cli-package.yml

name: CLI Package

on:
  release:
    types:
      - published
  workflow_dispatch:
    inputs:
      tag_name:
        description: "Tag name to build (e.g. v1.0.0). Leave empty to build from HEAD."
        required: false
        type: string
      upload_to_release:
        description: "Upload built artifacts to the release specified by tag_name."
        required: false
        default: false
        type: boolean

permissions:
  contents: read

concurrency:
  group: cli-package-${{ github.event.release.tag_name || inputs.tag_name || github.sha }}
  cancel-in-progress: true

jobs:
  # ── Resolve version info (mirrors desktop-package.yml) ─────────────
  prepare:
    if: github.event_name != 'release' || !startsWith(github.event.release.tag_name, 'data-migrator-v')
    name: Prepare
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.meta.outputs.version }}
      release_tag: ${{ steps.meta.outputs.release_tag }}
      upload_to_release: ${{ steps.meta.outputs.upload_to_release }}
      checkout_ref: ${{ steps.meta.outputs.checkout_ref }}
    steps:
      - uses: actions/checkout@v5

      - name: Resolve version metadata
        id: meta
        shell: bash
        env:
          GITHUB_EVENT_NAME: ${{ github.event_name }}
          GITHUB_SHA: ${{ github.sha }}
          RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
          INPUT_TAG_NAME: ${{ inputs.tag_name }}
          INPUT_UPLOAD_TO_RELEASE: ${{ inputs.upload_to_release }}
        run: |
          set -euo pipefail

          if [[ "${GITHUB_EVENT_NAME}" == "release" ]]; then
            TAG="${RELEASE_TAG_NAME}"
            VERSION="${TAG#v}"
            UPLOAD="true"
            CHECKOUT_REF="${TAG}"
          elif [[ -n "${INPUT_TAG_NAME}" ]]; then
            TAG="${INPUT_TAG_NAME}"
            VERSION="${TAG#v}"
            CHECKOUT_REF="${TAG}"
            if [[ "${INPUT_UPLOAD_TO_RELEASE}" == "true" ]]; then
              UPLOAD="true"
            else
              UPLOAD="false"
            fi
          else
            VERSION="$(jq -r '.version' package.json)"
            TAG="v${VERSION}"
            UPLOAD="false"
            CHECKOUT_REF="${GITHUB_SHA}"
          fi

          echo "version=$VERSION"            >> "$GITHUB_OUTPUT"
          echo "release_tag=$TAG"            >> "$GITHUB_OUTPUT"
          echo "upload_to_release=$UPLOAD"   >> "$GITHUB_OUTPUT"
          echo "checkout_ref=$CHECKOUT_REF"  >> "$GITHUB_OUTPUT"

  # ── Build the CLI per (os, target) ─────────────────────────────────
  build:
    name: Build (${{ matrix.platform.name }})
    runs-on: ${{ matrix.platform.os }}
    needs: prepare

    # Linux x86_64/aarch64 are intentionally absent. They are built and published
    # by .github/workflows/linux-binaries.yml, which is the only producer that
    # also covers nightly and which must hold the CLI and Relay archives together
    # to emit linux-binaries-v1.json. Adding them back here would upload identical
    # asset names from two workflows racing on the same `release: published`.
    strategy:
      fail-fast: false
      matrix:
        platform:
          - os: macos-15
            name: macos-arm64
            target: aarch64-apple-darwin
          - os: macos-15-intel
            name: macos-x64
            target: x86_64-apple-darwin
          - os: windows-latest
            name: windows-x64
            target: x86_64-pc-windows-msvc

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          ref: ${{ needs.prepare.outputs.checkout_ref }}

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.14"

      - name: Build plugin Host resources
        run: |
          bun install --cwd src/apps/extension-host --frozen-lockfile
          bun run --cwd src/apps/extension-host build

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.platform.target }}

      - name: Cache Rust build
        uses: swatinem/rust-cache@v2
        with:
          shared-key: "cli-v1-${{ matrix.platform.name }}"
          cache-bin: false

      - name: Build CLI (Unix)
        if: runner.os != 'Windows'
        shell: bash
        env:
          # Keep the CLI self-updater and SSH installer on the same embedded
          # minisign trust root used by the Desktop updater.
          OPENBITFUN_RELEASE_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
        run: |
          set -euo pipefail
          cargo build --release \
            --target ${{ matrix.platform.target }} \
            -p openbitfun-cli

      - name: Build CLI (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        env:
          RUSTFLAGS: -C target-feature=+crt-static
        run: cargo build --release --target ${{ matrix.platform.target }} -p openbitfun-cli

      - name: Test installer (Unix)
        if: runner.os != 'Windows'
        shell: bash
        env:
          CARGO_BUILD_TARGET: ${{ matrix.platform.target }}
        run: bash scripts/cli/test-install-unix.sh "${{ matrix.platform.target }}"

      - name: Test installer (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        env:
          CARGO_BUILD_TARGET: ${{ matrix.platform.target }}
          RUSTFLAGS: -C target-feature=+crt-static
        run: ./scripts/cli/test-install-windows.ps1 -Target $env:CARGO_BUILD_TARGET

