vantadb 0.1.4

name: Release VantaDB

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0

permissions:
  contents: write
  packages: write
  id-token: write
  attestations: write

jobs:
  gate:
    name: Pre-release validation
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          cache-bin: "false"

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libclang-dev clang librocksdb-dev

      - name: Validate version coherence
        run: cargo test --test version_coherence --all-features

  build-and-deploy:
    name: Build release binaries (${{ matrix.os }})
    needs: gate
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]

    steps:
      - name: Free Disk Space (Ubuntu)
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /usr/local/lib/android
          sudo rm -rf /opt/ghc
          sudo rm -rf /opt/hostedtoolcache/CodeQL

      - name: Checkout Code
        uses: actions/checkout@v6

      - name: Setup Rust Toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Cache Dependencies
        uses: Swatinem/rust-cache@v2
        with:
          cache-bin: "false"

      - name: Build Release Binaries
        run: cargo build --release -p vantadb -p vantadb-server -p vantadb-mcp

      - name: Rename and Hash (Unix)
        if: matrix.os != 'windows-latest'
        shell: bash
        run: |
          SUFFIX=""
          if [ "${{ matrix.os }}" = "macos-latest" ]; then
            SUFFIX="macos-amd64"
          else
            SUFFIX="linux-amd64"
          fi
          
          # Rename
          mv target/release/vanta-cli target/release/vanta-cli-$SUFFIX
          mv target/release/vantadb-server target/release/vantadb-server-$SUFFIX
          mv target/release/vantadb-mcp target/release/vantadb-mcp-$SUFFIX
          
          # Hash
          cd target/release
          if command -v sha256sum >/dev/null 2>&1; then
            sha256sum vanta-cli-$SUFFIX > vanta-cli-$SUFFIX.sha256
            sha256sum vantadb-server-$SUFFIX > vantadb-server-$SUFFIX.sha256
            sha256sum vantadb-mcp-$SUFFIX > vantadb-mcp-$SUFFIX.sha256
          else
            shasum -a 256 vanta-cli-$SUFFIX > vanta-cli-$SUFFIX.sha256
            shasum -a 256 vantadb-server-$SUFFIX > vantadb-server-$SUFFIX.sha256
            shasum -a 256 vantadb-mcp-$SUFFIX > vantadb-mcp-$SUFFIX.sha256
          fi

      - name: Rename and Hash (Windows)
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: |
          Rename-Item -Path "target\release\vanta-cli.exe" -NewName "vanta-cli-windows-amd64.exe"
          Rename-Item -Path "target\release\vantadb-server.exe" -NewName "vantadb-server-windows-amd64.exe"
          Rename-Item -Path "target\release\vantadb-mcp.exe" -NewName "vantadb-mcp-windows-amd64.exe"
          
          $hash_cli = (Get-FileHash -Algorithm SHA256 "target\release\vanta-cli-windows-amd64.exe").Hash.ToLower()
          Set-Content -Path "target\release\vanta-cli-windows-amd64.exe.sha256" -NoNewline -Value "$hash_cli  vanta-cli-windows-amd64.exe"
          
          $hash_server = (Get-FileHash -Algorithm SHA256 "target\release\vantadb-server-windows-amd64.exe").Hash.ToLower()
          Set-Content -Path "target\release\vantadb-server-windows-amd64.exe.sha256" -NoNewline -Value "$hash_server  vantadb-server-windows-amd64.exe"
          
          $hash_mcp = (Get-FileHash -Algorithm SHA256 "target\release\vantadb-mcp-windows-amd64.exe").Hash.ToLower()
          Set-Content -Path "target\release\vantadb-mcp-windows-amd64.exe.sha256" -NoNewline -Value "$hash_mcp  vantadb-mcp-windows-amd64.exe"

      - name: Attest Build Provenance
        uses: actions/attest-build-provenance@v4
        if: startsWith(github.ref, 'refs/tags/')
        with:
          subject-path: |
            target/release/vanta-*
            target/release/vantadb-mcp-*

      - name: Release
        uses: softprops/action-gh-release@v3
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: |
            target/release/vanta-cli-*
            target/release/vantadb-server-*
            target/release/vantadb-mcp-*
          draft: true
          generate_release_notes: true