gwm-cli 1.2.0

name: release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      tag:
        description: "tag to release (e.g. v0.1.0)"
        required: true

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    name: build (${{ matrix.target }})
    # Stable releases only. GitHub's `v*.*.*` tag glob also matches
    # `v0.7.0-rc.3`, so keep the stable workflow from building artifacts for
    # tags that belong to `pre-release.yml`.
    if: |
      !contains(github.event.inputs.tag || github.ref_name, '-rc.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-alpha.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-beta.')
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            archive: tar.gz
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            archive: tar.gz
            cross: true
          - os: macos-latest
            target: x86_64-apple-darwin
            archive: tar.gz
          - os: macos-latest
            target: aarch64-apple-darwin
            archive: tar.gz
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            archive: zip
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2

      - name: install cross (linux aarch64)
        if: matrix.cross == true
        run: cargo install cross --locked

      - name: build (cargo)
        if: matrix.cross != true
        run: cargo build --release --target ${{ matrix.target }} --locked

      - name: build (cross)
        if: matrix.cross == true
        run: cross build --release --target ${{ matrix.target }} --locked

      - name: package (unix)
        if: matrix.os != 'windows-latest'
        shell: bash
        run: |
          BIN_NAME="gwm"
          STAGE="${BIN_NAME}-${{ github.ref_name }}-${{ matrix.target }}"
          mkdir -p "dist/${STAGE}"
          cp "target/${{ matrix.target }}/release/${BIN_NAME}" "dist/${STAGE}/"
          cp README.md LICENSE.md CHANGELOG.md "dist/${STAGE}/"
          tar -C dist -czf "dist/${STAGE}.tar.gz" "${STAGE}"
          shasum -a 256 "dist/${STAGE}.tar.gz" > "dist/${STAGE}.tar.gz.sha256"

      - name: package (windows)
        if: matrix.os == 'windows-latest'
        shell: pwsh
        # Set-Content -Encoding ascii ensures the sidecar is plain ASCII (no
        # UTF-16 BOM that PowerShell's `Out-File` would add by default) so the
        # checksum file is verifiable by `sha256sum -c` on other platforms.
        run: |
          $BIN_NAME = "gwm.exe"
          $STAGE = "gwm-${{ github.ref_name }}-${{ matrix.target }}"
          New-Item -ItemType Directory -Force -Path "dist/$STAGE" | Out-Null
          Copy-Item "target/${{ matrix.target }}/release/$BIN_NAME" "dist/$STAGE/"
          Copy-Item README.md, LICENSE.md, CHANGELOG.md "dist/$STAGE/"
          Compress-Archive -Path "dist/$STAGE" -DestinationPath "dist/$STAGE.zip"
          $hash = (Get-FileHash -Algorithm SHA256 "dist/$STAGE.zip").Hash.ToLower()
          Set-Content -Path "dist/$STAGE.zip.sha256" -Encoding ascii -Value "$hash  $STAGE.zip"

      # Native Linux packages (issues #377 / #378). cargo-deb and
      # cargo-generate-rpm rewrite the `target/release` asset prefix to the
      # per-target dir when `--target` is passed, so they package the binary
      # the (cross-)build step above already produced — no rebuild. `--no-build`
      # (deb) keeps it from recompiling; the explicit `depends`/`auto-req = no`
      # in Cargo.toml skip dpkg-shlibdeps / rpm dep-detection, which can't run
      # against the cross-built aarch64 binary on an x86_64 runner.
      - name: package (linux .deb / .rpm)
        if: matrix.os == 'ubuntu-latest'
        shell: bash
        run: |
          cargo install cargo-deb cargo-generate-rpm --locked
          # `--no-strip`: the release profile already strips (`strip = true`),
          # AND cargo-deb's default strip runs the HOST `strip` — which can't
          # process the aarch64 ELF that `cross` built, failing the arm64 job.
          # cargo-generate-rpm does not strip, so it needs no such flag.
          cargo deb --no-build --no-strip --target ${{ matrix.target }} --output dist/
          cargo generate-rpm --target ${{ matrix.target }} --output dist/
          ( cd dist && for f in *.deb *.rpm; do shasum -a 256 "$f" > "$f.sha256"; done )
          ls -la dist

