release.yml

name: release

# Tag-driven, multi-channel release for the runx CLI.
#
# The git tag (cli-vX.Y.Z) is the single source of truth. Every job stamps that
# version into the manifests with scripts/set-release-version.ts before building
# or publishing, so the source tree never carries per-release version edits and
# `runx --version` (CARGO_PKG_VERSION) is truthful on every channel.
#
# The GitHub Release is the hub: it serves the raw per-target archives that
# Homebrew, Scoop, winget, AUR, Docker and direct downloads all consume by URL +
# sha256. npm and crates.io publish the same version. Per-registry publish jobs
# are gated on their credentials and skipped (with a warning) when unset.
#
# Pushing a cli-v* tag runs a real release. workflow_dispatch runs a dry-run
# (build + render, no publish).

on:
  push:
    tags:
      - "cli-v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Version to dry-run (X.Y.Z)"
        type: string
        required: true

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  prepare:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    outputs:
      version: ${{ steps.resolve.outputs.version }}
      publish: ${{ steps.resolve.outputs.publish }}
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v5
        with:
          version: 10.18.2
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - name: Resolve version
        id: resolve
        run: |
          if [ "${{ github.event_name }}" = "push" ]; then
            version="${GITHUB_REF_NAME#cli-v}"
            echo "publish=true" >> "$GITHUB_OUTPUT"
          else
            version="${{ github.event.inputs.version }}"
            echo "publish=false" >> "$GITHUB_OUTPUT"
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "resolved version=$version publish from tag=${{ github.event_name == 'push' }}"
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Stamp + verify manifests match the tag
        run: |
          pnpm exec tsx scripts/set-release-version.ts "${{ steps.resolve.outputs.version }}"
          pnpm exec tsx scripts/set-release-version.ts --check "${{ steps.resolve.outputs.version }}"
      - name: Fast verify
        run: pnpm verify:fast

  build:
    needs: prepare
    strategy:
      fail-fast: true
      matrix:
        include:
          - platform: darwin-arm64
            runner: macos-14
            target: aarch64-apple-darwin
            binary: runx
          - platform: darwin-x64
            runner: macos-15
            target: x86_64-apple-darwin
            binary: runx
          - platform: linux-x64
            runner: ubuntu-24.04
            target: x86_64-unknown-linux-musl
            binary: runx
          - platform: linux-arm64
            runner: ubuntu-24.04-arm
            target: aarch64-unknown-linux-musl
            binary: runx
          - platform: win32-x64
            runner: windows-latest
            target: x86_64-pc-windows-msvc
            binary: runx.exe
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v5
        with:
          version: 10.18.2
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Set up pinned toolchain (rust-toolchain.toml) + target
        working-directory: crates
        shell: bash
        run: |
          rustup show               # installs the version pinned by rust-toolchain.toml
          rustup target add ${{ matrix.target }}
      - name: Install musl toolchain
        if: contains(matrix.target, 'musl')
        run: sudo apt-get update && sudo apt-get install -y musl-tools
      - name: Stamp version from tag
        shell: bash
        run: pnpm exec tsx scripts/set-release-version.ts "${{ needs.prepare.outputs.version }}"
      - name: Build release binary
        working-directory: crates
        run: cargo build --release --locked --target ${{ matrix.target }} -p runx-cli
      - name: Stage signature manifest (npm)
        shell: bash
        run: |
          pnpm exec tsx scripts/make-signature-manifest.ts \
            --binary "crates/target/${{ matrix.target }}/release/${{ matrix.binary }}" \
            --platform "${{ matrix.platform }}" \
            --out "signatures-${{ matrix.platform }}.json" \
            --identity "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
      - name: Package npm artifacts (selector + native)
        shell: bash
        run: |
          pnpm exec tsx scripts/package-rust-cli.ts \
            --binary "crates/target/${{ matrix.target }}/release/${{ matrix.binary }}" \
            --platform "${{ matrix.platform }}" \
            --out-dir ".runx/rust-cli-artifacts" \
            --signature-manifest "signatures-${{ matrix.platform }}.json"
      - name: Build raw release archive
        shell: bash
        run: |
          pnpm exec tsx scripts/build-release-archives.ts \
            --binary "crates/target/${{ matrix.target }}/release/${{ matrix.binary }}" \
            --target "${{ matrix.target }}" \
            --version "${{ needs.prepare.outputs.version }}" \
            --out-dir "dist/archives"
      - name: Build .deb (linux only)
        if: contains(matrix.target, 'linux')
        run: |
          cargo install cargo-deb --locked
          cargo deb --no-build --target ${{ matrix.target }} -p runx-cli --output "dist/archives/"
        working-directory: crates
      - name: Upload npm artifacts
        uses: actions/upload-artifact@v4
        with:
          name: npm-${{ matrix.platform }}
          path: |
            .runx/rust-cli-artifacts/${{ matrix.platform }}/
            .runx/rust-cli-artifacts/selector/
          if-no-files-found: error
          retention-days: 7
      - name: Upload release archives
        uses: actions/upload-artifact@v4
        with:
          name: archive-${{ matrix.platform }}
          path: dist/archives/
          if-no-files-found: error
          retention-days: 7

