netchecker 0.5.3

name: Release

# Fires when you push a version tag (e.g. `v0.1.1`). `just version-patch` etc.
# create and push that tag for you.
on:
  push:
    tags:
      - "v*"

permissions:
  contents: write # needed to create the GitHub Release and upload assets

env:
  CARGO_TERM_COLOR: always

jobs:
  # 1. Create the GitHub Release for this tag (once).
  create-release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: taiki-e/create-gh-release-action@v1
        with:
          # Auto-generate release notes from commits since the last tag.
          changelog: ""
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # 2. Build a binary for every target and attach it (with a SHA-256) to the
  #    Release. taiki-e installs `cross` automatically for the Linux
  #    cross/musl targets, so no manual toolchain juggling.
  upload-assets:
    needs: create-release
    strategy:
      fail-fast: false
      matrix:
        include:
          - { target: x86_64-unknown-linux-gnu, os: ubuntu-latest }
          - { target: x86_64-unknown-linux-musl, os: ubuntu-latest } # static
          - { target: aarch64-unknown-linux-gnu, os: ubuntu-latest }
          - { target: aarch64-unknown-linux-musl, os: ubuntu-latest } # static
          - { target: x86_64-apple-darwin, os: macos-latest }
          - { target: aarch64-apple-darwin, os: macos-latest }
          - { target: x86_64-pc-windows-msvc, os: windows-latest }
          - { target: aarch64-pc-windows-msvc, os: windows-latest }
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: taiki-e/upload-rust-binary-action@v1
        with:
          bin: netchecker
          target: ${{ matrix.target }}
          # e.g. netchecker-v0.1.1-x86_64-unknown-linux-musl.tar.gz
          archive: $bin-$tag-$target
          tar: unix # .tar.gz on unix targets
          zip: windows # .zip on windows targets
          checksum: sha256
          token: ${{ secrets.GITHUB_TOKEN }}

  # 3. Build a .deb per architecture and attach it to the Release. Built on
  #    native runners (amd64 + arm64) so there's no cross-linking to babysit.
  build-deb:
    needs: create-release
    strategy:
      fail-fast: false
      matrix:
        include:
          - { arch: amd64, os: ubuntu-latest }
          - { arch: arm64, os: ubuntu-24.04-arm }
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install cargo-deb
        run: cargo install cargo-deb --locked
      - name: Build .deb
        run: cargo deb
      - name: Attach .deb to release
        run: gh release upload "${GITHUB_REF_NAME}" target/debian/*.deb --clobber
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # 4. Publish the crate to crates.io. Requires a CARGO_REGISTRY_TOKEN repo
  #    secret (crates.io API token with publish-update scope).
  publish-crates:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: cargo publish
        run: cargo publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  # 5. Regenerate the Homebrew formula from the release's own .sha256 files and
  #    push it to the tap. Runs after upload-assets so the checksums exist.
  #    Requires a TAP_TOKEN secret: a PAT with contents:write on the
  #    pourmand1376/homebrew-tap repo (the default GITHUB_TOKEN can't push to
  #    another repo). Skip this job by not setting the secret.
  update-homebrew:
    needs: upload-assets
    runs-on: ubuntu-latest
    steps:
      - name: Checkout tap
        uses: actions/checkout@v4
        with:
          repository: pourmand1376/homebrew-tap
          token: ${{ secrets.TAP_TOKEN }}
      - name: Regenerate formula
        env:
          TAG: ${{ github.ref_name }} # vX.Y.Z
        run: |
          set -euo pipefail
          v="${TAG#v}"
          base="https://github.com/pourmand1376/netchecker/releases/download/${TAG}"
          sha() { curl -fsSL "$base/netchecker-${TAG}-$1.sha256" | awk '{print $1}'; }
          mac_arm=$(sha aarch64-apple-darwin)
          mac_x86=$(sha x86_64-apple-darwin)
          lin_arm=$(sha aarch64-unknown-linux-musl)
          lin_x86=$(sha x86_64-unknown-linux-musl)
          mkdir -p Formula
          cat > Formula/netchecker.rb <<EOF
          class Netchecker < Formula
            desc "Cross-platform internet reachability checker"
            homepage "https://github.com/pourmand1376/netchecker"
            version "${v}"
            license "MIT"

            on_macos do
              on_arm do
                url "${base}/netchecker-${TAG}-aarch64-apple-darwin.tar.gz"
                sha256 "${mac_arm}"
              end
              on_intel do
                url "${base}/netchecker-${TAG}-x86_64-apple-darwin.tar.gz"
                sha256 "${mac_x86}"
              end
            end

            on_linux do
              on_arm do
                url "${base}/netchecker-${TAG}-aarch64-unknown-linux-musl.tar.gz"
                sha256 "${lin_arm}"
              end
              on_intel do
                url "${base}/netchecker-${TAG}-x86_64-unknown-linux-musl.tar.gz"
                sha256 "${lin_x86}"
              end
            end

            def install
              bin.install "netchecker"
            end

            test do
              system bin/"netchecker", "--version"
            end
          end
          EOF
      - name: Commit & push
        env:
          TAG: ${{ github.ref_name }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add Formula/netchecker.rb
          git commit -m "netchecker ${TAG#v}" || { echo "no change"; exit 0; }
          git push