          - os: ubuntu-22.04
            target: aarch64-unknown-linux-gnu
            archive: tar.gz
          - os: macos-13
            target: x86_64-apple-darwin
            archive: tar.gz
          - os: macos-14
            target: aarch64-apple-darwin
            archive: tar.gz
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            archive: zip
          - os: windows-latest
            target: aarch64-pc-windows-msvc
            archive: zip
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
      id-token: write
    env:
      TARGET: ${{ matrix.target }}
      ARCHIVE_NAME: lapdev-cli-${{ matrix.target }}.${{ matrix.archive }}
      ARTIFACT_NAME: lapdev-cli-${{ matrix.target }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
          components: "clippy,rustfmt"

      - name: Install Linux cross toolchain
        if: runner.os == 'Linux' && contains(matrix.target, 'aarch64-unknown-linux-gnu')
        run: |
          sudo apt-get update
          sudo apt-get install --yes gcc-aarch64-linux-gnu

      - name: Configure aarch64 Linux linker
        if: runner.os == 'Linux' && matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_AR=aarch64-linux-gnu-ar" >> "$GITHUB_ENV"
          echo "CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
          echo "AR_aarch64_unknown_linux_gnu=aarch64-linux-gnu-ar" >> "$GITHUB_ENV"

      - name: Cargo fetch
        run: cargo fetch --locked
        if: runner.os != 'Windows'

      - name: Cargo fetch (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: cargo fetch --locked

      - name: Build (Unix)
        if: runner.os != 'Windows'
        run: cargo build -p lapdev-cli --release --locked --target "${TARGET}"

      - name: Build (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: cargo build -p lapdev-cli --release --locked --target $env:TARGET

      - name: Import Apple code signing cert
        if: runner.os == 'macOS'
        uses: apple-actions/import-codesign-certs@v3
        with:
          p12-file-base64: ${{ secrets.APPLE_CODESIGN_CERT_BASE64 }}
          p12-password: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}

      - name: Codesign binary (macOS)
        if: runner.os == 'macOS'
        env:
          APPLE_CODESIGN_IDENTITY: ${{ secrets.APPLE_CODESIGN_IDENTITY }}
        run: |
          codesign --force --timestamp --options runtime --sign "${APPLE_CODESIGN_IDENTITY}" "target/${TARGET}/release/lapdev-cli"

      - name: Notarize macOS binary
        if: runner.os == 'macOS'
        env:
          APPLE_ID: ${{ secrets.APPLE_NOTARIZE_APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_NOTARIZE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          mkdir -p notarize
          cp "target/${TARGET}/release/lapdev-cli" notarize/lapdev
          ditto -c -k --keepParent notarize/lapdev notarize.zip
          xcrun notarytool submit notarize.zip --apple-id "${APPLE_ID}" --team-id "${APPLE_TEAM_ID}" --password "${APPLE_PASSWORD}" --wait
          rm -rf notarize notarize.zip

      - name: Prepare artifact (Unix)
        if: runner.os != 'Windows'
        run: |
          BIN="target/${TARGET}/release/lapdev-cli"
          mkdir -p pack
          cp "${BIN}" pack/lapdev
          chmod 755 pack/lapdev
          tar -C pack -czf "${ARCHIVE_NAME}" lapdev

      - name: Prepare artifact (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $bin = "target\${env:TARGET}\release\lapdev-cli.exe"
          New-Item -ItemType Directory -Path pack -Force | Out-Null
          Copy-Item $bin "pack\lapdev.exe" -Force
          Compress-Archive -Path "pack\lapdev.exe" -DestinationPath $env:ARCHIVE_NAME -Force

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ env.ARTIFACT_NAME }}
          path: |
            ${{ env.ARCHIVE_NAME }}

  publish:
    needs: [prepare, build]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          path: release

      - name: List artifacts
        run: ls -R release

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ needs.prepare.outputs.tag_name }}
          VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          FILES=()
          while IFS= read -r -d '' file; do
            FILES+=("$file")
          done < <(find release -type f -print0)

          if [[ ${#FILES[@]} -eq 0 ]]; then
            echo "No artifacts found to upload" >&2
            exit 1
          fi

          FILES+=("pkg/installers/lapdev-cli.sh" "pkg/installers/lapdev-cli.ps1")

          gh release create "${TAG_NAME}" "${FILES[@]}" \
            --title "Lapdev CLI v${VERSION}" \
            --notes "Prebuilt Lapdev CLI binaries for version v${VERSION}."