gwm-cli 1.6.0

name: release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      tag:
        description: "tag to release (e.g. v0.1.0)"
        required: true

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    name: build (${{ matrix.target }})
    # Stable releases only. GitHub's `v*.*.*` tag glob also matches
    # `v0.7.0-rc.3`, so keep the stable workflow from building artifacts for
    # tags that belong to `pre-release.yml`.
    if: |
      !contains(github.event.inputs.tag || github.ref_name, '-rc.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-alpha.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-beta.')
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            archive: tar.gz
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            archive: tar.gz
            cross: true
          - os: macos-latest
            target: x86_64-apple-darwin
            archive: tar.gz
          - os: macos-latest
            target: aarch64-apple-darwin
            archive: tar.gz
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            archive: zip
    steps:
      # Reads the tree to build and package it, never pushes — so the token
      # `actions/checkout` would otherwise leave in `.git/config` is a
      # credential handed to every later step for nothing. Same reasoning for
      # every checkout below that does not pass an explicit `token:`;
      # `tests/release_workflow_tests.rs` pins both sides of that split.
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2

      - name: install cross (linux aarch64)
        if: matrix.cross == true
        run: cargo install cross --locked

      - name: build (cargo)
        if: matrix.cross != true
        run: cargo build --release --target ${{ matrix.target }} --locked

      - name: build (cross)
        if: matrix.cross == true
        run: cross build --release --target ${{ matrix.target }} --locked

      - name: package (unix)
        if: matrix.os != 'windows-latest'
        shell: bash
        run: |
          BIN_NAME="gwm"
          STAGE="${BIN_NAME}-${{ github.ref_name }}-${{ matrix.target }}"
          mkdir -p "dist/${STAGE}"
          cp "target/${{ matrix.target }}/release/${BIN_NAME}" "dist/${STAGE}/"
          cp README.md LICENSE.md CHANGELOG.md "dist/${STAGE}/"
          tar -C dist -czf "dist/${STAGE}.tar.gz" "${STAGE}"
          shasum -a 256 "dist/${STAGE}.tar.gz" > "dist/${STAGE}.tar.gz.sha256"

      - name: package (windows)
        if: matrix.os == 'windows-latest'
        shell: pwsh
        # Set-Content -Encoding ascii ensures the sidecar is plain ASCII (no
        # UTF-16 BOM that PowerShell's `Out-File` would add by default) so the
        # checksum file is verifiable by `sha256sum -c` on other platforms.
        run: |
          $BIN_NAME = "gwm.exe"
          $STAGE = "gwm-${{ github.ref_name }}-${{ matrix.target }}"
          New-Item -ItemType Directory -Force -Path "dist/$STAGE" | Out-Null
          Copy-Item "target/${{ matrix.target }}/release/$BIN_NAME" "dist/$STAGE/"
          Copy-Item README.md, LICENSE.md, CHANGELOG.md "dist/$STAGE/"
          Compress-Archive -Path "dist/$STAGE" -DestinationPath "dist/$STAGE.zip"
          $hash = (Get-FileHash -Algorithm SHA256 "dist/$STAGE.zip").Hash.ToLower()
          Set-Content -Path "dist/$STAGE.zip.sha256" -Encoding ascii -Value "$hash  $STAGE.zip"

      # Native Linux packages (issues #377 / #378). cargo-deb and
      # cargo-generate-rpm rewrite the `target/release` asset prefix to the
      # per-target dir when `--target` is passed, so they package the binary
      # the (cross-)build step above already produced — no rebuild. `--no-build`
      # (deb) keeps it from recompiling; the explicit `depends`/`auto-req = no`
      # in Cargo.toml skip dpkg-shlibdeps / rpm dep-detection, which can't run
      # against the cross-built aarch64 binary on an x86_64 runner.
      - name: package (linux .deb / .rpm)
        if: matrix.os == 'ubuntu-latest'
        shell: bash
        run: |
          cargo install cargo-deb cargo-generate-rpm --locked
          # `--no-strip`: the release profile already strips (`strip = true`),
          # AND cargo-deb's default strip runs the HOST `strip` — which can't
          # process the aarch64 ELF that `cross` built, failing the arm64 job.
          # cargo-generate-rpm does not strip, so it needs no such flag.
          cargo deb --no-build --no-strip --target ${{ matrix.target }} --output dist/
          cargo generate-rpm --target ${{ matrix.target }} --output dist/
          ( cd dist && for f in *.deb *.rpm; do shasum -a 256 "$f" > "$f.sha256"; done )
          ls -la dist

      - name: upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: gwm-${{ matrix.target }}
          path: |
            dist/*.tar.gz
            dist/*.tar.gz.sha256
            dist/*.zip
            dist/*.zip.sha256
          if-no-files-found: error