  smoke:
    needs: [prepare, build]
    strategy:
      fail-fast: true
      matrix:
        include:
          - { platform: darwin-arm64, runner: macos-14, target: aarch64-apple-darwin, ext: tar.gz, bin: runx }
          - { platform: darwin-x64, runner: macos-15, target: x86_64-apple-darwin, ext: tar.gz, bin: runx }
          - { platform: linux-x64, runner: ubuntu-24.04, target: x86_64-unknown-linux-musl, ext: tar.gz, bin: runx }
          - { platform: linux-arm64, runner: ubuntu-24.04-arm, target: aarch64-unknown-linux-musl, ext: tar.gz, bin: runx }
          - { platform: win32-x64, runner: windows-latest, target: x86_64-pc-windows-msvc, ext: zip, bin: runx.exe }
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Download built archive
        uses: actions/download-artifact@v5
        with:
          name: archive-${{ matrix.platform }}
          path: dist
      - name: Extract and run the released binary
        shell: bash
        run: |
          set -eux
          stem="runx-${{ needs.prepare.outputs.version }}-${{ matrix.target }}"
          if [ "${{ matrix.ext }}" = "zip" ]; then
            # GitHub windows-latest ships 7-Zip (the same tool that produced
            # the archive); the runner's bsdtar does not autodetect zip.
            7z x -y "dist/${stem}.zip" -o"dist" >/dev/null
          else
            tar -xzf "dist/${stem}.tar.gz" -C dist
          fi
          out=$("dist/${stem}/${{ matrix.bin }}" --version)
          echo "got: $out"
          case "$out" in
            *"${{ needs.prepare.outputs.version }}"*) echo "smoke ok" ;;
            *) echo "::error::version mismatch: $out"; exit 1 ;;
          esac

  github-release:
    needs: [prepare, build, smoke]
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      id-token: write # build provenance attestation
      attestations: write
    steps:
      - uses: actions/checkout@v6
      - name: Download archives
        uses: actions/download-artifact@v5
        with:
          pattern: archive-*
          merge-multiple: true
          path: dist/archives
      - name: Build consolidated checksums
        run: |
          cd dist/archives
          sha256sum runx-* > checksums.txt
          cat checksums.txt
      - name: Generate SBOM (CycloneDX)
        uses: anchore/sbom-action@v0
        with:
          path: crates
          format: cyclonedx-json
          output-file: dist/archives/runx-${{ needs.prepare.outputs.version }}-sbom.cdx.json
      - name: Attest build provenance for released binaries
        if: needs.prepare.outputs.publish == 'true'
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: "dist/archives/runx-*.tar.gz, dist/archives/runx-*.zip"
      - name: Stage install scripts
        run: cp scripts/install scripts/install.ps1 dist/archives/
      - name: Create / update GitHub release
        if: needs.prepare.outputs.publish == 'true'
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ github.ref_name }}
          generate_release_notes: true
          files: |
            dist/archives/*

