release.yml

name: Release

on:
  push:
    tags: ["v*"]

permissions:
  contents: write
  id-token: write

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v6
        with:
          node-version: 22

      - run: corepack enable

      - name: Install dependencies
        run: yarn install

      - name: Typecheck
        run: yarn typecheck

      - name: Run tests
        run: yarn test:run

      - name: Build
        run: yarn build

      - name: Smoke test (Node ESM)
        run: yarn node dist/index.js --help

  build-binaries:
    needs: test
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            target: bun-darwin-arm64
            artifact: bsky-macos-arm64
            archive: tar.gz
          - os: macos-latest
            target: bun-darwin-x64
            artifact: bsky-macos-x64
            archive: tar.gz
          - os: ubuntu-latest
            target: bun-linux-x64
            artifact: bsky-linux-x64
            archive: tar.gz
          - os: ubuntu-latest
            target: bun-linux-arm64
            artifact: bsky-linux-arm64
            archive: tar.gz
          - os: windows-latest
            target: bun-windows-x64
            artifact: bsky-windows-x64
            archive: zip

    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      # Build dist/index.js with tsup (resolves @/ path aliases)
      - uses: actions/setup-node@v6
        with:
          node-version: 22

      - run: corepack enable

      - run: yarn install

      # Unplug rrule + tslib so esbuild can read them from disk
      # (PnP zip archives cause esbuild resolution failures on Windows)
      - run: yarn unplug rrule tslib

      - run: yarn build

      # Compile standalone binary from the tsup output
      - uses: oven-sh/setup-bun@v2

      # Bun needs a standard node_modules/ for cross-compilation
      - run: bun install

      - name: Compile binary
        run: bun build --compile --target ${{ matrix.target }} dist/index.js --outfile bsky

      - name: Archive (tar.gz)
        if: matrix.archive == 'tar.gz'
        run: tar -czf ${{ matrix.artifact }}.tar.gz bsky

      - name: Archive (zip)
        if: matrix.archive == 'zip'
        run: Compress-Archive -Path bsky.exe -DestinationPath ${{ matrix.artifact }}.zip
        shell: pwsh

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: ${{ matrix.artifact }}.${{ matrix.archive }}

  changelog:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Generate release notes
        id: cliff-release
        uses: orhun/git-cliff-action@v4
        with:
          config: cliff.toml
          args: --latest --strip header
        env:
          OUTPUT: release-notes.md
          GITHUB_REPO: ${{ github.repository }}

      - name: Generate full changelog
        uses: orhun/git-cliff-action@v4
        with:
          config: cliff.toml
          args: --strip header
        env:
          OUTPUT: CHANGELOG.md
          GITHUB_REPO: ${{ github.repository }}

      - uses: actions/upload-artifact@v4
        with:
          name: changelog
          path: |
            CHANGELOG.md
            release-notes.md

  release:
    needs: [build-binaries, changelog]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Collect release assets
        run: |
          mkdir -p release
          find artifacts -name '*.tar.gz' -o -name '*.zip' | xargs -I{} mv {} release/
          cp artifacts/changelog/release-notes.md release/

      - name: Generate SHA256 checksums
        working-directory: release
        run: sha256sum *.tar.gz *.zip > checksums.txt

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          body_path: release/release-notes.md
          files: |
            release/*.tar.gz
            release/*.zip
            release/checksums.txt
          generate_release_notes: false

  update-homebrew:
    needs: release
    runs-on: ubuntu-latest
    environment: release
    steps:
      - name: Download checksums
        run: |
          TAG="${GITHUB_REF_NAME}"
          VERSION="${TAG#v}"
          curl -fsSL "https://github.com/harveyrandall/bsky-cli/releases/download/${TAG}/checksums.txt" -o checksums.txt
          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
          echo "TAG=${TAG}" >> "$GITHUB_ENV"

      - name: Parse checksums
        id: shas
        run: |
          echo "macos_arm64=$(grep 'bsky-macos-arm64.tar.gz' checksums.txt | awk '{print $1}')" >> "$GITHUB_OUTPUT"
          echo "macos_x64=$(grep 'bsky-macos-x64.tar.gz' checksums.txt | awk '{print $1}')" >> "$GITHUB_OUTPUT"
          echo "linux_arm64=$(grep 'bsky-linux-arm64.tar.gz' checksums.txt | awk '{print $1}')" >> "$GITHUB_OUTPUT"
          echo "linux_x64=$(grep 'bsky-linux-x64.tar.gz' checksums.txt | awk '{print $1}')" >> "$GITHUB_OUTPUT"

      - name: Checkout tap repo
        uses: actions/checkout@v4
        with:
          repository: harveyrandall/homebrew-tools
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}

      - name: Update formula
        env:
          VERSION: ${{ env.VERSION }}
          SHA_MACOS_ARM64: ${{ steps.shas.outputs.macos_arm64 }}
          SHA_MACOS_X64: ${{ steps.shas.outputs.macos_x64 }}
          SHA_LINUX_ARM64: ${{ steps.shas.outputs.linux_arm64 }}
          SHA_LINUX_X64: ${{ steps.shas.outputs.linux_x64 }}
        run: |
          cd Formula
          sed -i "s/version \".*\"/version \"${VERSION}\"/" bsky-cli.rb
          # Update SHA256 hashes in order of appearance
          awk -v s1="$SHA_MACOS_ARM64" -v s2="$SHA_MACOS_X64" \
              -v s3="$SHA_LINUX_ARM64" -v s4="$SHA_LINUX_X64" '
            BEGIN { n=0 }
            /sha256/ { n++
              if (n==1) { sub(/sha256 ".*"/, "sha256 \"" s1 "\"") }
              if (n==2) { sub(/sha256 ".*"/, "sha256 \"" s2 "\"") }
              if (n==3) { sub(/sha256 ".*"/, "sha256 \"" s3 "\"") }
              if (n==4) { sub(/sha256 ".*"/, "sha256 \"" s4 "\"") }
            }
            { print }
          ' bsky-cli.rb > bsky-cli.rb.tmp && mv bsky-cli.rb.tmp bsky-cli.rb

      - name: Commit and push
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Formula/bsky-cli.rb
          git commit -m "chore: bump bsky-cli to ${VERSION}"
          git push

  npm-publish:
    needs: test
    runs-on: ubuntu-latest
    environment: release
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v6
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org

      - run: corepack enable

      - name: Install dependencies
        run: yarn install

      - name: Build
        run: yarn build

      - name: Publish to npm
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}