release.yml

name: Release

# Manual release only
on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (example: 1.2.3 or 1.2.3-rc.1)"
        required: true
        type: string

permissions:
  contents: write

jobs:
  resolve:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.resolve_version.outputs.version }}
      is_prerelease: ${{ steps.resolve_version.outputs.is_prerelease }}
    steps:
      - name: Resolve release version
        id: resolve_version
        run: |
          if [ "${{ github.event_name }}" = "push" ]; then
            VERSION="${GITHUB_REF#refs/tags/}"
          else
            VERSION="${{ github.event.inputs.tag }}"
          fi

          if [ -z "${VERSION}" ]; then
            echo "Error: VERSION is empty"
            exit 1
          fi

          if [[ "${VERSION}" == v* ]]; then
            echo "Error: tags must not use 'v' prefix (got: ${VERSION})"
            exit 1
          fi

          if ! [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
            echo "Error: VERSION must be SemVer-like (got: ${VERSION})"
            exit 1
          fi

          BASE_VERSION="${VERSION%%+*}"
          if [[ "${BASE_VERSION}" == *-* ]]; then
            IS_PRERELEASE=true
          else
            IS_PRERELEASE=false
          fi

          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
          echo "is_prerelease=${IS_PRERELEASE}" >> "${GITHUB_OUTPUT}"

  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true
          cache-dependency-path: go.sum
      - name: Run linter
        uses: golangci/golangci-lint-action@v9
        with:
          version: v2.12.2
          args: --timeout=5m

  # The microsandbox SDK's FFI bridge is cgo (dlopen-based), so every binary
  # must be built with CGO_ENABLED=1 on a toolchain that can target it:
  # native runners per platform, cross-cgo (gcc-aarch64-linux-gnu) for
  # linux/arm64. Plain GOOS/GOARCH cross builds drop the cgo files and fail
  # with "build constraints exclude all Go files" in internal/ffi.
  test-linux-amd64:
    runs-on: ubuntu-latest
    needs: resolve
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true
          cache-dependency-path: go.sum
      - name: Run tests
        run: make test-ci
      - name: Build linux/amd64
        env:
          VERSION: ${{ needs.resolve.outputs.version }}
        run: |
          ./scripts/embed-msb-runtime.sh
          mkdir -p dist
          CGO_ENABLED=1 GOOS=linux GOARCH=amd64 go build -tags msbembed -ldflags "-s -w" -o dist/construct-linux-amd64 ./cmd/construct
      - name: Report artifact size delta
        run: du -h dist/construct-linux-amd64
      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: construct-linux-amd64
          path: dist/construct-linux-amd64
          if-no-files-found: error
          retention-days: 2

  build-linux-arm64:
    runs-on: ubuntu-latest
    needs: resolve
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true
          cache-dependency-path: go.sum
      - name: Install aarch64 cross toolchain
        run: sudo apt-get update && sudo apt-get install -y gcc-aarch64-linux-gnu
      - name: Build linux/arm64 (cross-cgo)
        run: |
          GOOS=linux GOARCH=arm64 ./scripts/embed-msb-runtime.sh
          mkdir -p dist
          CGO_ENABLED=1 GOOS=linux GOARCH=arm64 CC=aarch64-linux-gnu-gcc go build -tags msbembed -ldflags "-s -w" -o dist/construct-linux-arm64 ./cmd/construct
      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: construct-linux-arm64
          path: dist/construct-linux-arm64
          if-no-files-found: error
          retention-days: 2