      - name: upload artifacts (linux packages)
        if: matrix.os == 'ubuntu-latest'
        uses: actions/upload-artifact@v7
        with:
          name: gwm-linux-packages-${{ matrix.target }}
          path: |
            dist/*.deb
            dist/*.deb.sha256
            dist/*.rpm
            dist/*.rpm.sha256
          if-no-files-found: error

  release:
    name: github release
    needs: [build]
    if: |
      !contains(github.event.inputs.tag || github.ref_name, '-rc.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-alpha.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-beta.')
    runs-on: ubuntu-latest
    steps:
      # Only reads `changelogs/` for the release notes. The publish step below
      # authenticates `gh` through an explicit `GH_TOKEN`, not through the git
      # credential this checkout would persist.
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: dist
          merge-multiple: true

      # Release notes come from the per-version file under `changelogs/`,
      # not the top-level `CHANGELOG.md` (which is only the in-progress
      # index — entries get moved into `changelogs/X.Y.Z.md` when the
      # release is cut). Sourcing from the index would publish an empty
      # body with the past-releases list, as observed for v0.6.0 / v0.6.0-rc.1
      # before this fix.
      - name: resolve changelog path
        id: changelog
        shell: bash
        run: |
          TAG="${{ github.ref_name }}"
          VERSION="${TAG#v}"
          CHANGELOG_PATH="changelogs/${VERSION}.md"
          if [ ! -f "${CHANGELOG_PATH}" ]; then
            echo "::error::Expected ${CHANGELOG_PATH} to exist for tag ${TAG} — release notes would otherwise fall back to the empty CHANGELOG.md index."
            exit 1
          fi
          echo "path=${CHANGELOG_PATH}" >> "$GITHUB_OUTPUT"

      - name: publish release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            gh release edit "$TAG" \
              --repo "$GITHUB_REPOSITORY" \
              --title "$TAG" \
              --notes-file "${{ steps.changelog.outputs.path }}" \
              --draft=false \
              --prerelease=false
          else
            gh release create "$TAG" \
              --repo "$GITHUB_REPOSITORY" \
              --title "$TAG" \
              --notes-file "${{ steps.changelog.outputs.path }}" \
              --verify-tag \
              --draft=false \
              --prerelease=false
          fi

          gh release upload "$TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --clobber \
            dist/*.tar.gz \
            dist/*.tar.gz.sha256 \
            dist/*.zip \
            dist/*.zip.sha256 \
            dist/*.deb \
            dist/*.deb.sha256 \
            dist/*.rpm \
            dist/*.rpm.sha256

  homebrew-tap-update:
    name: update homebrew tap
    needs: [release]
    runs-on: ubuntu-latest
    # Stable releases only — rc/alpha/beta must never reach `brew install gwm`,
    # otherwise users tracking the tap would silently move to a pre-release.
    # Intentionally does NOT gate on `event_name == 'push'`: the documented
    # recovery path (`gh workflow run release.yml --ref <tag>`) needs to
    # re-drive this job after a transient failure, which is a
    # workflow_dispatch event. The suffix filter alone is sufficient
    # because dispatch-from-a-branch would already break the upstream
    # `build` / `release` jobs (they archive `${{ github.ref_name }}`),
    # so the whole workflow is implicitly tag-scoped.
    if: |
      !contains(github.event.inputs.tag || github.ref_name, '-rc.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-alpha.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-beta.')
    # While HOMEBREW_TAP_TOKEN is being provisioned the first time, a missing
    # secret would fail this job. Keep it advisory so the GitHub release
    # still lands and the tap refresh can be re-driven manually via
    # workflow_dispatch once the secret exists. Flip to false after the
    # first successful sync (see CONTRIBUTING.md > Releases > Homebrew tap).
    continue-on-error: true
    steps:
      - name: verify HOMEBREW_TAP_TOKEN is configured
        env:
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          if [ -z "${HOMEBREW_TAP_TOKEN:-}" ]; then
            echo "::error::HOMEBREW_TAP_TOKEN secret is not configured."
            echo "Bootstrap: see CONTRIBUTING.md > Releases > Homebrew tap setup."
            exit 1
          fi

      - name: checkout gwm-cli (template + render script)
        uses: actions/checkout@v7
        with:
          path: gwm-cli
          persist-credentials: false

      - name: checkout kbrdn1/homebrew-tap
        uses: actions/checkout@v7
        with:
          repository: kbrdn1/homebrew-tap
          path: homebrew-tap
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}

