release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  id-token: write # Required for npm OIDC trusted publishing.

jobs:
  release:
    runs-on: ubuntu-latest
    environment: release # Matches the npm trusted publisher binding; enables a manual approval gate.
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22 # Trusted publishing requires Node >=22.14.
          cache: npm
          registry-url: https://registry.npmjs.org

      - name: Install (skip husky in CI)
        run: npm ci
        env:
          HUSKY: "0"

      # Quality gates must pass before publishing anything (AGENTS.md).
      - run: npm run typecheck
      - run: npm run lint
      - run: npm run format:check
      - run: npm test
      - run: npm run build

      # Trusted publishing (OIDC) requires npm CLI >=11.5.1; Node 22 ships npm 10.
      - name: Upgrade npm
        run: npm install -g npm@latest

      - name: Publish to npm
        # No NODE_AUTH_TOKEN: npm CLI auto-detects the OIDC environment and
        # obtains a short-lived token from the trusted publisher binding.
        run: npm publish --provenance --access public

      - uses: oven-sh/setup-bun@v2

      - name: Read version
        id: version
        run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"

      - name: Cross-compile binaries
        run: |
          set -uo pipefail
          VERSION="${{ steps.version.outputs.version }}"
          TARGETS=(
            "bun-linux-x64:qwen-omni-mcp-v${VERSION}-linux-x64"
            "bun-linux-arm64:qwen-omni-mcp-v${VERSION}-linux-arm64"
            "bun-darwin-arm64:qwen-omni-mcp-v${VERSION}-darwin-arm64"
            "bun-darwin-x64:qwen-omni-mcp-v${VERSION}-darwin-x64"
            "bun-windows-x64:qwen-omni-mcp-v${VERSION}-windows-x64.exe"
          )
          failed=0
          for entry in "${TARGETS[@]}"; do
            target="${entry%%:*}"
            outfile="${entry#*:}"
            echo "::group::Building ${target} -> ${outfile}"
            if bun build --compile --target="${target}" src/index.ts --outfile "${outfile}"; then
              ls -lh "${outfile}"
            else
              echo "::warning::Cross-compile failed for ${target} (linux-x64 is the guaranteed target)"
              failed=$((failed + 1))
            fi
            echo "::endgroup::"
          done
          # linux-x64 is the guaranteed primary target; its failure is fatal.
          test -f "qwen-omni-mcp-v${VERSION}-linux-x64" || { echo "FATAL: primary linux-x64 binary missing"; exit 1; }
          test "${failed}" -eq 0 || echo "::warning::${failed} cross-compile target(s) failed but primary binary present"

      - uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: |
            qwen-omni-mcp-*