wavekat-cli 0.0.11

Command-line client for the WaveKat platform (wk)
name: Release artifacts

# Triggered by release-plz-release.yml after release-plz creates a
# *draft* release for a new tag. We build the binaries into the draft,
# upload install.sh, then promote `--draft=false` so the release goes
# live atomically — /releases/latest never points at a tag whose
# binaries are still building.
on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to build (e.g. v0.0.3). The tag must already exist."
        required: true

permissions:
  contents: write

jobs:
  build:
    name: ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            os: macos-14
          - target: x86_64-apple-darwin
            os: macos-15-intel
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.tag }}

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          key: release-${{ matrix.target }}

      - name: Build and upload
        uses: taiki-e/upload-rust-binary-action@v1
        with:
          bin: wk
          target: ${{ matrix.target }}
          archive: $bin-$tag-$target
          tar: unix
          checksum: sha256
          ref: refs/tags/${{ inputs.tag }}
          token: ${{ secrets.GITHUB_TOKEN }}

  installer:
    name: Upload install.sh
    # Intentionally not `needs: build` — install.sh has no build artefacts
    # to wait on, so it uploads in parallel with the matrix.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.tag }}
      - name: Upload install.sh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          tag="${{ inputs.tag }}"
          gh release upload "$tag" install.sh --clobber

  publish:
    name: Promote draft → published
    needs: [build, installer]
    runs-on: ubuntu-latest
    steps:
      - name: Promote release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO: ${{ github.repository }}
        run: |
          set -euo pipefail
          tag="${{ inputs.tag }}"
          # --latest pins this as the "latest" release explicitly so
          # GitHub's auto-detection doesn't pick a different non-draft
          # release in the rare case where releases land out of order.
          gh release edit "$tag" --draft=false --latest --repo "$REPO"