release.yml

name: Release

on:
  workflow_dispatch:

permissions:
  contents: write

jobs:
  version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.bump.outputs.version }}
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2

      - run: bun install --frozen-lockfile

      - name: Calculate version
        id: bump
        run: |
          VERSION=$(npx --yes @circlesac/oneup version --target package.json | tail -1)
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - uses: actions/upload-artifact@v4
        with:
          name: versioned-files
          path: package.json

  build:
    needs: version
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        include:
          - os: macos-latest
            target: bun-darwin-x64
            name: tsk-darwin-x64
          - os: macos-latest
            target: bun-darwin-arm64
            name: tsk-darwin-arm64
          - os: ubuntu-latest
            target: bun-linux-x64
            name: tsk-linux-x64
          - os: ubuntu-latest
            target: bun-linux-arm64
            name: tsk-linux-arm64

    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2

      - run: bun install --frozen-lockfile

      - uses: actions/download-artifact@v4
        with:
          name: versioned-files

      - name: Build binary
        run: |
          bun build --compile --target=${{ matrix.target }} --outfile=tsk src/index.ts
          if [[ "${{ matrix.target }}" == bun-darwin-* ]]; then
            codesign --remove-signature tsk
            codesign --force --deep -s - tsk
          fi
          tar czf ${{ matrix.name }}.tar.gz tsk

      - name: Package Debian artifact
        if: startsWith(matrix.target, 'bun-linux')
        run: |
          case "${{ matrix.target }}" in
            bun-linux-x64) arch=amd64 ;;
            bun-linux-arm64) arch=arm64 ;;
            *) exit 1 ;;
          esac
          ./packaging/build-deb.sh "tsk" "${{ needs.version.outputs.version }}" "$arch" .

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.name }}
          path: |
            ${{ matrix.name }}.*
            tsk_*.deb

  release:
    needs: [version, build]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.version.outputs.version }}
          generate_release_notes: true
          files: |
            artifacts/**/*.tar.gz
            artifacts/**/*.deb
            bin/install.sh

  publish-npm:
    needs: [version, release]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org

      - uses: actions/download-artifact@v4
        with:
          name: versioned-files

      - name: Publish to npm
        run: npm publish --access public

  publish-package-indexes:
    needs: [version, release, build]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Update Homebrew and APT indexes
        env:
          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          VERSION=${{ needs.version.outputs.version }}

          SHA_DARWIN_ARM64=$(shasum -a 256 artifacts/tsk-darwin-arm64/*.tar.gz | cut -d' ' -f1)
          SHA_DARWIN_X64=$(shasum -a 256 artifacts/tsk-darwin-x64/*.tar.gz | cut -d' ' -f1)
          SHA_LINUX_ARM64=$(shasum -a 256 artifacts/tsk-linux-arm64/*.tar.gz | cut -d' ' -f1)
          SHA_LINUX_X64=$(shasum -a 256 artifacts/tsk-linux-x64/*.tar.gz | cut -d' ' -f1)

          git clone https://x-access-token:${GH_TOKEN}@github.com/circlesac/homebrew-tap.git
          cd homebrew-tap
          cp ../homebrew/tsk.rb.template Formula/tsk.rb
          sed -i "s/VERSION_PLACEHOLDER/${VERSION}/g" Formula/tsk.rb
          sed -i "s/SHA_DARWIN_ARM64/${SHA_DARWIN_ARM64}/g" Formula/tsk.rb
          sed -i "s/SHA_DARWIN_X64/${SHA_DARWIN_X64}/g" Formula/tsk.rb
          sed -i "s/SHA_LINUX_ARM64/${SHA_LINUX_ARM64}/g" Formula/tsk.rb
          sed -i "s/SHA_LINUX_X64/${SHA_LINUX_X64}/g" Formula/tsk.rb

          mapfile -t packages < <(find ../artifacts -type f -name 'tsk_*.deb' | sort)
          test "${#packages[@]}" -eq 2
          for package in "${packages[@]}"; do
            ./apt/scripts/add-package.sh "$package" circlesac/tsk-cli "v${VERSION}"
          done

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Formula/tsk.rb "apt/manifests/tsk/${VERSION}"
          git diff --cached --quiet && exit 0
          git commit -m "Update tsk to ${VERSION}"
          for attempt in 1 2 3; do
            git pull --rebase origin main
            if git push origin main; then
              exit 0
            fi
            printf 'push attempt %s failed\n' "$attempt" >&2
          done
          exit 1