blaze-keys 0.2.2

name: Release

permissions:
  contents: write

on:
  push:
    tags:
      - '[0-9]+.*' # Triggers only on version tags

jobs:
  versioning:
    name: "Calculate version information"
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.set.outputs.version }}
    steps:
      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # @v6

      - name: Get the release version from the tag
        id: set
        if: env.VERSION == ''
        run: |
          echo "VERSION=${{ github.ref_name }}" >> $GITHUB_ENV
          echo "version=${{ github.ref_name }}" >> $GITHUB_OUTPUT
          cat $GITHUB_ENV

      - name: Show the version
        run: |
          echo "version is: $VERSION"

      - name: Check that tag version and Cargo.toml version are the same
        shell: bash
        run: |
          if ! grep -q "version = \"$VERSION\"" Cargo.toml; then
            echo "version does not match Cargo.toml" >&2
            exit 1
          fi
      
    
  create_docker_image:
    runs-on: ubuntu-latest
    needs:
      - "versioning"
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # @v6

      - name: Login to Docker Hub
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef  # @v3.6.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_WRITE_TOKEN }}

      - name: Build and push Docker image
        run: |
          version="${{ needs.versioning.outputs.version }}"
          echo "Docker image tag: ${version}"

          docker build -t "${{ secrets.DOCKER_USERNAME }}/blaze-keys:${version}" -t "${{ secrets.DOCKER_USERNAME }}/blaze-keys:latest" .
          docker push "${{ secrets.DOCKER_USERNAME }}/blaze-keys:${version}"
          docker push "${{ secrets.DOCKER_USERNAME }}/blaze-keys:latest"

  build-and-upload:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    needs: ["versioning"]
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux x86_64 (GNU)
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            code-target: x86_64-unknown-linux-gnu

          # Linux x86_64 (musl)
          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            code-target: x86_64-unknown-linux-musl
          
          # macOS x86_64
          - os: macos-15-intel 
            target: x86_64-apple-darwin
            code-target: x86_64-apple-darwin

          # macOS ARM64
          - os: macos-latest 
            target: aarch64-apple-darwin
            code-target: aarch64-apple-darwin

    steps:
      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # @v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@9bc92bc5598b4f3bec5d910d352094982cb0c3b9  # @1.92.0
        with:
          targets: ${{ matrix.code-target }}

      - name: Install musl
        run: sudo apt-get update && sudo apt-get install -y musl-tools
        if: matrix.target == 'x86_64-unknown-linux-musl'

      - name: Build binary
        run: cargo build --release --target ${{ matrix.code-target }}

      - name: Package and Calculate Checksum
        shell: bash
        env:
          TARGET: ${{ matrix.target }}
          REF_NAME: ${{ github.ref_name }} 
        run: |
          BIN_NAME="blz"
          
          # Create a unique name for the release asset
          ASSET_NAME="$BIN_NAME-$REF_NAME-$TARGET"
          
          # Create a temporary directory for packing
          mkdir "$ASSET_NAME"
          
          # Copy the binary and strip it (if on Linux) to reduce size
          cp "target/$TARGET/release/$BIN_NAME" "$ASSET_NAME/"
          if [[ "$runner.os" == "Linux" ]]; then
            strip "$ASSET_NAME/$BIN_NAME"
          fi
          
          tar czf "$ASSET_NAME.tar.gz" -C "$ASSET_NAME" .
          
          if [[ "$runner.os" == "macOS" ]]; then
            shasum -a 256 "$ASSET_NAME.tar.gz" > "$ASSET_NAME.tar.gz.sha256"
          else
            sha256sum "$ASSET_NAME.tar.gz" > "$ASSET_NAME.tar.gz.sha256"
          fi
          
          echo "ASSET=$ASSET_NAME.tar.gz" >> $GITHUB_ENV
          echo "CHECKSUM=$ASSET_NAME.tar.gz.sha256" >> $GITHUB_ENV

      - name: Upload Release Assets
        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b  # @v2.5.0
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: |
            ${{ env.ASSET }}
            ${{ env.CHECKSUM }}

  cargo-publish:
    runs-on: ubuntu-latest
    environment: release 
    needs: ["build-and-upload"]
    permissions:
      id-token: write   # Required for OIDC token exchange
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # @v6
      - uses: rust-lang/crates-io-auth-action@b7e9a28eded4986ec6b1fa40eeee8f8f165559ec  # @v1
        id: auth
      - run: cargo publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}