  publish-npm:
    needs: [prepare, github-release]
    if: needs.prepare.outputs.publish == 'true'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write # npm provenance
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v5
        with:
          version: 10.18.2
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
          registry-url: https://registry.npmjs.org
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download npm artifacts
        uses: actions/download-artifact@v5
        with:
          pattern: npm-*
          merge-multiple: true
          path: .runx/rust-cli-artifacts
      - name: Restore executable bits on native binaries
        # actions/upload-artifact stores via a zip-on-the-wire path that does
        # not preserve POSIX exec bits; re-apply them before verify.
        run: |
          find .runx/rust-cli-artifacts -path '*/bin/runx' -type f -print0 \
            | xargs -0 -r chmod +x
          find .runx/rust-cli-artifacts -path '*/bin/runx.exe' -type f -print0 \
            | xargs -0 -r chmod +x
      - name: Verify release artifacts
        run: |
          pnpm exec tsx scripts/check-rust-cli-release-artifacts.ts \
            --artifact-dir ".runx/rust-cli-artifacts" --no-js-delegation --verify-signatures
      - name: Publish packages
        working-directory: .runx/rust-cli-artifacts
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: "true"
        run: |
          for dir in */; do
            name=$(node -p "require('./${dir}package.json').name")
            version=$(node -p "require('./${dir}package.json').version")
            if npm view "${name}@${version}" version >/dev/null 2>&1; then
              echo "${name}@${version} already published; skipping"
              continue
            fi
            ( cd "$dir" && npm publish --access public --tag latest )
          done

  publish-crates:
    needs: [prepare, github-release]
    if: needs.prepare.outputs.publish == 'true'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Check crates.io credentials
        id: gate
        run: |
          if [ -n "${{ secrets.CARGO_REGISTRY_TOKEN }}" ]; then
            echo "publish=true" >> "$GITHUB_OUTPUT"
          else
            echo "publish=false" >> "$GITHUB_OUTPUT"
            echo "::warning::Skipping crates.io publish because CARGO_REGISTRY_TOKEN is not configured."
          fi
      - uses: actions/checkout@v6
        if: steps.gate.outputs.publish == 'true'
      - uses: pnpm/action-setup@v5
        if: steps.gate.outputs.publish == 'true'
        with:
          version: 10.18.2
      - uses: actions/setup-node@v6
        if: steps.gate.outputs.publish == 'true'
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - uses: dtolnay/rust-toolchain@stable
        if: steps.gate.outputs.publish == 'true'
      - name: Install dependencies
        if: steps.gate.outputs.publish == 'true'
        run: pnpm install --frozen-lockfile
      - name: Stamp version from tag
        if: steps.gate.outputs.publish == 'true'
        run: pnpm exec tsx scripts/set-release-version.ts "${{ needs.prepare.outputs.version }}"
      - name: Publish crates in dependency order
        if: steps.gate.outputs.publish == 'true'
        working-directory: crates
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          # Dependency crates carry their own versions and only publish when bumped;
          # `cargo publish` is a no-op-with-error if the version already exists, so
          # tolerate that and continue. runx-cli publishes last.
          for crate in runx-receipts runx-core runx-parser runx-contracts runx-runtime runx-sdk runx-cli; do
            echo "::group::publish $crate"
            cargo publish -p "$crate" --allow-dirty || \
              echo "::warning::$crate publish skipped (already published or blocked)"
            echo "::endgroup::"
          done

