murk-cli 0.5.11

name: Release

on:
  push:
    tags: ["v*"]

permissions: read-all

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    name: Build (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            cross: true
          - target: arm-unknown-linux-gnueabihf
            os: ubuntu-latest
            cross: true
          - target: x86_64-apple-darwin
            os: macos-14
          - target: aarch64-apple-darwin
            os: macos-latest
          - target: x86_64-pc-windows-msvc
            os: windows-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2

      - name: Install cross
        if: matrix.cross
        run: cargo install cross --locked --version 0.2.5

      - name: Build
        run: |
          if [ "${{ matrix.cross }}" = "true" ]; then
            cross build --release --locked --target ${{ matrix.target }}
          else
            cargo build --release --locked --target ${{ matrix.target }}
          fi
        shell: bash

      - name: Package (Unix)
        if: runner.os != 'Windows'
        run: |
          cd target/${{ matrix.target }}/release
          tar czf ../../../murk-${{ github.ref_name }}-${{ matrix.target }}.tar.gz murk

      - name: Package (Windows)
        if: runner.os == 'Windows'
        shell: bash
        run: |
          cd target/${{ matrix.target }}/release
          7z a ../../../murk-${{ github.ref_name }}-${{ matrix.target }}.zip murk.exe

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: murk-${{ matrix.target }}
          path: murk-${{ github.ref_name }}-${{ matrix.target }}.*

  release:
    name: GitHub Release
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

      - name: Generate release notes
        uses: orhun/git-cliff-action@c93ef52f3d0ddcdcc9bd5447d98d458a11cd4f72 # v4
        id: cliff
        with:
          config: cliff.toml
          args: --latest --strip header
        env:
          OUTPUT: CHANGES.md

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          merge-multiple: true

      - name: Checksums
        run: sha256sum murk-* > SHA256SUMS

      - name: Attest build provenance
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-path: |
            murk-*
            SHA256SUMS

      - uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2
        with:
          body_path: CHANGES.md
          files: |
            murk-*
            SHA256SUMS

  homebrew:
    name: Update Homebrew tap
    needs: release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Download checksums
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release download ${{ github.ref_name }} --pattern SHA256SUMS

      - name: Render formula
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          cp .github/formula/murk.rb.template murk.rb

          for target in x86_64-apple-darwin aarch64-apple-darwin x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu; do
            HASH=$(grep "murk-${{ github.ref_name }}-${target}.tar.gz" SHA256SUMS | awk '{print $1}')
            PLACEHOLDER="__SHA256_$(echo "$target" | tr '[:lower:]-' '[:upper:]_')__"
            sed -i "s/${PLACEHOLDER}/${HASH}/" murk.rb
          done

          sed -i "s/__VERSION__/${VERSION}/" murk.rb
          cat murk.rb

      - name: Push to tap
        env:
          TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          git clone https://x-access-token:${TAP_TOKEN}@github.com/iicky/homebrew-murk.git tap
          mkdir -p tap/Formula
          cp murk.rb tap/Formula/murk.rb
          cd tap
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Formula/murk.rb
          git commit -m "murk ${GITHUB_REF_NAME}"
          git push

  publish:
    name: Publish to crates.io
    needs: build
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
      - name: Authenticate to crates.io via OIDC
        uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe # v1.0.4
        id: crates-auth
      - name: Publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates-auth.outputs.token }}
        shell: bash
        run: |
          set -o pipefail
          cargo publish 2>&1 | tee /tmp/publish.log || {
            if grep -q "already uploaded" /tmp/publish.log; then
              echo "Version already published"
              exit 0
            fi
            exit 1
          }