  build-macos:
    runs-on: macos-latest
    needs: resolve
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true
          cache-dependency-path: go.sum
      - name: Build darwin (arm64 + amd64 via clang -arch)
        run: |
          mkdir -p dist
          # darwin/arm64 embeds the msb pair; darwin/amd64 has no upstream
          # assets and the script skips embedding for it (host-msb gate).
          GOOS=darwin GOARCH=arm64 ./scripts/embed-msb-runtime.sh
          CGO_ENABLED=1 GOOS=darwin GOARCH=arm64 go build -tags msbembed -ldflags "-s -w" -o dist/construct-darwin-arm64 ./cmd/construct
          GOOS=darwin GOARCH=amd64 ./scripts/embed-msb-runtime.sh
          CGO_ENABLED=1 GOOS=darwin GOARCH=amd64 go build -tags msbembed -ldflags "-s -w" -o dist/construct-darwin-amd64 ./cmd/construct
          # The linker's strip can leave the ad-hoc signature stale, and
          # macOS arm64 kernels SIGKILL such binaries at exec. Re-sign each
          # slice; the merged binary is re-signed after lipo below.
          codesign --force --sign - dist/construct-darwin-arm64
          codesign --force --sign - dist/construct-darwin-amd64
      - name: Optional release signing and notarization
        env:
          RELEASE_SIGN: ${{ vars.RELEASE_SIGN }}
          RELEASE_NOTARIZE: ${{ vars.RELEASE_NOTARIZE }}
          SIGN_IDENTITY: ${{ secrets.APPLE_SIGN_IDENTITY }}
          VERSION: ${{ needs.resolve.outputs.version }}
        run: |
          make release-sign
          make notarize-release
      - name: Create macOS Universal Binary
        run: |
          lipo -create -output dist/construct dist/construct-darwin-amd64 dist/construct-darwin-arm64
          lipo -info dist/construct
          codesign --force --sign - dist/construct
      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: construct-darwin
          path: |
            dist/construct-darwin-arm64
            dist/construct-darwin-amd64
            dist/construct
          if-no-files-found: error
          retention-days: 2

  release:
    runs-on: ubuntu-latest
    needs: [resolve, lint, test-linux-amd64, build-linux-arm64, build-macos]
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: dist
          merge-multiple: true
      - name: Package release archives
        env:
          VERSION: ${{ needs.resolve.outputs.version }}
        run: |
          cd dist
          chmod +x construct-darwin-arm64 construct-darwin-amd64 construct-linux-amd64 construct-linux-arm64
          tar -czf "construct-darwin-arm64-${VERSION}.tar.gz" construct-darwin-arm64
          tar -czf "construct-darwin-amd64-${VERSION}.tar.gz" construct-darwin-amd64
          tar -czf "construct-linux-amd64-${VERSION}.tar.gz" construct-linux-amd64
          tar -czf "construct-linux-arm64-${VERSION}.tar.gz" construct-linux-arm64

          mkdir -p linux-amd64 linux-arm64
          cp construct-linux-amd64 linux-amd64/construct
          cp construct-linux-arm64 linux-arm64/construct
          tar -czf construct-cli-linux-amd64.tar.gz -C linux-amd64 construct
          tar -czf construct-cli-linux-arm64.tar.gz -C linux-arm64 construct
          rm -rf linux-amd64 linux-arm64

          tar -czf construct-cli-macos-universal.tar.gz construct
          rm construct
      - name: Generate checksums
        env:
          VERSION: ${{ needs.resolve.outputs.version }}
        run: |
          cd dist
          sha256sum \
            "construct-darwin-arm64-${VERSION}.tar.gz" \
            "construct-darwin-amd64-${VERSION}.tar.gz" \
            "construct-linux-amd64-${VERSION}.tar.gz" \
            "construct-linux-arm64-${VERSION}.tar.gz" \
            "construct-cli-macos-universal.tar.gz" \
            "construct-cli-linux-amd64.tar.gz" \
            "construct-cli-linux-arm64.tar.gz" \
            > checksums.txt
      - name: Verify release outputs
        env:
          VERSION: ${{ needs.resolve.outputs.version }}
        run: |
          set -e
          expected_files=(
            "dist/construct-darwin-arm64-${VERSION}.tar.gz"
            "dist/construct-darwin-amd64-${VERSION}.tar.gz"
            "dist/construct-linux-amd64-${VERSION}.tar.gz"
            "dist/construct-linux-arm64-${VERSION}.tar.gz"
            "dist/construct-cli-macos-universal.tar.gz"
            "dist/construct-cli-linux-amd64.tar.gz"
            "dist/construct-cli-linux-arm64.tar.gz"
            "dist/checksums.txt"
          )

