release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

# smoelius: Please keep keys ordered as follows when defining jobs:
#
# - name
# - needs (optional)
# - environment (optional)
# - outputs (optional)
# - permissions
# - strategy (optional)
# - runs-on
# - steps
#
# Note that, ignoring `needs` and `strategy`, the keys are in alphabetical order.
# - `needs` is an exception because it expresses dependencies between jobs.
# - `strategy` is an exception because `runs-on` often relies on `strategy.matrix`.

jobs:
  create-release-notes:
    name: Create release notes
    outputs:
      version: ${{ steps.get-version.outputs.version }}
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Get version
        id: get-version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Lint CHANGELOG.md
        run: ./scripts/lint_changelog.sh

      - name: Create release notes
        run: git log -p -1 CHANGELOG.md | grep '^+\($\|[^+]\)' | cut -c 2- | tee body.md

      - name: Output summary
        run: |
          if [[ '${{ github.event_name }}' = 'workflow_dispatch' ]]; then
            echo '> [!NOTE]' >> "$GITHUB_STEP_SUMMARY"
            echo 'Dry run'   >> "$GITHUB_STEP_SUMMARY"
            echo             >> "$GITHUB_STEP_SUMMARY"
          fi
          cat body.md >> "$GITHUB_STEP_SUMMARY"

      - name: Check release notes
        if: ${{ github.event_name != 'workflow_dispatch' }}
        run: grep -Fx '## ${{ steps.get-version.outputs.version }}' body.md

      - name: Upload release notes
        uses: actions/upload-artifact@v7
        with:
          name: release-notes
          path: body.md
          if-no-files-found: error

  build-binaries:
    name: Build binaries (${{ matrix.target }})
    needs: create-release-notes
    permissions:
      contents: read
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
          - os: macos-latest
            target: aarch64-apple-darwin
          - os: windows-latest
            target: x86_64-pc-windows-msvc
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7

      - name: Build binaries
        run: cargo build --locked --release --target ${{ matrix.target }} -p cargo-dylint -p dylint-link --features=dylint/__driver_from_crates_io

      - name: Package binaries
        shell: bash
        run: |
          set -u

          VERSION="${GITHUB_REF_NAME#v}"
          BINARIES="cargo-dylint dylint-link"

          for BINARY in $BINARIES; do
            PACKAGE_NAME="${BINARY}-${{ matrix.target }}-v${VERSION}"
            mkdir -p "${PACKAGE_NAME}"
            cp "target/${{ matrix.target }}/release/${BINARY}" "${PACKAGE_NAME}/"

            ARCHIVE="${PACKAGE_NAME}.tar.gz"
            tar -czf "${ARCHIVE}" "${PACKAGE_NAME}"
            openssl dgst -sha256 "${ARCHIVE}" > "${ARCHIVE}.sha256"
          done

      - name: Upload binary artifacts
        uses: actions/upload-artifact@v7
        with:
          name: binaries-${{ matrix.target }}
          path: |
            cargo-dylint-${{ matrix.target }}-v*.tar.gz
            cargo-dylint-${{ matrix.target }}-v*.tar.gz.sha256
            dylint-link-${{ matrix.target }}-v*.tar.gz
            dylint-link-${{ matrix.target }}-v*.tar.gz.sha256
          if-no-files-found: error

  publish:
    name: Publish
    needs: build-binaries
    environment:
      name: release
      deployment: ${{ github.event_name != 'workflow_dispatch' }}
    permissions:
      actions: read
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Download binary artifacts
        uses: actions/download-artifact@v8
        with:
          path: dist
          merge-multiple: true

      - uses: taiki-e/install-action@v2.90.1
        with:
          tool: rsign2
          fallback: cargo-install

      - name: Sign binary artifacts
        shell: bash
        run: |
          set -u

          MANIFESTS="cargo-dylint/Cargo.toml dylint-link/Cargo.toml"
          trap 'rm -f minisign.key minisign.pub' EXIT

          rsign generate -f -W -p minisign.pub -s minisign.key
          echo "::add-mask::$(tail -n 1 minisign.key)"

          PUBLIC_KEY="$(tail -n 1 minisign.pub)"

          for MANIFEST in $MANIFESTS; do
            printf '\n[package.metadata.binstall.signing]\n' >> "${MANIFEST}"
            printf 'algorithm = "minisign"\n' >> "${MANIFEST}"
            printf 'pubkey = "%s"\n' "${PUBLIC_KEY}" >> "${MANIFEST}"
          done

          for ARCHIVE in dist/*.tar.gz; do
            rsign sign -W -s minisign.key -x "${ARCHIVE}.sig" "${ARCHIVE}"
          done

      - uses: rust-lang/crates-io-auth-action@v1
        id: auth

      - name: Publish
        run: |
          set -u

          # smoelius: Publishing in this order ensures that all dependencies are met.
          DIRS='internal driver dylint-link dylint cargo-dylint utils/linting utils/testing'
          for DIR in $DIRS; do
            pushd "$DIR"
            if [[ '${{ github.event_name }}' = 'workflow_dispatch' ]]; then
                cargo publish --allow-dirty --dry-run
            else
                cargo publish --allow-dirty || true
            fi
            popd
          done
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

      - name: Test crates.io driver
        run: cargo test -p dylint --features=__driver_from_crates_io driver_from_crates_io -- --ignored --nocapture

      - name: Upload release artifacts
        uses: actions/upload-artifact@v7
        with:
          name: release-artifacts
          path: |
            dist/*.tar.gz
            dist/*.sha256
            dist/*.sig
          if-no-files-found: error

  release:
    name: Release
    needs: [create-release-notes, publish]
    permissions:
      actions: read
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Download release notes
        uses: actions/download-artifact@v8
        with:
          name: release-notes

      - name: Download release artifacts
        uses: actions/download-artifact@v8
        with:
          name: release-artifacts
          path: dist

      - name: Create release
        if: ${{ github.event_name != 'workflow_dispatch' }}
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ github.ref }}
          name: Release ${{ needs.create-release-notes.outputs.version }}
          body_path: body.md
          files: |
            dist/*.tar.gz
            dist/*.sha256
            dist/*.sig
          draft: false
          prerelease: ${{ contains(github.ref, 'pre') || contains(github.ref, 'rc') }}