      - name: upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: gwm-${{ matrix.target }}
          path: |
            dist/*.tar.gz
            dist/*.tar.gz.sha256
            dist/*.zip
            dist/*.zip.sha256
          if-no-files-found: error

      - name: upload artifacts (linux packages)
        if: matrix.os == 'ubuntu-latest'
        uses: actions/upload-artifact@v7
        with:
          name: gwm-linux-packages-${{ matrix.target }}
          path: |
            dist/*.deb
            dist/*.deb.sha256
            dist/*.rpm
            dist/*.rpm.sha256
          if-no-files-found: error

  release:
    name: github release
    needs: [build]
    if: |
      !contains(github.event.inputs.tag || github.ref_name, '-rc.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-alpha.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-beta.')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: dist
          merge-multiple: true

      # Release notes come from the per-version file under `changelogs/`,
      # not the top-level `CHANGELOG.md` (which is only the in-progress
      # index — entries get moved into `changelogs/X.Y.Z.md` when the
      # release is cut). Sourcing from the index would publish an empty
      # body with the past-releases list, as observed for v0.6.0 / v0.6.0-rc.1
      # before this fix.
      - name: resolve changelog path
        id: changelog
        shell: bash
        run: |
          TAG="${{ github.ref_name }}"
          VERSION="${TAG#v}"
          CHANGELOG_PATH="changelogs/${VERSION}.md"
          if [ ! -f "${CHANGELOG_PATH}" ]; then
            echo "::error::Expected ${CHANGELOG_PATH} to exist for tag ${TAG} — release notes would otherwise fall back to the empty CHANGELOG.md index."
            exit 1
          fi
          echo "path=${CHANGELOG_PATH}" >> "$GITHUB_OUTPUT"

      - name: publish release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            gh release edit "$TAG" \
              --repo "$GITHUB_REPOSITORY" \
              --title "$TAG" \
              --notes-file "${{ steps.changelog.outputs.path }}" \
              --draft=false \
              --prerelease=false
          else
            gh release create "$TAG" \
              --repo "$GITHUB_REPOSITORY" \
              --title "$TAG" \
              --notes-file "${{ steps.changelog.outputs.path }}" \
              --verify-tag \
              --draft=false \
              --prerelease=false
          fi

          gh release upload "$TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --clobber \
            dist/*.tar.gz \
            dist/*.tar.gz.sha256 \
            dist/*.zip \
            dist/*.zip.sha256 \
            dist/*.deb \
            dist/*.deb.sha256 \
            dist/*.rpm \
            dist/*.rpm.sha256

  homebrew-tap-update:
    name: update homebrew tap
    needs: [release]
    runs-on: ubuntu-latest
    # Stable releases only — rc/alpha/beta must never reach `brew install gwm`,
    # otherwise users tracking the tap would silently move to a pre-release.
    # Intentionally does NOT gate on `event_name == 'push'`: the documented
    # recovery path (`gh workflow run release.yml --ref <tag>`) needs to
    # re-drive this job after a transient failure, which is a
    # workflow_dispatch event. The suffix filter alone is sufficient
    # because dispatch-from-a-branch would already break the upstream
    # `build` / `release` jobs (they archive `${{ github.ref_name }}`),
    # so the whole workflow is implicitly tag-scoped.
    if: |
      !contains(github.event.inputs.tag || github.ref_name, '-rc.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-alpha.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-beta.')
    # While HOMEBREW_TAP_TOKEN is being provisioned the first time, a missing
    # secret would fail this job. Keep it advisory so the GitHub release
    # still lands and the tap refresh can be re-driven manually via
    # workflow_dispatch once the secret exists. Flip to false after the
    # first successful sync (see CONTRIBUTING.md > Releases > Homebrew tap).
    continue-on-error: true
    steps:
      - name: verify HOMEBREW_TAP_TOKEN is configured
        env:
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          if [ -z "${HOMEBREW_TAP_TOKEN:-}" ]; then
            echo "::error::HOMEBREW_TAP_TOKEN secret is not configured."
            echo "Bootstrap: see CONTRIBUTING.md > Releases > Homebrew tap setup."
            exit 1
          fi