          for file in "${expected_files[@]}"; do
            if [ -f "${file}" ]; then
              size=$(stat -c%s "${file}")
              echo "OK ${file} (size: ${size} bytes)"
            else
              echo "Missing expected artifact: ${file}"
              exit 1
            fi
          done
      - name: Extract release notes from CHANGELOG.md
        env:
          VERSION_SEMVER: ${{ needs.resolve.outputs.version }}
        run: |
          set -euo pipefail

          changelog_file="CHANGELOG.md"
          notes_file="release_notes.md"
          start_marker="<!-- RELEASE:START ${VERSION_SEMVER} -->"
          end_marker="<!-- RELEASE:END ${VERSION_SEMVER} -->"

          if [ -f "${changelog_file}" ]; then
            awk -v start="${start_marker}" -v end="${end_marker}" '
              $0 == start { in_section = 1; next }
              $0 == end { in_section = 0; exit }
              in_section { print }
            ' "${changelog_file}" > "${notes_file}"
          else
            : > "${notes_file}"
          fi

          if ! grep -q '[^[:space:]]' "${notes_file}"; then
            prev_tag=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || true)
            if [ -n "${prev_tag}" ]; then
              echo "**Full changelog:** ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/compare/${prev_tag}...${VERSION_SEMVER}" > "${notes_file}"
            else
              echo "**Full changelog:** ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/tag/${VERSION_SEMVER}" > "${notes_file}"
            fi
          fi
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ needs.resolve.outputs.version }}
          name: The Construct CLI ${{ needs.resolve.outputs.version }}
          body_path: release_notes.md
          draft: false
          prerelease: ${{ needs.resolve.outputs.is_prerelease == 'true' }}
          files: |
            dist/construct-darwin-arm64-${{ needs.resolve.outputs.version }}.tar.gz
            dist/construct-darwin-amd64-${{ needs.resolve.outputs.version }}.tar.gz
            dist/construct-linux-amd64-${{ needs.resolve.outputs.version }}.tar.gz
            dist/construct-linux-arm64-${{ needs.resolve.outputs.version }}.tar.gz
            dist/construct-cli-macos-universal.tar.gz
            dist/construct-cli-linux-amd64.tar.gz
            dist/construct-cli-linux-arm64.tar.gz
            dist/checksums.txt
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Update release marker file
        env:
          VERSION: ${{ needs.resolve.outputs.version }}
          IS_PRERELEASE: ${{ needs.resolve.outputs.is_prerelease }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          # The job checks out the tag (detached HEAD). When the tag commit is
          # off main's lineage, `push HEAD:main` is rejected non-fast-forward
          # and a swallowed error left main/VERSION stale (1.17.13 shipped
          # while main still said 1.17.12). Commit the marker on top of
          # origin/main so the push is always a fast-forward, and let a
          # rejected push fail the step loudly.
          git fetch origin main
          git checkout -B release-marker origin/main
          if [ "$IS_PRERELEASE" = "true" ]; then
            echo "$VERSION" > VERSION-BETA
            git add VERSION-BETA
            git commit -m "chore: update VERSION-BETA to $VERSION" || echo "No changes to commit"
          else
            echo "$VERSION" > VERSION
            git add VERSION
            git commit -m "chore: update VERSION to $VERSION" || echo "No changes to commit"
          fi
          git push origin release-marker:main

  update-tap:
    needs: [release, resolve]
    if: ${{ needs.resolve.outputs.is_prerelease != 'true' }}
    runs-on: ubuntu-latest
    steps:
      - name: Trigger Homebrew Tap Update
        uses: actions/github-script@v9
        with:
          github-token: ${{ secrets.TAP_GITHUB_TOKEN }}
          script: |
            await github.rest.actions.createWorkflowDispatch({
              owner: 'EstebanForge',
              repo: 'homebrew-tap',
              workflow_id: 'update-formula.yml',
              ref: 'main',
              inputs: {
                formula: 'construct-cli',
                tag: '${{ needs.resolve.outputs.version }}',
                repository: '${{ github.repository }}'
              }
            })