      - name: fetch sha256 sidecars from the release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          mkdir -p sha
          for target in aarch64-apple-darwin x86_64-apple-darwin; do
            gh release download "$TAG" \
              --repo kbrdn1/gwm-cli \
              --pattern "gwm-${TAG}-${target}.tar.gz.sha256" \
              --dir sha
          done
          ls -la sha

      - name: render Formula/gwm.rb
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          VERSION="${TAG#v}"
          SHA_ARM64=$(awk '{print $1}' "sha/gwm-${TAG}-aarch64-apple-darwin.tar.gz.sha256")
          SHA_X86_64=$(awk '{print $1}' "sha/gwm-${TAG}-x86_64-apple-darwin.tar.gz.sha256")
          mkdir -p homebrew-tap/Formula
          sh gwm-cli/.github/scripts/render-tap-formula.sh \
            "$TAG" "$VERSION" "$SHA_ARM64" "$SHA_X86_64" \
            gwm-cli/packaging/homebrew/gwm.rb.template \
            > homebrew-tap/Formula/gwm.rb
          echo "=== rendered Formula/gwm.rb ==="
          cat homebrew-tap/Formula/gwm.rb

      - name: commit + push to tap
        working-directory: homebrew-tap
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          git config user.name  "gwm-cli release bot"
          git config user.email "release-bot@gwm-cli.local"
          git add Formula/gwm.rb
          if git diff --cached --quiet; then
            echo "Formula/gwm.rb unchanged — nothing to push."
            exit 0
          fi
          git commit -m "gwm ${TAG#v} (${TAG})"
          git push

  scoop-bucket-update:
    name: update scoop bucket
    needs: [release]
    runs-on: ubuntu-latest
    # Stable releases only — rc/alpha/beta must never reach `scoop install gwm`,
    # otherwise users tracking the bucket would silently move to a pre-release.
    # Same reasoning as homebrew-tap-update above (the whole workflow is
    # implicitly tag-scoped via the upstream jobs).
    if: |
      !contains(github.event.inputs.tag || github.ref_name, '-rc.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-alpha.') &&
      !contains(github.event.inputs.tag || github.ref_name, '-beta.')
    # While SCOOP_BUCKET_TOKEN is being provisioned the first time, a missing
    # secret would fail this job. Keep it advisory so the GitHub release still
    # lands and the bucket refresh can be re-driven manually via
    # workflow_dispatch once the secret exists. Flip to false after the first
    # successful sync (see CONTRIBUTING.md > Releases > Scoop bucket).
    continue-on-error: true
    steps:
      - name: verify SCOOP_BUCKET_TOKEN is configured
        env:
          SCOOP_BUCKET_TOKEN: ${{ secrets.SCOOP_BUCKET_TOKEN }}
        run: |
          if [ -z "${SCOOP_BUCKET_TOKEN:-}" ]; then
            echo "::error::SCOOP_BUCKET_TOKEN secret is not configured."
            echo "Bootstrap: see CONTRIBUTING.md > Releases > Scoop bucket setup."
            exit 1
          fi

      - name: checkout gwm-cli (template + render script)
        uses: actions/checkout@v7
        with:
          path: gwm-cli
          persist-credentials: false

      - name: checkout kbrdn1/scoop-gwm
        uses: actions/checkout@v7
        with:
          repository: kbrdn1/scoop-gwm
          path: scoop-gwm
          token: ${{ secrets.SCOOP_BUCKET_TOKEN }}

      - name: fetch sha256 sidecar from the release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          mkdir -p sha
          gh release download "$TAG" \
            --repo kbrdn1/gwm-cli \
            --pattern "gwm-${TAG}-x86_64-pc-windows-msvc.zip.sha256" \
            --dir sha
          ls -la sha

      - name: render bucket/gwm.json
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          VERSION="${TAG#v}"
          SHA_X86_64=$(awk '{print $1}' "sha/gwm-${TAG}-x86_64-pc-windows-msvc.zip.sha256")
          mkdir -p scoop-gwm/bucket
          sh gwm-cli/.github/scripts/render-scoop-manifest.sh \
            "$TAG" "$VERSION" "$SHA_X86_64" \
            gwm-cli/packaging/scoop/gwm.json.template \
            > scoop-gwm/bucket/gwm.json
          echo "=== rendered bucket/gwm.json ==="
          cat scoop-gwm/bucket/gwm.json

      - name: commit + push to bucket
        working-directory: scoop-gwm
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          git config user.name  "gwm-cli release bot"
          git config user.email "release-bot@gwm-cli.local"
          git add bucket/gwm.json
          if git diff --cached --quiet; then
            echo "bucket/gwm.json unchanged — nothing to push."
            exit 0
          fi
          git commit -m "gwm ${TAG#v} (${TAG})"
          git push