memory-mcp 0.6.0

# Release workflow — triggered by tag push from tag-release.yml.
# Builds binaries, publishes crate + Docker image, then undrafts the release.
name: Release

on:
  push:
    tags: ['v[0-9]+.[0-9]+.[0-9]+*']

concurrency:
  group: release
  cancel-in-progress: false

permissions: {}

jobs:
  create-release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      tag_name: ${{ github.ref_name }}
      is_prerelease: ${{ contains(github.ref_name, '-') }}
    steps:
      - name: Create draft release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ github.ref_name }}
        run: |
          prerelease_flag=""
          if [[ "$TAG_NAME" == *-* ]]; then
            prerelease_flag="--prerelease"
          fi
          gh release create "$TAG_NAME" --draft $prerelease_flag \
            --title "$TAG_NAME" \
            --repo "${{ github.repository }}"

  # Build release binaries with cargo-auditable and upload as release assets.
  # All binaries include the k8s feature (opt-in at runtime via --store k8s-secret).
  # Uses cargo auditable build (0.7+ subcommand) directly instead of
  # taiki-e/upload-rust-binary-action, which doesn't support it yet.
  publish-binaries:
    needs: create-release
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
          # Windows excluded until usearch supports it (see #42).
          - target: universal-apple-darwin
            os: macos-latest
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    env:
      CARGO_INCREMENTAL: '0'
      CARGO_TERM_COLOR: always
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.create-release.outputs.tag_name }}
          persist-credentials: false
      - name: Install system dependencies
        if: matrix.target == 'x86_64-unknown-linux-gnu'
        run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev pkg-config
      - uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # master (2026-02-13)
        with:
          toolchain: stable
          targets: ${{ matrix.target == 'universal-apple-darwin' && 'aarch64-apple-darwin,x86_64-apple-darwin' || matrix.target }}
      - name: Install cargo-auditable
        run: cargo install cargo-auditable@0.7.4 --locked
      - name: Build
        run: |
          case "${{ matrix.target }}" in
            x86_64-unknown-linux-gnu)
              cargo auditable build --release --features k8s --target x86_64-unknown-linux-gnu
              cp target/x86_64-unknown-linux-gnu/release/memory-mcp memory-mcp
              ;;
            universal-apple-darwin)
              cargo auditable build --release --features k8s --target aarch64-apple-darwin --target x86_64-apple-darwin
              lipo -create -output memory-mcp \
                target/aarch64-apple-darwin/release/memory-mcp \
                target/x86_64-apple-darwin/release/memory-mcp
              ;;
            *)
              echo "::error::Unknown target: ${{ matrix.target }}"
              exit 1
              ;;
          esac
      - name: Package and upload
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ needs.create-release.outputs.tag_name }}
        run: |
          archive="memory-mcp-${TAG_NAME}-${{ matrix.target }}"
          mkdir "${archive}"
          mv memory-mcp "${archive}/"
          tar czf "${archive}.tar.gz" "${archive}"
          shasum -a 256 "${archive}.tar.gz" > "${archive}.tar.gz.sha256"
          gh release upload "${TAG_NAME}" "${archive}.tar.gz" "${archive}.tar.gz.sha256" \
            --repo "${{ github.repository }}"

  publish-crate:
    needs: create-release
    if: ${{ needs.create-release.outputs.is_prerelease != 'true' }}
    uses: ./.github/workflows/publish-crate.yml
    with:
      tag: ${{ needs.create-release.outputs.tag_name }}
    permissions:
      id-token: write
      contents: read

  publish-image:
    needs: create-release
    if: ${{ needs.create-release.outputs.is_prerelease != 'true' }}
    uses: ./.github/workflows/publish-image.yml
    with:
      tag: ${{ needs.create-release.outputs.tag_name }}
    permissions:
      contents: read
      packages: write
      id-token: write

  # Undraft the release after all artifacts are uploaded.
  publish-release:
    needs: [create-release, publish-binaries, publish-crate, publish-image]
    if: ${{ always() && needs.create-release.result == 'success' && needs.publish-binaries.result == 'success' && (needs.publish-crate.result == 'skipped' || needs.publish-crate.result == 'success') && (needs.publish-image.result == 'skipped' || needs.publish-image.result == 'success') }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ needs.create-release.outputs.tag_name }}
        run: |
          gh release edit "$TAG_NAME" \
            --draft=false \
            --repo "${{ github.repository }}"

  update-release-notes:
    needs: [create-release, publish-release]
    if: ${{ needs.create-release.outputs.is_prerelease != 'true' }}
    uses: ./.github/workflows/update-release-notes.yml
    with:
      tag: ${{ needs.create-release.outputs.tag_name }}
    permissions:
      contents: write