release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (e.g. 1.2.3, without v prefix)'
        required: true

jobs:
  build:
    name: Build (${{ matrix.target }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: linux-x86_64
          - os: ubuntu-24.04-arm
            target: linux-aarch64
          - os: macos-latest
            target: macos-arm64
          - os: macOS-15-intel
            target: macos-x86_64

    runs-on: ${{ matrix.os }}
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: '17'
          distribution: 'temurin'

      # Static linking on Linux requires zlib headers
      - name: Install native-image prerequisites (Linux)
        if: runner.os == 'Linux'
        run: sudo apt-get install -y libz-dev

      - name: Build native image
        run: ./mill cli.nativeImage
        env:
          CELLAR_VERSION: v${{ inputs.version }}

      - name: Package artifact
        shell: bash
        run: |
          VERSION="${{ inputs.version }}"
          ARCHIVE="cellar-${VERSION}-${{ matrix.target }}.tar.gz"
          mkdir staging
          cp out/cli/nativeImage.dest/native-executable staging/cellar
          cp README.md staging/
          tar -czf "${ARCHIVE}" -C staging .
          echo "ARCHIVE=${ARCHIVE}" >> "$GITHUB_ENV"

      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ matrix.target }}
          path: ${{ env.ARCHIVE }}

  jar:
    name: Build JAR
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Build assembly JAR
        run: ./mill cli.assembly
        env:
          CELLAR_VERSION: v${{ inputs.version }}

      - name: Rename JAR
        run: |
          VERSION="${{ inputs.version }}"
          JAR="cellar-${VERSION}.jar"
          cp out/cli/assembly.dest/out.jar "${JAR}"
          echo "JAR=${JAR}" >> "$GITHUB_ENV"

      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: jar
          path: ${{ env.JAR }}

  release:
    name: Publish Release
    needs: [build, jar]
    runs-on: ubuntu-latest
    # OIDC token for cosign keyless signing; write access for release publishing
    permissions:
      contents: write
      id-token: write

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: main

      - name: Download all artifacts
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          path: artifacts/
          merge-multiple: true

      - name: Generate SHA256 checksums
        working-directory: artifacts
        run: sha256sum *.tar.gz *.jar > checksums.txt

      - name: Install cosign
        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Sign checksums (keyless OIDC)
        working-directory: artifacts
        run: cosign sign-blob --yes checksums.txt --bundle checksums.txt.bundle

      - name: Update flake.nix
        run: |
          VERSION="${{ inputs.version }}"

          # Convert hex sha256 to Nix SRI format (sha256-<base64>)
          sri_hash() {
            echo -n "$1" | xxd -r -p | base64 | tr -d '\n' | sed 's/^/sha256-/'
          }

          LINUX_X86=$(sri_hash "$(grep "linux-x86_64.tar.gz" artifacts/checksums.txt | awk '{print $1}')")
          LINUX_ARM=$(sri_hash "$(grep "linux-aarch64.tar.gz" artifacts/checksums.txt | awk '{print $1}')")
          MACOS_ARM=$(sri_hash "$(grep "macos-arm64.tar.gz" artifacts/checksums.txt | awk '{print $1}')")
          MACOS_X86=$(sri_hash "$(grep "macos-x86_64.tar.gz" artifacts/checksums.txt | awk '{print $1}')")

          sed -i "0,/version = \".*\";/s|version = \".*\";|version = \"${VERSION}\";|" flake.nix
          sed -i "/linux-x86_64/{n;s|hash = \".*\";|hash = \"${LINUX_X86}\";|}" flake.nix
          sed -i "/linux-aarch64/{n;s|hash = \".*\";|hash = \"${LINUX_ARM}\";|}" flake.nix
          sed -i "/macos-x86_64/{n;s|hash = \".*\";|hash = \"${MACOS_X86}\";|}" flake.nix
          sed -i "/macos-arm64/{n;s|hash = \".*\";|hash = \"${MACOS_ARM}\";|}" flake.nix

      - name: Commit, tag, and push
        run: |
          VERSION="${{ inputs.version }}"
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add flake.nix
          git diff --cached --quiet && echo "No flake changes" && exit 0
          git commit -m "Update flake.nix to ${VERSION}"
          git push origin main
          git tag "v${VERSION}"
          git push origin "v${VERSION}"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
        with:
          tag_name: v${{ inputs.version }}
          files: artifacts/*
          generate_release_notes: true