ploidy/.github/workflows/release.yml

---
name: Create a release
on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
  workflow_dispatch:
    inputs:
      publish:
        description: "Publish release to crates.io"
        type: boolean
        required: false
        default: true

jobs:
  release:
    name: Create release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Draft release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --draft --title "$GITHUB_REF_NAME"

  bins:
    name: Build and upload release binaries
    needs: [release]
    permissions:
      contents: write
    # GitHub Actions doesn't have a way to easily pass matrix job outputs
    # to downstream jobs, so this job has several platform-specific steps
    # gated with `if`.
    strategy:
      matrix:
        platform:
          - os: macos
            os-version: latest
            target: aarch64-apple-darwin
          - os: macos
            os-version: latest
            target: x86_64-apple-darwin
          - os: ubuntu
            os-version: latest
            target: x86_64-unknown-linux-gnu
          - os: ubuntu
            os-version: "24.04-arm"
            target: aarch64-unknown-linux-gnu
          - os: ubuntu
            os-version: latest
            target: x86_64-unknown-linux-musl
            features: [mimalloc]
          - os: ubuntu
            os-version: "24.04-arm"
            target: aarch64-unknown-linux-musl
            features: [mimalloc]
          - os: windows
            os-version: latest
            target: x86_64-pc-windows-msvc
        binary: [ploidy]
    runs-on: ${{ matrix.platform.os }}-${{ matrix.platform.os-version }}
    env:
      CARGO_TERM_COLOR: always
    steps:
      - name: Check out repo
        uses: actions/checkout@v7
        with:
          ref: ${{ github.ref }}

      - name: Add target to Rust toolchain
        shell: bash
        env:
          TARGET: ${{ matrix.platform.target }}
        run: |
          rustup target add "$TARGET"

      - name: Restore Cargo packages and metadata
        uses: actions/cache/restore@v5
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
          key: cargo-${{ matrix.platform.os }}-${{ hashFiles('rust-toolchain.toml') }}-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            cargo-${{ matrix.platform.os }}-${{ hashFiles('rust-toolchain.toml') }}-

      - name: Install musl libraries and compiler wrappers
        if: ${{ contains(matrix.platform.target, 'musl') }}
        shell: bash
        run: |
          sudo apt-get -y install musl-dev musl-tools

      - name: Build binaries
        shell: bash
        env:
          BINARY: ${{ matrix.binary }}
          TARGET: ${{ matrix.platform.target }}
          FEATURES: ${{ matrix.platform.features && format('--features {0}', join(matrix.platform.features, ',')) || '' }}
        run: |
          cargo build --release --bin "$BINARY" --target "$TARGET" $FEATURES

      - name: Create Linux tar archive
        if: ${{ matrix.platform.os == 'ubuntu' }}
        shell: bash
        env:
          BINARY: ${{ matrix.binary }}
          TARGET: ${{ matrix.platform.target }}
        run: |
          mkdir -p "./archive/$BINARY-$GITHUB_REF_NAME-$TARGET"
          mv "./target/$TARGET/release/$BINARY" "./archive/$BINARY-$GITHUB_REF_NAME-$TARGET/$BINARY"
          tar -c --format pax -C ./archive . | gzip -n > ./archive.tgz

      - name: Extract Mac app signing certificate
        if: ${{ matrix.platform.os == 'macos' }}
        shell: bash
        env:
          DEVELOPER_ID_APP_CERT: ${{ secrets.DEVELOPER_ID_APP_CERT }}
        run: |
          echo "$DEVELOPER_ID_APP_CERT" | base64 -d > ./cert.p12

      - name: Sign macOS binary
        if: ${{ matrix.platform.os == 'macos' }}
        uses: indygreg/apple-code-sign-action@44d0985b7f4363198e80b6fea63ac3e9dd3e9957 # v1.1
        with:
          sign: true
          input_path: ./target/${{ matrix.platform.target }}/release/${{ matrix.binary }}
          p12_file: cert.p12
          p12_password: ${{ secrets.DEVELOPER_ID_APP_CERT_PASSWORD }}
          sign_args: |
            --code-signature-flags
            runtime

      - name: Create macOS ZIP archive
        if: ${{ matrix.platform.os == 'macos' }}
        shell: bash
        env:
          BINARY: ${{ matrix.binary }}
          TARGET: ${{ matrix.platform.target }}
        run: |
          mkdir -p "./archive/$BINARY-$GITHUB_REF_NAME-$TARGET"
          mv "./target/$TARGET/release/$BINARY" "./archive/$BINARY-$GITHUB_REF_NAME-$TARGET/$BINARY"
          cd ./archive
          zip -r9 ../archive.zip .

      - name: Create Windows ZIP archive
        if: ${{ matrix.platform.os == 'windows' }}
        # Git Bash transparently adds the `.exe` suffix, so we don't need to
        # explicitly include it in the path names below.
        shell: bash
        env:
          BINARY: ${{ matrix.binary }}
          TARGET: ${{ matrix.platform.target }}
        run: |
          mkdir -p "./archive/$BINARY-$GITHUB_REF_NAME-$TARGET"
          mv "./target/$TARGET/release/$BINARY" "./archive/$BINARY-$GITHUB_REF_NAME-$TARGET/$BINARY"
          cd ./archive
          "/c/Program Files/7-Zip/7z" a -tzip -mx9 -so . > ../archive.zip

      - name: Upload tar archive
        if: ${{ matrix.platform.os == 'ubuntu' }}
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BINARY: ${{ matrix.binary }}
          TARGET: ${{ matrix.platform.target }}
        run: |
          mv ./archive.tgz "./$BINARY-$GITHUB_REF_NAME-$TARGET.tgz"
          gh release upload "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" "./$BINARY-$GITHUB_REF_NAME-$TARGET.tgz"

      - name: Upload ZIP archive
        if: ${{ matrix.platform.os == 'macos' || matrix.platform.os == 'windows' }}
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BINARY: ${{ matrix.binary }}
          TARGET: ${{ matrix.platform.target }}
        run: |
          mv ./archive.zip "./$BINARY-$GITHUB_REF_NAME-$TARGET.zip"
          gh release upload "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" "./$BINARY-$GITHUB_REF_NAME-$TARGET.zip"

  publish:
    name: Publish to crates.io
    if: ${{ github.event_name == 'push' || inputs.publish }}
    permissions:
      id-token: write
    runs-on: ubuntu-latest
    env:
      CARGO_TERM_COLOR: always
    steps:
      - name: Check out repo
        uses: actions/checkout@v7
        with:
          ref: ${{ github.ref }}

      - name: Authenticate with crates.io
        uses: rust-lang/crates-io-auth-action@v1
        id: auth

      - name: Publish all packages
        shell: bash
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
        run: |
          cargo publish --workspace