tidemark 0.1.3

name: Release

on:
  push:
    tags:
      - 'v[0-9]*.[0-9]*.[0-9]*'
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Dry run mode (skip actual publishing)'
        required: false
        default: true
        type: boolean
      skip_crates_io:
        description: 'Skip publishing to crates.io (if already published)'
        required: false
        default: false
        type: boolean
      skip_pypi:
        description: 'Skip publishing to PyPI (if already published)'
        required: false
        default: false
        type: boolean

permissions:
  contents: write

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:
  test:
    name: Run tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable

      - uses: taiki-e/install-action@nextest

      - name: Verify Cargo.lock is up to date
        run: cargo check --locked

      - name: Run tests
        run: make test

  build:
    name: Build ${{ matrix.target }}
    needs: test
    timeout-minutes: 30
    # Guard: self-hosted runners only execute on trusted events (tag push,
    # workflow_dispatch). Fork PRs must never dispatch jobs to self-hosted.
    if: github.event_name != 'pull_request'
    strategy:
      # Run every target to completion so a single platform failure surfaces
      # all per-platform issues in one run instead of one tag at a time. The
      # release job still requires the whole build job to succeed.
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: [self-hosted, Linux, ARM64]
            target: aarch64-unknown-linux-gnu
          - os: windows-latest
            target: x86_64-pc-windows-msvc
          - os: macos-15-intel
            target: x86_64-apple-darwin
          - os: macos-15
            target: aarch64-apple-darwin
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
        with:
          # Preserve target/ between runs on self-hosted runners for cargo
          # incremental rebuild. GitHub-hosted runners start clean each job
          # regardless of this setting, so this only affects self-hosted.
          clean: false

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Prepare cargo cache dirs (arm64 linux)
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: mkdir -p "${RUNNER_TOOL_CACHE}/cargo-cache/registry" "${RUNNER_TOOL_CACHE}/cargo-cache/git"

      - name: Clean stale dist
        # Keep dist/ fresh each run so previous builds cannot leak artifacts
        # into the upload. Self-hosted runners do not clean automatically.
        # On the arm64 linux runner, maturin-action runs as root inside the
        # manylinux container and leaves root-owned files in dist/; clean
        # via docker so the unprivileged runner user can proceed.
        shell: bash
        run: |
          if [[ "${{ matrix.target }}" == "aarch64-unknown-linux-gnu" ]]; then
            docker run --rm -v "${GITHUB_WORKSPACE}:/io" alpine rm -rf /io/dist /io/target/wheels
          else
            rm -rf dist target/wheels
          fi

      - name: Install cross-compilation tools
        # Only needed on GitHub-hosted linux where the arm64 toolchain must
        # be cross-installed. The self-hosted arm64 runner is native.
        if: matrix.target == 'aarch64-unknown-linux-gnu' && runner.arch != 'ARM64'
        run: sudo apt-get update && sudo apt-get install -y gcc-aarch64-linux-gnu

      - name: Install uv
        if: matrix.target != 'aarch64-unknown-linux-gnu'
        uses: astral-sh/setup-uv@v6

      - name: Install maturin and zig
        # maturin-action provides its own maturin inside the manylinux
        # container for the arm64 linux build, so skip the host install
        # on the self-hosted runner.
        if: matrix.target != 'aarch64-unknown-linux-gnu'
        shell: bash
        run: |
          uv venv "${RUNNER_TEMP}/build-venv"
          # Pass the venv directory (not an interpreter path) so uv resolves
          # bin/python on Unix and Scripts/python.exe on Windows itself.
          uv pip install --python "${RUNNER_TEMP}/build-venv" maturin ziglang
          VENV_BIN="${RUNNER_TEMP}/build-venv/bin"
          [ -d "$VENV_BIN" ] || VENV_BIN="${RUNNER_TEMP}/build-venv/Scripts"
          echo "$VENV_BIN" >> "$GITHUB_PATH"

      - name: Build wheel (arm64 linux via maturin-action)
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        uses: PyO3/maturin-action@v1
        with:
          target: aarch64-unknown-linux-gnu
          args: --release --out dist
          manylinux: manylinux_2_28
          # Mount persistent cargo cache into the manylinux container so
          # dependency downloads survive between jobs on the self-hosted
          # runner.
          docker-options: -v ${{ runner.tool_cache }}/cargo-cache/registry:/root/.cargo/registry -v ${{ runner.tool_cache }}/cargo-cache/git:/root/.cargo/git

      - name: Build wheel
        if: matrix.target != 'aarch64-unknown-linux-gnu'
        shell: bash
        run: |
          case "${{ matrix.target }}" in
            *-gnu)
              maturin build --release --target ${{ matrix.target }} --compatibility manylinux_2_28 --zig --out dist
              ;;
            *)
              maturin build --release --target ${{ matrix.target }} --out dist
              ;;
          esac