      - name: checkout gwm-cli (template + render script)
        uses: actions/checkout@v7
        with:
          path: gwm-cli

      - name: checkout kbrdn1/homebrew-tap
        uses: actions/checkout@v7
        with:
          repository: kbrdn1/homebrew-tap
          path: homebrew-tap
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}

      - name: fetch sha256 sidecars from the release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          mkdir -p sha
          for target in aarch64-apple-darwin x86_64-apple-darwin; do
            gh release download "$TAG" \
              --repo kbrdn1/gwm-cli \
              --pattern "gwm-${TAG}-${target}.tar.gz.sha256" \
              --dir sha
          done
          ls -la sha

      - name: render Formula/gwm.rb
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          VERSION="${TAG#v}"
          SHA_ARM64=$(awk '{print $1}' "sha/gwm-${TAG}-aarch64-apple-darwin.tar.gz.sha256")
          SHA_X86_64=$(awk '{print $1}' "sha/gwm-${TAG}-x86_64-apple-darwin.tar.gz.sha256")
          mkdir -p homebrew-tap/Formula
          sh gwm-cli/.github/scripts/render-tap-formula.sh \
            "$TAG" "$VERSION" "$SHA_ARM64" "$SHA_X86_64" \
            gwm-cli/packaging/homebrew/gwm.rb.template \
            > homebrew-tap/Formula/gwm.rb
          echo "=== rendered Formula/gwm.rb ==="
          cat homebrew-tap/Formula/gwm.rb

      - name: commit + push to tap
        working-directory: homebrew-tap
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          git config user.name  "gwm-cli release bot"
          git config user.email "release-bot@gwm-cli.local"
          git add Formula/gwm.rb
          if git diff --cached --quiet; then
            echo "Formula/gwm.rb unchanged — nothing to push."
            exit 0
          fi
          git commit -m "gwm ${TAG#v} (${TAG})"
          git push

  scoop-bucket-update:
    name: update scoop bucket
    needs: [release]
    runs-on: ubuntu-latest
    # Stable releases only — rc/alpha/beta must never reach `scoop install gwm`,
    # otherwise users tracking the bucket would silently move to a pre-release.
    # Same reasoning as homebrew-tap-update above (the whole workflow is
    # implicitly tag-scoped via the upstream jobs).
    if: |
      !contains(github.event.inputs.tag || github.ref_name, '-rc.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-alpha.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-beta.')
    # While SCOOP_BUCKET_TOKEN is being provisioned the first time, a missing
    # secret would fail this job. Keep it advisory so the GitHub release still
    # lands and the bucket refresh can be re-driven manually via
    # workflow_dispatch once the secret exists. Flip to false after the first
    # successful sync (see CONTRIBUTING.md > Releases > Scoop bucket).
    continue-on-error: true
    steps:
      - name: verify SCOOP_BUCKET_TOKEN is configured
        env:
          SCOOP_BUCKET_TOKEN: ${{ secrets.SCOOP_BUCKET_TOKEN }}
        run: |
          if [ -z "${SCOOP_BUCKET_TOKEN:-}" ]; then
            echo "::error::SCOOP_BUCKET_TOKEN secret is not configured."
            echo "Bootstrap: see CONTRIBUTING.md > Releases > Scoop bucket setup."
            exit 1
          fi

      - name: checkout gwm-cli (template + render script)
        uses: actions/checkout@v7
        with:
          path: gwm-cli

      - name: checkout kbrdn1/scoop-gwm
        uses: actions/checkout@v7
        with:
          repository: kbrdn1/scoop-gwm
          path: scoop-gwm
          token: ${{ secrets.SCOOP_BUCKET_TOKEN }}

      - name: fetch sha256 sidecar from the release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          mkdir -p sha
          gh release download "$TAG" \
            --repo kbrdn1/gwm-cli \
            --pattern "gwm-${TAG}-x86_64-pc-windows-msvc.zip.sha256" \
            --dir sha
          ls -la sha