      - name: Package and smoke test (Unix)
        if: runner.os != 'Windows'
        id: stage
        shell: bash
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
          TARGET: ${{ matrix.platform.target }}
        run: |
          set -euo pipefail
          bash scripts/cli/package-unix.sh "$VERSION" "$TARGET"

      - name: Package and smoke test (Windows)
        if: runner.os == 'Windows'
        id: stage-windows
        shell: pwsh
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
          TARGET: ${{ matrix.platform.target }}
        run: |
          ./scripts/cli/package-windows.ps1 -Version $env:VERSION -Target $env:TARGET

      - name: Sign CLI archive and checksum (macOS)
        if: runner.os == 'macOS'
        shell: bash
        env:
          OPENBITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          OPENBITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          OPENBITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
        run: |
          set -euo pipefail
          bash scripts/sign-release-assets.sh \
            "${{ steps.stage.outputs.archive }}" \
            "${{ steps.stage.outputs.checksum }}"

      - name: Upload artifact
        uses: actions/upload-artifact@v6
        with:
          name: openbitfun-cli-${{ needs.prepare.outputs.release_tag }}-${{ matrix.platform.name }}
          if-no-files-found: error
          path: |
            ${{ steps.stage.outputs.archive || steps.stage-windows.outputs.archive }}
            ${{ steps.stage.outputs.checksum || steps.stage-windows.outputs.checksum }}
            openbitfun-cli-*.tar.gz.sig
            openbitfun-cli-*.tar.gz.sha256.sig

  # ── Aggregate and upload to GitHub Release ─────────────────────────
  upload-release-assets:
    name: Upload Release Assets
    needs: [prepare, build]
    if: needs.prepare.outputs.upload_to_release == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Download CLI artifacts
        uses: actions/download-artifact@v7
        with:
          pattern: openbitfun-cli-${{ needs.prepare.outputs.release_tag }}-*
          path: cli-release-assets
          merge-multiple: true

      - name: List release assets
        run: |
          echo "CLI release assets:"
          find cli-release-assets -type f | sort

      - name: Generate SHA256SUMS for macOS and Windows archives
        working-directory: cli-release-assets
        run: |
          set -euo pipefail
          # Scope note: Linux archives are published by linux-binaries.yml in a
          # different workflow run that finishes after this one, so they cannot
          # be folded in here deterministically. Every archive on the release —
          # Linux included — still ships its own `<archive>.sha256` sidecar, which
          # is the complete and uniform verification surface. Keep this file's
          # contents deterministic rather than dependent on cross-workflow timing.
          mapfile -t archives < <(
            find . -maxdepth 1 -type f \
              \( -name 'openbitfun-cli-*.tar.gz' -o -name 'openbitfun-cli-*.zip' \) \
              -printf '%f\n' | sort
          )
          [[ "${#archives[@]}" -gt 0 ]]
          sha256sum "${archives[@]}" > SHA256SUMS

          echo "---- SHA256SUMS ----"
          cat SHA256SUMS

      - name: Upload to release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ needs.prepare.outputs.release_tag }}
          files: |
            cli-release-assets/openbitfun-cli-*.tar.gz
            cli-release-assets/openbitfun-cli-*.tar.gz.sha256
            cli-release-assets/openbitfun-cli-*.tar.gz.sig
            cli-release-assets/openbitfun-cli-*.tar.gz.sha256.sig
            cli-release-assets/openbitfun-cli-*.zip
            cli-release-assets/openbitfun-cli-*.zip.sha256
            cli-release-assets/SHA256SUMS
          fail_on_unmatched_files: true

      # This post-publication dispatch only proves that GitHub accepted the
      # notification. The external tap owns formula rollout and readback.
      - name: Notify homebrew-tap (post-publication)
        env:
          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_DISPATCH_TOKEN }}
          RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
          OFFICIAL_REPOSITORY: ${{ github.repository == 'GCWing/OpenBitFun' }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${GH_TOKEN}" ]]; then
            if [[ "${OFFICIAL_REPOSITORY}" == "true" ]]; then
              echo "::error::HOMEBREW_TAP_DISPATCH_TOKEN is required for the official post-publication notification."
              exit 1
            fi
            echo "HOMEBREW_TAP_DISPATCH_TOKEN not set on fork; skipping tap dispatch."
            exit 0
          fi

          echo "Dispatching openbitfun-release-published for ${RELEASE_TAG} to GCWing/homebrew-tap"
          PAYLOAD="$(jq -cn --arg tag_name "${RELEASE_TAG}" '{
            event_type: "openbitfun-release-published",
            client_payload: {
              tag_name: $tag_name,
              primary_binary: "openbitfun"
            }
          }')"
          curl -fsSL -X POST \
            -H "Authorization: Bearer ${GH_TOKEN}" \
            -H "Accept: application/vnd.github+json" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            https://api.github.com/repos/GCWing/homebrew-tap/dispatches \
            -d "$PAYLOAD"