release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to release (e.g., v1.0.0)'
        required: true

env:
  CARGO_TERM_COLOR: always

permissions:
  attestations: write
  contents: write
  id-token: write

jobs:
  create-release:
    name: Create Release
    runs-on: ubuntu-latest
    outputs:
      tag_name: ${{ steps.release_info.outputs.tag_name }}
    steps:
      - name: Check if release exists
        id: release_info
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ github.event.inputs.tag || github.ref_name }}
        shell: bash
        run: |
          echo "tag_name=${TAG_NAME}" >> "$GITHUB_OUTPUT"
          if gh release view "${TAG_NAME}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Create Release
        if: steps.release_info.outputs.exists != 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ steps.release_info.outputs.tag_name }}
        shell: bash
        run: |
          gh release create "${TAG_NAME}" \
            --repo "${GITHUB_REPOSITORY}" \
            --target "${GITHUB_SHA}" \
            --title "Release ${TAG_NAME}" \
            --notes ""

  build-release:
    name: Build Release Binaries
    needs: create-release
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            artifact_name: pickle-fuzzer
            asset_name: pickle-fuzzer-linux-x86_64
          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            artifact_name: pickle-fuzzer
            asset_name: pickle-fuzzer-linux-x86_64-musl
          - os: macos-latest
            target: x86_64-apple-darwin
            artifact_name: pickle-fuzzer
            asset_name: pickle-fuzzer-macos-x86_64
          - os: macos-latest
            target: aarch64-apple-darwin
            artifact_name: pickle-fuzzer
            asset_name: pickle-fuzzer-macos-aarch64
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact_name: pickle-fuzzer.exe
            asset_name: pickle-fuzzer-windows-x86_64.exe

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.create-release.outputs.tag_name }}

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7
        with:
          toolchain: stable
          targets: ${{ matrix.target }}

      - name: Build release binary
        run: cargo build --release --target ${{ matrix.target }}

      - name: Strip binary (Linux/macOS)
        if: matrix.os != 'windows-latest'
        run: strip target/${{ matrix.target }}/release/${{ matrix.artifact_name }}

      - name: Generate checksum (Linux)
        if: matrix.os == 'ubuntu-latest'
        run: |
          artifact_path="target/${{ matrix.target }}/release/${{ matrix.artifact_name }}"
          checksum_path="target/${{ matrix.target }}/release/${{ matrix.asset_name }}.sha256"
          hash="$(sha256sum "$artifact_path" | awk '{print $1}')"
          echo "${hash}  ${{ matrix.asset_name }}" > "$checksum_path"

      - name: Generate checksum (macOS)
        if: matrix.os == 'macos-latest'
        run: |
          artifact_path="target/${{ matrix.target }}/release/${{ matrix.artifact_name }}"
          checksum_path="target/${{ matrix.target }}/release/${{ matrix.asset_name }}.sha256"
          hash="$(shasum -a 256 "$artifact_path" | awk '{print $1}')"
          echo "${hash}  ${{ matrix.asset_name }}" > "$checksum_path"

      - name: Generate checksum (Windows)
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: |
          $artifactPath = "target/${{ matrix.target }}/release/${{ matrix.artifact_name }}"
          $checksumPath = "target/${{ matrix.target }}/release/${{ matrix.asset_name }}.sha256"
          $hash = (Get-FileHash -Algorithm SHA256 $artifactPath).Hash.ToLower()
          "$hash  ${{ matrix.asset_name }}" | Out-File -FilePath $checksumPath -Encoding ascii

      - name: Prepare release asset
        shell: bash
        run: |
          cp "target/${{ matrix.target }}/release/${{ matrix.artifact_name }}" \
            "target/${{ matrix.target }}/release/${{ matrix.asset_name }}"

      - name: Attest release binary
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: ./target/${{ matrix.target }}/release/${{ matrix.artifact_name }}

      - name: Upload Release Asset
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ needs.create-release.outputs.tag_name }}
        shell: bash
        run: |
          gh release upload "${TAG_NAME}" \
            "./target/${{ matrix.target }}/release/${{ matrix.asset_name }}" \
            --repo "${GITHUB_REPOSITORY}" \
            --clobber

      - name: Upload checksum asset
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ needs.create-release.outputs.tag_name }}
        shell: bash
        run: |
          gh release upload "${TAG_NAME}" \
            "./target/${{ matrix.target }}/release/${{ matrix.asset_name }}.sha256" \
            --repo "${GITHUB_REPOSITORY}" \
            --clobber

  # publish-crate:
  #   name: Publish to crates.io
  #   needs: build-release
  #   runs-on: ubuntu-latest
  #   steps:
  #     - name: Checkout code
  #       uses: actions/checkout@v4

  #     - name: Install Rust toolchain
  #       uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7

  #     - name: Publish to crates.io
  #       run: cargo publish --token ${{ secrets.CARGO_TOKEN }}
  #       continue-on-error: true