zc2 0.0.13

name: Auto-release

# On master push: bump patch in Cargo.toml, tag, create a GitHub
# release, build release binaries for Linux x86_64 + Apple Silicon,
# upload them to the release, and publish the crate to crates.io.

on:
  push:
    branches: [master, main]
    paths-ignore:
      - "**.md"
      - "docs/**"
      - ".github/workflows/*.yml"
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: auto-release
  cancel-in-progress: false

jobs:
  bump-and-release:
    if: "!contains(github.event.head_commit.message, '[skip release]')"
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.bump.outputs.tag }}
      new_version: ${{ steps.bump.outputs.new_version }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Bump patch version in Cargo.toml
        id: bump
        run: |
          set -euo pipefail
          CURRENT=$(grep -E '^version = ' Cargo.toml | head -1 | sed -E 's/.*"([^"]+)".*/\1/')
          IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT"
          NEW="${MAJOR}.${MINOR}.$((PATCH + 1))"
          echo "  current: $CURRENT"
          echo "  new    : $NEW"
          sed -i.bak -E "0,/^version = \".*\"/{s/^version = \".*\"/version = \"$NEW\"/}" Cargo.toml
          rm Cargo.toml.bak
          echo "new_version=$NEW" >> "$GITHUB_OUTPUT"
          echo "tag=v$NEW" >> "$GITHUB_OUTPUT"

      - name: Update Cargo.lock
        run: |
          cargo update --offline --package zc2 || cargo generate-lockfile

      - name: Commit + tag
        run: |
          set -euo pipefail
          git add Cargo.toml Cargo.lock
          git commit -m "chore(release): v${{ steps.bump.outputs.new_version }} [skip release]"
          git tag "${{ steps.bump.outputs.tag }}"
          git push origin HEAD:${{ github.ref_name }}
          git push origin "${{ steps.bump.outputs.tag }}"

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "${{ steps.bump.outputs.tag }}" \
            --title "${{ steps.bump.outputs.tag }}" \
            --generate-notes

  build-and-upload:
    needs: bump-and-release
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux x86_64 — built on Ubuntu; broadest desktop/server target.
          - runner: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            artifact: zc-linux-x86_64
            binary: zc
            cross: false
          # Linux aarch64 — cross-compiled from Ubuntu via the `cross` helper
          # (native ARM runners are GitHub-beta + slow for small jobs).
          - runner: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            artifact: zc-linux-aarch64
            binary: zc
            cross: true
          # macOS Intel — cross-built on macos-14 (Apple Silicon) via
          # `rustup target add x86_64-apple-darwin`. Avoids the queued
          # macos-13 runner pool; both targets ship in the Apple CLT so
          # the produced binary is identical to a native Intel build.
          - runner: macos-14
            target: x86_64-apple-darwin
            artifact: zc-macos-x86_64
            binary: zc
            cross: false
          # macOS Apple Silicon.
          - runner: macos-14
            target: aarch64-apple-darwin
            artifact: zc-macos-aarch64
            binary: zc
            cross: false
          # Windows x86_64 — MSVC toolchain, produces zc.exe.
          - runner: windows-latest
            target: x86_64-pc-windows-msvc
            artifact: zc-windows-x86_64.exe
            binary: zc.exe
            cross: false
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.bump-and-release.outputs.tag }}

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "stable"
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2

      - name: Install cross (linux-aarch64 only)
        if: matrix.cross
        run: cargo install cross --locked

      - name: cargo build --release (native)
        if: ${{ !matrix.cross }}
        run: cargo build --release --target ${{ matrix.target }}

      - name: cross build --release (cross-compiled)
        if: matrix.cross
        run: cross build --release --target ${{ matrix.target }}

      - name: Package binary (Unix)
        if: runner.os != 'Windows'
        run: |
          mkdir -p dist
          cp "target/${{ matrix.target }}/release/${{ matrix.binary }}" "dist/${{ matrix.artifact }}"
          chmod +x "dist/${{ matrix.artifact }}"

      - name: Package binary (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path dist | Out-Null
          Copy-Item "target/${{ matrix.target }}/release/${{ matrix.binary }}" "dist/${{ matrix.artifact }}"

      - name: Upload to release
        shell: bash  # Windows runners default to pwsh, which chokes on \ continuations.
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "${{ needs.bump-and-release.outputs.tag }}" \
            "dist/${{ matrix.artifact }}" --clobber

  publish-crate:
    needs: [bump-and-release, build-and-upload]
    runs-on: ubuntu-latest
    environment: release
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.bump-and-release.outputs.tag }}

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "stable"

      - uses: Swatinem/rust-cache@v2

      # `cargo publish --no-verify` skips the repeat full build (already
      # done by build-and-upload). On intermittent crates.io hiccups we
      # retry twice before failing the job.
      - name: cargo publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          set -euo pipefail
          if [ -z "${CARGO_REGISTRY_TOKEN:-}" ]; then
            echo "::error::CARGO_REGISTRY_TOKEN is not set. Add it to the 'release' environment (or repo secrets) to enable crates.io publishing."
            exit 1
          fi
          for attempt in 1 2 3; do
            if cargo publish --no-verify --token "$CARGO_REGISTRY_TOKEN"; then
              exit 0
            fi
            echo "publish attempt $attempt failed; retrying in 20s"
            sleep 20
          done
          exit 1