vecboost 0.3.0-rc.1

name: Release

on:
  push:
    tags:
      - 'v*'

# 最小权限:顶层只读,发布 job 单独声明 contents: write
permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

jobs:
  validate:
    name: Validate Release
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          components: rustfmt, clippy

      - name: Install Protocol Buffers compiler
        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Rust Cache
        uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
        with:
          shared-key: "release-validate"
          cache-targets: false

      - name: Format Check
        run: cargo fmt --all -- --check

      - name: Clippy Lint
        run: cargo clippy --features "grpc,cli,auth,onnx,db,sqlite,openapi,mcp" --all-targets -- -D warnings

      - name: Cargo Audit
        run: cargo audit

      - name: Build Check
        run: cargo build --features "grpc,cli,auth,onnx,db,sqlite,openapi,mcp"

      - name: Run Tests
        run: cargo test --features "grpc,cli,auth,onnx,db,sqlite,openapi,mcp" --lib


  build-docker:
    name: Build Docker Image
    needs: validate
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Login to Docker Hub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_TOKEN }}

      - name: Extract metadata for Docker
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
        with:
          images: vecboost/vecboost
          tags: |
            type=semver,pattern=v{{version}}
            type=sha

      - name: Build and push Docker image
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64

  github-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0

      - name: Get Version
        id: version
        run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      # Release 只带 GitHub 自动生成的源码压缩包,不附二进制产物。
      - name: Create Release
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          name: Release v${{ steps.version.outputs.VERSION }}
          generate_release_notes: true
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  publish-crates:
    name: Publish to crates.io
    needs: [github-release]
    runs-on: ubuntu-latest
    # 冷缓存全量验证编译曾超 10m 被取消,放宽到 30m
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable

      - name: Install Protocol Buffers compiler
        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3

      - name: Rust Cache
        uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
        with:
          shared-key: "release-publish"
          cache-targets: false

      - name: Publish to crates.io
        run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }}

  notify:
    name: Notify Status
    needs: [build-docker, github-release, publish-crates]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    if: always()
    steps:
      - name: Check status
        run: |
          echo "build-docker: ${{ needs.build-docker.result }}"
          echo "github-release: ${{ needs.github-release.result }}"
          echo "publish-crates: ${{ needs.publish-crates.result }}"
          if [[ "${{ needs.github-release.result }}" == "success" ]] && \
             [[ "${{ needs.publish-crates.result }}" == "success" ]]; then
            echo "✅ Release completed successfully!"
            if [[ "${{ needs.build-docker.result }}" != "success" ]]; then
              echo "⚠️  Docker image build failed (non-blocking)"
            fi
            exit 0
          else
            echo "❌ Release failed!"
            exit 1
          fi