      - name: Build binary (arm64 linux via cargo-zigbuild)
        # On the Pi runner build natively with cargo-zigbuild targeting
        # glibc 2.28 for wide distro compatibility. Use a separate target
        # directory so host cargo does not conflict with root-owned files
        # left behind by the maturin-action container build in target/.
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        env:
          CARGO_TARGET_DIR: target-host
        run: cargo zigbuild --release --target aarch64-unknown-linux-gnu.2.28

      - name: Build binary
        if: matrix.target != 'aarch64-unknown-linux-gnu'
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
        run: cargo build --release --target ${{ matrix.target }}

      - name: Verify binary
        if: ${{ !contains(matrix.target, 'aarch64-unknown-linux') }}
        shell: bash
        run: |
          if [[ "${{ runner.os }}" == "Windows" ]]; then
            ./target/${{ matrix.target }}/release/tidemark.exe --version
          else
            ./target/${{ matrix.target }}/release/tidemark --version
          fi

      - name: Create release archive
        shell: bash
        run: |
          VERSION=${GITHUB_REF#refs/tags/}
          ARCHIVE_NAME="tidemark-${VERSION}-${{ matrix.target }}"

          mkdir -p release-package

          if [[ "${{ runner.os }}" == "Windows" ]]; then
            cp "target/${{ matrix.target }}/release/tidemark.exe" release-package/tidemark.exe
            cd release-package
            powershell -command "Compress-Archive -Path tidemark.exe -DestinationPath ../${ARCHIVE_NAME}.zip"
            cd ..
            powershell -command "Get-FileHash -Path '${ARCHIVE_NAME}.zip' -Algorithm SHA256 | Select-Object -ExpandProperty Hash" > "${ARCHIVE_NAME}.zip.sha256"
          else
            if [[ "${{ matrix.target }}" == "aarch64-unknown-linux-gnu" ]]; then
              BIN_PATH="target-host/aarch64-unknown-linux-gnu/release/tidemark"
            else
              BIN_PATH="target/${{ matrix.target }}/release/tidemark"
            fi
            cp "$BIN_PATH" release-package/tidemark
            tar -czf "${ARCHIVE_NAME}.tar.gz" -C release-package tidemark

            if [[ "${{ runner.os }}" == "macOS" ]]; then
              shasum -a 256 "${ARCHIVE_NAME}.tar.gz" > "${ARCHIVE_NAME}.tar.gz.sha256"
            else
              sha256sum "${ARCHIVE_NAME}.tar.gz" > "${ARCHIVE_NAME}.tar.gz.sha256"
            fi
          fi

          rm -rf release-package

      - name: Upload wheel
        uses: actions/upload-artifact@v4
        with:
          path: dist/*.whl
          name: wheel-${{ matrix.target }}

      - name: Upload release archives
        uses: actions/upload-artifact@v4
        with:
          path: |
            tidemark-*-${{ matrix.target }}.tar.gz*
            tidemark-*-${{ matrix.target }}.zip*
          name: release-${{ matrix.target }}

  sdist:
    name: Build source distribution
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4

      - uses: astral-sh/setup-uv@v6

      - name: Install maturin
        shell: bash
        run: |
          uv venv "${RUNNER_TEMP}/build-venv"
          uv pip install --python "${RUNNER_TEMP}/build-venv/bin/python" maturin
          echo "${RUNNER_TEMP}/build-venv/bin" >> "$GITHUB_PATH"

      - name: Build sdist
        run: maturin sdist

      - uses: actions/upload-artifact@v4
        with:
          path: target/wheels/*.tar.gz
          name: sdist

  release:
    runs-on: ubuntu-latest
    needs: [build, sdist]
    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable

      - name: Install uv
        uses: astral-sh/setup-uv@v5
        with:
          enable-cache: false

      - name: Publish to crates.io
        if: ${{ inputs.dry_run != true && inputs.skip_crates_io != true }}
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: cargo publish --locked

      - name: Test crates.io publish (dry run)
        if: ${{ inputs.dry_run == true && inputs.skip_crates_io != true }}
        run: |
          echo "DRY RUN: Would publish to crates.io"
          cargo publish --dry-run --locked

      - name: Skip crates.io publishing
        if: ${{ inputs.skip_crates_io == true }}
        run: echo "Skipping crates.io publishing as requested"

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Publish to PyPI
        if: ${{ inputs.dry_run != true && inputs.skip_pypi != true }}
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
        run: |
          uv tool run twine upload artifacts/wheel-*/*.whl artifacts/sdist/*.tar.gz

      - name: Test PyPI upload (dry run)
        if: ${{ inputs.dry_run == true && inputs.skip_pypi != true }}
        run: |
          echo "DRY RUN: Would upload to PyPI:"
          find artifacts/wheel-* -name "*.whl" -type f | sort
          find artifacts/sdist -name "*.tar.gz" -type f | sort
          uv tool run twine check artifacts/wheel-*/*.whl artifacts/sdist/*.tar.gz

