anything-to-skill 0.1.2

name: Release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      tag:
        description: Tag to build (must already exist)
        required: true

env:
  CARGO_TERM_COLOR: always

permissions:
  contents: write

jobs:
  build:
    name: ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Native runner per target where one exists — the dependency tree has
          # no C build scripts, so nothing here needs `cross` or a sysroot.
          - target: aarch64-apple-darwin
            os: macos-latest
          # Intel macOS cross-compiles from the ARM runner rather than using
          # `macos-13`. GitHub is retiring the Intel runners and a job asking
          # for one can sit queued indefinitely without ever starting — this
          # release stalled for 20 minutes on exactly that. Apple ships a
          # universal SDK, so with no C build scripts in the tree the
          # cross-compile is as ordinary as a native build.
          - target: x86_64-apple-darwin
            os: macos-latest
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            musl: true
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-24.04-arm
          - target: aarch64-unknown-linux-musl
            os: ubuntu-24.04-arm
            musl: true
          - target: x86_64-pc-windows-msvc
            os: windows-latest

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.tag || github.ref }}

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}

      # musl builds are statically linked, so one binary runs on any Linux
      # including Alpine — worth the extra targets.
      - name: Install musl toolchain
        if: matrix.musl
        run: sudo apt-get update && sudo apt-get install -y musl-tools

      - name: Build
        run: cargo build --release --locked --target ${{ matrix.target }}

      # The tag is the single source of the version, so a release archive can
      # never disagree with the tag it was built from.
      - name: Resolve version
        id: version
        shell: bash
        run: |
          set -euo pipefail
          tag="${{ github.event.inputs.tag || github.ref_name }}"
          echo "number=${tag#v}" >> "$GITHUB_OUTPUT"

      - name: Package (unix)
        if: runner.os != 'Windows'
        shell: bash
        run: |
          set -euo pipefail
          name="anything-to-skill-${{ steps.version.outputs.number }}-${{ matrix.target }}"
          mkdir -p "dist/${name}"
          cp "target/${{ matrix.target }}/release/anything-to-skill" "dist/${name}/"
          cp README.md SKILL.md SECURITY.md LICENSE "dist/${name}/"
          tar -C dist -czf "dist/${name}.tar.gz" "${name}"
          # Checksums are recorded against the bare filename so `sha256sum -c`
          # works from the directory the user downloaded into.
          ( cd dist && shasum -a 256 "${name}.tar.gz" > "${name}.tar.gz.sha256" )

      - name: Package (windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $name = "anything-to-skill-${{ steps.version.outputs.number }}-${{ matrix.target }}"
          New-Item -ItemType Directory -Force -Path "dist/$name" | Out-Null
          Copy-Item "target/${{ matrix.target }}/release/anything-to-skill.exe" "dist/$name/"
          Copy-Item README.md, SKILL.md, SECURITY.md, LICENSE "dist/$name/"
          Compress-Archive -Path "dist/$name" -DestinationPath "dist/$name.zip"
          $hash = (Get-FileHash "dist/$name.zip" -Algorithm SHA256).Hash.ToLower()
          # Two spaces before the filename — the format `sha256sum -c` expects.
          "$hash  $name.zip" | Out-File -Encoding ascii -NoNewline "dist/$name.zip.sha256"
          "" | Out-File -Encoding ascii -Append "dist/$name.zip.sha256"

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.target }}
          path: |
            dist/*.tar.gz
            dist/*.zip
            dist/*.sha256
          if-no-files-found: error

  release:
    name: Publish release
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      # One SHA256SUMS covering every archive is easier to verify against than
      # seven separate files, but both are published.
      - name: Collect checksums
        run: |
          set -euo pipefail
          cd artifacts
          cat *.sha256 | sort -k2 > SHA256SUMS
          echo "--- release contents ---"
          ls -la

      - name: Publish
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
          draft: false
          generate_release_notes: true
          files: |
            artifacts/*.tar.gz
            artifacts/*.zip
            artifacts/SHA256SUMS
          body: |
            ## Install

            ```bash
            curl -fsSL https://raw.githubusercontent.com/asale-ai/anything-to-skill/main/install.sh | sh
            ```

            Or download the archive for your platform below and put
            `anything-to-skill` on your `PATH`.

            | Platform | Archive |
            |---|---|
            | macOS (Apple Silicon) | `aarch64-apple-darwin` |
            | macOS (Intel) | `x86_64-apple-darwin` |
            | Linux x86-64 | `x86_64-unknown-linux-gnu` |
            | Linux x86-64 (static) | `x86_64-unknown-linux-musl` |
            | Linux ARM64 | `aarch64-unknown-linux-gnu` |
            | Linux ARM64 (static) | `aarch64-unknown-linux-musl` |
            | Windows x86-64 | `x86_64-pc-windows-msvc` |

            The `musl` builds are statically linked and run on any Linux,
            including Alpine.

            Verify a download against `SHA256SUMS`:

            ```bash
            sha256sum -c SHA256SUMS --ignore-missing
            ```