      - name: render bucket/gwm.json
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          VERSION="${TAG#v}"
          SHA_X86_64=$(awk '{print $1}' "sha/gwm-${TAG}-x86_64-pc-windows-msvc.zip.sha256")
          mkdir -p scoop-gwm/bucket
          sh gwm-cli/.github/scripts/render-scoop-manifest.sh \
            "$TAG" "$VERSION" "$SHA_X86_64" \
            gwm-cli/packaging/scoop/gwm.json.template \
            > scoop-gwm/bucket/gwm.json
          echo "=== rendered bucket/gwm.json ==="
          cat scoop-gwm/bucket/gwm.json

      - name: commit + push to bucket
        working-directory: scoop-gwm
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          git config user.name  "gwm-cli release bot"
          git config user.email "release-bot@gwm-cli.local"
          git add bucket/gwm.json
          if git diff --cached --quiet; then
            echo "bucket/gwm.json unchanged — nothing to push."
            exit 0
          fi
          git commit -m "gwm ${TAG#v} (${TAG})"
          git push

  aur-publish:
    name: publish gwm-cli-bin to the AUR
    needs: [release]
    runs-on: ubuntu-latest
    # Stable releases only — rc/alpha/beta must never reach `yay -S gwm-cli-bin`,
    # otherwise Arch users would silently move to a pre-release. Same reasoning
    # as homebrew-tap-update / scoop-bucket-update above (the whole workflow is
    # implicitly tag-scoped via the upstream jobs).
    if: |
      !contains(github.event.inputs.tag || github.ref_name, '-rc.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-alpha.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-beta.')
    # While AUR_SSH_PRIVATE_KEY is being provisioned the first time, a missing
    # secret would fail this job. Keep it advisory so the GitHub release still
    # lands and the AUR push can be re-driven manually via workflow_dispatch
    # once the secret exists. Flip to false after the first successful sync
    # (see CONTRIBUTING.md > Releases > AUR).
    continue-on-error: true
    steps:
      - name: verify AUR_SSH_PRIVATE_KEY is configured
        env:
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
        run: |
          if [ -z "${AUR_SSH_PRIVATE_KEY:-}" ]; then
            echo "::error::AUR_SSH_PRIVATE_KEY secret is not configured."
            echo "Bootstrap: see CONTRIBUTING.md > Releases > AUR setup."
            exit 1
          fi

      - name: checkout gwm-cli (template + render script)
        uses: actions/checkout@v7

      - name: fetch sha256 sidecars from the release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          mkdir -p sha
          for target in x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu; do
            gh release download "$TAG" \
              --repo kbrdn1/gwm-cli \
              --pattern "gwm-${TAG}-${target}.tar.gz.sha256" \
              --dir sha
          done
          ls -la sha

      - name: render aur/PKGBUILD
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          VERSION="${TAG#v}"
          SHA_X86_64=$(awk '{print $1}' "sha/gwm-${TAG}-x86_64-unknown-linux-gnu.tar.gz.sha256")
          SHA_ARM64=$(awk '{print $1}' "sha/gwm-${TAG}-aarch64-unknown-linux-gnu.tar.gz.sha256")
          mkdir -p aur
          sh .github/scripts/render-aur-pkgbuild.sh \
            "$VERSION" "$SHA_X86_64" "$SHA_ARM64" \
            packaging/aur/PKGBUILD.template \
            > aur/PKGBUILD
          echo "=== rendered aur/PKGBUILD ==="
          cat aur/PKGBUILD