      - name: Skip PyPI publishing
        if: ${{ inputs.skip_pypi == true }}
        run: echo "Skipping PyPI publishing as requested"

      - name: Create Release
        if: ${{ inputs.dry_run != true }}
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: |
            artifacts/release-*/tidemark-*.tar.gz
            artifacts/release-*/tidemark-*.tar.gz.sha256
            artifacts/release-*/tidemark-*.zip
            artifacts/release-*/tidemark-*.zip.sha256

      - name: Dry Run Summary
        if: ${{ inputs.dry_run == true }}
        run: |
          echo "Dry run complete. Artifacts built but nothing published."
          echo "Archives:"
          find artifacts/release-* -type f | sort

  update-homebrew:
    needs: release
    if: ${{ !inputs.dry_run }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: /tmp/artifacts

      - name: Compute SHA256 hashes
        id: hashes
        run: |
          for target in x86_64-apple-darwin aarch64-apple-darwin x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu; do
            sha=$(cat /tmp/artifacts/release-${target}/tidemark-${{ github.ref_name }}-${target}.tar.gz.sha256 | awk '{print $1}')
            key=$(echo "${target}" | tr '-' '_')
            echo "${key}=${sha}" >> "$GITHUB_OUTPUT"
          done

      - name: Update Homebrew formula
        env:
          HOMEBREW_TAP_DEPLOY_KEY: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
        run: |
          VERSION="${{ github.ref_name }}"
          VERSION_NUM="${VERSION#v}"

          cat > /tmp/tidemark.rb << 'FORMULA'
          class Tidemark < Formula
            desc "Snapshot a directory tree and diff what changed - no git required"
            homepage "https://github.com/rvben/tidemark"
            version "VERSION_NUM"
            license "MIT"

            on_macos do
              if Hardware::CPU.arm?
                url "https://github.com/rvben/tidemark/releases/download/VERSION/tidemark-VERSION-aarch64-apple-darwin.tar.gz"
                sha256 "SHA_AARCH64_APPLE_DARWIN"
              else
                url "https://github.com/rvben/tidemark/releases/download/VERSION/tidemark-VERSION-x86_64-apple-darwin.tar.gz"
                sha256 "SHA_X86_64_APPLE_DARWIN"
              end
            end

            on_linux do
              if Hardware::CPU.arm?
                url "https://github.com/rvben/tidemark/releases/download/VERSION/tidemark-VERSION-aarch64-unknown-linux-gnu.tar.gz"
                sha256 "SHA_AARCH64_UNKNOWN_LINUX_GNU"
              else
                url "https://github.com/rvben/tidemark/releases/download/VERSION/tidemark-VERSION-x86_64-unknown-linux-gnu.tar.gz"
                sha256 "SHA_X86_64_UNKNOWN_LINUX_GNU"
              end
            end

            def install
              bin.install "tidemark"
            end

            test do
              system "#{bin}/tidemark", "--version"
            end
          end
          FORMULA

          sed -i "s/VERSION_NUM/${VERSION_NUM}/g" /tmp/tidemark.rb
          sed -i "s/VERSION/${VERSION}/g" /tmp/tidemark.rb
          sed -i "s/SHA_AARCH64_APPLE_DARWIN/${{ steps.hashes.outputs.aarch64_apple_darwin }}/g" /tmp/tidemark.rb
          sed -i "s/SHA_X86_64_APPLE_DARWIN/${{ steps.hashes.outputs.x86_64_apple_darwin }}/g" /tmp/tidemark.rb
          sed -i "s/SHA_AARCH64_UNKNOWN_LINUX_GNU/${{ steps.hashes.outputs.aarch64_unknown_linux_gnu }}/g" /tmp/tidemark.rb
          sed -i "s/SHA_X86_64_UNKNOWN_LINUX_GNU/${{ steps.hashes.outputs.x86_64_unknown_linux_gnu }}/g" /tmp/tidemark.rb

          # Authenticate to the tap with a write deploy key scoped to
          # rvben/homebrew-tap. The key does not expire, so cross-repo pushes
          # keep working without periodic token rotation.
          mkdir -p ~/.ssh
          echo "$HOMEBREW_TAP_DEPLOY_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -t ed25519 github.com >> ~/.ssh/known_hosts 2>/dev/null

          git clone git@github.com:rvben/homebrew-tap.git /tmp/tap
          mkdir -p /tmp/tap/Formula
          cp /tmp/tidemark.rb /tmp/tap/Formula/tidemark.rb
          cd /tmp/tap
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Formula/tidemark.rb
          git diff --cached --quiet || git commit -m "Update tidemark to ${VERSION}"
          git push