ssh-vault 1.3.4

---
name: Deploy

on:
  push:
    tags:
      - '*'
  workflow_dispatch:
    inputs:
      homebrew_tag:
        description: Tag to test with, for example 1.2.14
        required: false
        type: string
      homebrew_dry_run:
        description: Test brew bump-formula-pr without creating a PR
        required: true
        type: boolean
        default: true

permissions:
  contents: write

jobs:
  test:
    uses: ./.github/workflows/test.yml

  build:
    name: Build and release
    runs-on: ${{ matrix.os }}
    needs: test
    if: startsWith(github.ref, 'refs/tags/')

    strategy:
      matrix:
        include:
          - build: linux
            os: ubuntu-latest
            target: x86_64-unknown-linux-musl

          - build: linux-arm
            os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-musl

          - build: macos
            os: macos-latest
            target: x86_64-apple-darwin

          - build: windows
            os: windows-latest
            target: x86_64-pc-windows-msvc

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Get the release version from the tag
        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - run: sudo apt -y install musl-dev musl-tools
        if: startsWith(matrix.build, 'linux')

      - name: Build
        run: |
          cargo build --release --locked --target ${{ matrix.target }}

      - name: Build archive
        shell: bash
        run: |
          binary_name="ssh-vault"

          dirname="$binary_name-${{ env.VERSION }}-${{ matrix.target }}"
          mkdir "$dirname"
          if [ "${{ matrix.os }}" = "windows-latest" ]; then
            mv "target/${{ matrix.target }}/release/$binary_name.exe" "$dirname"
          else
            mv "target/${{ matrix.target }}/release/$binary_name" "$dirname"
          fi

          if [ "${{ matrix.os }}" = "windows-latest" ]; then
            7z a "$dirname.zip" "$dirname"
            echo "ASSET=$dirname.zip" >> $GITHUB_ENV
          else
            tar -czf "$dirname.tar.gz" "$dirname"
            echo "ASSET=$dirname.tar.gz" >> $GITHUB_ENV
          fi

      - name: Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v3
        with:
          files: |-
            ${{ env.ASSET }}

  package-release:
    name: Build Linux packages
    runs-on: ${{ matrix.os }}
    needs: test
    if: startsWith(github.ref, 'refs/tags/')

    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            rpm_arch: x86_64

          - os: ubuntu-24.04-arm
            rpm_arch: aarch64

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install packaging tools
        run: cargo install --locked cargo-deb cargo-generate-rpm

      - name: Build release binary
        run: cargo build --release --locked

      - name: Build deb
        run: cargo deb --no-build

      - name: Build rpm
        run: cargo generate-rpm --arch ${{ matrix.rpm_arch }}

      - name: Release packages
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v3
        with:
          files: |-
            target/debian/*.deb
            target/generate-rpm/*.rpm

  publish:
    name: Publish
    runs-on: ubuntu-latest
    needs:
      - build
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Checkout sources
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - run: cargo publish --token ${CRATES_TOKEN}
        env:
          CRATES_TOKEN: ${{ secrets.CRATES_TOKEN }}

  package:
    name: PackageCloud
    needs:
      - build
    if: startsWith(github.ref, 'refs/tags/')
    uses: ./.github/workflows/packagecloud.yml
    secrets: inherit

  homebrew:
    name: Bump Homebrew formula
    runs-on: macos-latest
    needs:
      - test
    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
    steps:
      - name: Open Homebrew core formula PR
        env:
          HOMEBREW_GITHUB_API_TOKEN: ${{ secrets.COMMITTER_TOKEN }}
          HOMEBREW_TAG: ${{ inputs.homebrew_tag }}
          HOMEBREW_DRY_RUN: ${{ inputs.homebrew_dry_run }}
        shell: bash
        run: |
          set -euo pipefail

          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
            TAG="${GITHUB_REF#refs/tags/}"
          else
            TAG="${HOMEBREW_TAG}"
          fi
          if [ -z "$TAG" ]; then
            echo "ERROR: homebrew_tag is required for workflow_dispatch runs"
            exit 1
          fi

          TARBALL="https://github.com/ssh-vault/ssh-vault/archive/refs/tags/${TAG}.tar.gz"
          SHA256=$(curl -fsSL "$TARBALL" | shasum -a 256 | cut -d' ' -f1)
          echo "tarball=$TARBALL sha256=$SHA256"

          git config --global user.name "github-actions[bot]"
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
          brew update
          # Do not pass --version: it writes a `version` stanza into the formula
          # that `brew audit --strict` rejects as redundant, since Homebrew
          # already parses the version from the tag in --url. See the tag in
          # $TARBALL (.../refs/tags/${TAG}.tar.gz).
          args=(
            "bump-formula-pr"
            "ssh-vault"
            "--url=$TARBALL"
            "--sha256=$SHA256"
            "--message=Update ssh-vault to ${TAG}."
            "--no-browse"
          )
          if [ "$HOMEBREW_DRY_RUN" = "true" ]; then
            args+=(--write-only --no-audit)
          fi
          brew "${args[@]}"