      # Third-party action — pinned to a commit SHA (v4.2.0) because it is
      # trusted with AUR_SSH_PRIVATE_KEY. It clones the AUR repo, drops in our
      # rendered PKGBUILD, regenerates .SRCINFO via makepkg, and pushes.
      # `test: true` runs `makepkg` in an Arch container against the real
      # release binary — it builds the package (verifying the source download
      # and sha256sums on the actual statically-linked artifact), so a broken
      # PKGBUILD or a bad checksum fails the job here rather than shipping to
      # the AUR. It does NOT run namcap; the PKGBUILD was namcap-linted locally
      # (see the PR / packaging/aur/PKGBUILD.template).
      - name: publish to the AUR
        uses: KSXGitHub/github-actions-deploy-aur@084b0d9b15415bf9cdb65d44dad1efe37a354050 # v4.2.0
        with:
          pkgname: gwm-cli-bin
          pkgbuild: aur/PKGBUILD
          commit_username: kbrdn1
          commit_email: onepiecekylian@gmail.com
          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
          commit_message: "gwm-cli-bin ${{ github.ref_name }}"
          ssh_keyscan_types: rsa,ecdsa,ed25519
          test: true

  winget-publish:
    name: publish kbrdn1.gwm to winget
    needs: [release]
    runs-on: ubuntu-latest
    # Stable releases only — rc/alpha/beta must never reach `winget install
    # kbrdn1.gwm`. Same reasoning as the homebrew/scoop/aur jobs above (the
    # whole workflow is implicitly tag-scoped via the upstream jobs).
    if: |
      !contains(github.event.inputs.tag || github.ref_name, '-rc.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-alpha.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-beta.')
    # Advisory until WINGET_TOKEN is provisioned AND the initial `kbrdn1.gwm`
    # manifest is merged into microsoft/winget-pkgs — komac UPDATES an existing
    # package, so the first submission is manual (see CONTRIBUTING). Flip to
    # false after the first successful automated submission.
    continue-on-error: true
    env:
      # Pinned AND digest-anchored: the expected sha256 lives here, in this
      # repo, rather than being fetched from the same upstream release as the
      # binary — a release whose artifacts and SHA256SUMS were both swapped
      # would otherwise still verify. Bump the two together, deliberately.
      KOMAC_VERSION: 2.16.0
      KOMAC_SHA256: 7d2707fa6210f2789a3702de49fbd150b736dbf426ee0b9bc8e098736f9fd82d
    steps:
      - name: verify WINGET_TOKEN is configured
        env:
          WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
        run: |
          if [ -z "${WINGET_TOKEN:-}" ]; then
            echo "::error::WINGET_TOKEN secret is not configured."
            echo "Bootstrap: see CONTRIBUTING.md > Releases > winget setup."
            exit 1
          fi

      # Run komac directly from a pinned, digest-anchored release binary instead
      # of the `winget-releaser` action. That action pulls
      # `cargo-bins/cargo-binstall@main` (a mutable ref) and installs the latest
      # komac at runtime, so a compromise of either would run with WINGET_TOKEN
      # in scope — a SHA pin on the action alone would not protect the secret.
      # Pinning the one tool that touches the token is the same posture as the
      # SHA-pinned deploy-aur job above.
      - name: install komac (pinned + digest-anchored)
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          tarball="komac-${KOMAC_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
          gh release download "v${KOMAC_VERSION}" --repo russellbanks/Komac \
            --pattern "$tarball" --dir /tmp/komac
          echo "${KOMAC_SHA256}  /tmp/komac/${tarball}" | sha256sum -c -
          tar -C /tmp/komac -xzf "/tmp/komac/${tarball}"
          echo /tmp/komac >> "$GITHUB_PATH"

      # `komac update` bases the new version on the existing `kbrdn1.gwm`
      # manifest (nested-portable zip), swapping in the new version, URL, and
      # sha256, then opens a PR from the kbrdn1/winget-pkgs fork. The tag's `v`
      # prefix is stripped to match the winget PackageVersion (v1.1.1 -> 1.1.1).
      - name: submit the manifest update to winget-pkgs
        env:
          GITHUB_TOKEN: ${{ secrets.WINGET_TOKEN }}
          KOMAC_FORK_OWNER: kbrdn1
          KOMAC_CREATED_WITH: gwm-cli release.yml
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          version="${TAG#v}"
          url="https://github.com/kbrdn1/gwm-cli/releases/download/${TAG}/gwm-${TAG}-x86_64-pc-windows-msvc.zip"
          komac update kbrdn1.gwm --version "$version" --urls "$url" --submit