axterminator 0.10.2

name: Release

on:
  push:
    tags:
      - 'v*'
  # Manual trigger validates the build matrix without burning a tag.
  # Publish/release/homebrew jobs are guarded to run only on tag refs.
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always

jobs:
  build-rust:
    name: Build Rust ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # macOS Apple Silicon (ARM64)
          - os: macos-14
            target: aarch64-apple-darwin
          # macOS Intel (x86_64)
          - os: macos-15
            target: x86_64-apple-darwin

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Verify Cargo.toml version matches the tag
        # Fail fast if a release is tagged without bumping Cargo.toml: that ships
        # mis-versioned binaries and breaks cargo publish with a version-already-exists
        # error. Only runs on a vX.Y.Z tag push (not workflow_dispatch).
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          tag="${GITHUB_REF_NAME#v}"
          ver="$(grep -m1 '^version = ' Cargo.toml | sed -E 's/^version = "([^"]+)".*/\1/')"
          if [ "$tag" != "$ver" ]; then
            echo "::error::Release tag v$tag does not match Cargo.toml version $ver. Bump Cargo.toml before tagging."
            exit 1
          fi
          echo "version OK: tag v$tag == Cargo.toml $ver"

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          targets: ${{ matrix.target }}

      # rust-toolchain.toml pins the active toolchain to 1.95.0, overriding the
      # `stable` toolchain the action just installed. The `targets:` input above
      # adds the rust-std component to `stable`, NOT to the pinned 1.95.0
      # toolchain — so `cargo build --target x86_64-apple-darwin` fails with
      # E0463 "can't find crate for std". Running rustup inside the checkout dir
      # adds the target to the pinned toolchain that actually builds.
      - name: Add target to pinned toolchain
        run: rustup target add ${{ matrix.target }}

      - name: Build release binary
        run: cargo build --release --locked --features cli --target ${{ matrix.target }}

      - name: Rename artifacts
        run: |
          cd target/${{ matrix.target }}/release
          cp axterminator axterminator-${{ matrix.target }}

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: axterminator-${{ matrix.target }}
          path: target/${{ matrix.target }}/release/axterminator-${{ matrix.target }}

  release:
    name: Create GitHub Release
    needs: [build-rust]
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download all artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: artifacts

      - name: Prepare release files
        run: |
          mkdir -p release
          find artifacts -type f -name "axterminator-*-apple-darwin" -exec cp {} release/ \;
          cd release
          ls -la
          sha256sum -- * > checksums-sha256.txt || shasum -a 256 -- * > checksums-sha256.txt
          cat checksums-sha256.txt

      - name: Create GitHub Release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          generate_release_notes: true
          files: |
            release/*

  publish-crates-io:
    name: Publish to crates.io
    needs: [build-rust]
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: macos-14
    environment:
      name: crates-io
      url: https://crates.io/crates/axterminator
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Publish to crates.io
        run: cargo publish --features cli
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  update-homebrew:
    name: Update Homebrew tap
    needs: [release]
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    environment:
      name: homebrew
      url: https://github.com/MikkoParkkola/homebrew-tap
    permissions:
      contents: write

    steps:
      - name: Checkout homebrew-tap
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: MikkoParkkola/homebrew-tap
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}

      - name: Update formula
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          URL="https://github.com/MikkoParkkola/axterminator/archive/refs/tags/${GITHUB_REF_NAME}.tar.gz"
          SHA256=$(curl -sL "$URL" | sha256sum | cut -d' ' -f1)

          cat > Formula/axterminator.rb << FORMULA
          class Axterminator < Formula
            desc "Background-first macOS GUI automation with MCP server support"
            homepage "https://github.com/MikkoParkkola/axterminator"
            url "$URL"
            sha256 "$SHA256"
            version "$VERSION"
            license :cannot_represent

            depends_on :macos
            depends_on "rust" => :build

            def install
              system "cargo", "install",
                "--locked",
                "--features", "cli",
                "--root", prefix,
                "--path", "."
            end

            test do
              assert_match "accessibility", shell_output("#{bin}/axterminator check")
            end
          end
          FORMULA

      - name: Commit and push
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Formula/axterminator.rb
          git commit -m "axterminator ${GITHUB_REF_NAME}" || echo "No changes"
          git push

  publish-npm:
    name: Publish npm wrapper
    needs: [release]
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write  # OIDC token for npm trusted publishing + provenance
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # OIDC trusted publishing needs npm >= 11.5.1; Node 24 bundles a recent npm.
      - name: Set up Node 24
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Stamp version from tag and publish (OIDC, no token)
        working-directory: npm
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          npm version "${VERSION}" --no-git-tag-version --allow-same-version
          npm publish --provenance --access public