  package-managers:
    needs: [prepare, github-release]
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v5
        with:
          version: 10.18.2
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download archives (for checksums)
        uses: actions/download-artifact@v5
        with:
          pattern: archive-*
          merge-multiple: true
          path: dist/archives
      - name: Build channel manifest input
        run: |
          node scripts/build-channel-input.mjs \
            --version "${{ needs.prepare.outputs.version }}" \
            --repo "${GITHUB_REPOSITORY}" \
            --tag "cli-v${{ needs.prepare.outputs.version }}" \
            --archives dist/archives \
            --out dist/channel-input.json
      - name: Render channel manifests
        run: pnpm exec tsx scripts/gen-channel-manifests.ts --input dist/channel-input.json --out-dir dist/channels
      - name: Attach rendered manifests to release
        if: needs.prepare.outputs.publish == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          tar -C dist -czf dist/channel-manifests.tar.gz channels
          gh release upload "${{ github.ref_name }}" dist/channel-manifests.tar.gz --clobber
      - name: Upload rendered manifests
        uses: actions/upload-artifact@v4
        with:
          name: channel-manifests
          path: dist/channels

  publish-homebrew:
    needs: [prepare, package-managers]
    if: needs.prepare.outputs.publish == 'true'
    runs-on: ubuntu-24.04
    steps:
      - name: Check Homebrew tap credentials
        id: gate
        run: |
          if [ -n "${{ secrets.HOMEBREW_TAP_TOKEN }}" ]; then
            echo "publish=true" >> "$GITHUB_OUTPUT"
          else
            echo "publish=false" >> "$GITHUB_OUTPUT"
            echo "::warning::Skipping Homebrew publish because HOMEBREW_TAP_TOKEN is not configured."
          fi
      - name: Download rendered manifests
        if: steps.gate.outputs.publish == 'true'
        uses: actions/download-artifact@v5
        with:
          name: channel-manifests
          path: channels
      - name: Check out tap
        if: steps.gate.outputs.publish == 'true'
        uses: actions/checkout@v6
        with:
          repository: runxhq/homebrew-tap
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: tap
      - name: Commit formula
        if: steps.gate.outputs.publish == 'true'
        run: |
          mkdir -p tap/Formula
          cp channels/homebrew/runx.rb tap/Formula/runx.rb
          git -C tap config user.name "github-actions[bot]"
          git -C tap config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git -C tap add Formula/runx.rb
          git -C tap diff --cached --quiet || { git -C tap commit -m "runx ${{ needs.prepare.outputs.version }}"; git -C tap push; }

  publish-scoop:
    needs: [prepare, package-managers]
    if: needs.prepare.outputs.publish == 'true'
    runs-on: ubuntu-24.04
    steps:
      - name: Check Scoop bucket credentials
        id: gate
        run: |
          if [ -n "${{ secrets.SCOOP_BUCKET_TOKEN }}" ]; then
            echo "publish=true" >> "$GITHUB_OUTPUT"
          else
            echo "publish=false" >> "$GITHUB_OUTPUT"
            echo "::warning::Skipping Scoop publish because SCOOP_BUCKET_TOKEN is not configured."
          fi
      - name: Download rendered manifests
        if: steps.gate.outputs.publish == 'true'
        uses: actions/download-artifact@v5
        with:
          name: channel-manifests
          path: channels
      - name: Check out bucket
        if: steps.gate.outputs.publish == 'true'
        uses: actions/checkout@v6
        with:
          repository: runxhq/scoop-bucket
          token: ${{ secrets.SCOOP_BUCKET_TOKEN }}
          path: bucket
      - name: Commit manifest
        if: steps.gate.outputs.publish == 'true'
        run: |
          mkdir -p bucket/bucket
          cp channels/scoop/runx.json bucket/bucket/runx.json
          git -C bucket config user.name "github-actions[bot]"
          git -C bucket config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git -C bucket add bucket/runx.json
          git -C bucket diff --cached --quiet || { git -C bucket commit -m "runx ${{ needs.prepare.outputs.version }}"; git -C bucket push; }

  publish-winget:
    needs: [prepare, package-managers]
    if: needs.prepare.outputs.publish == 'true'
    runs-on: ubuntu-24.04
    steps:
      - name: Check winget credentials
        id: gate
        run: |
          if [ -n "${{ secrets.WINGET_TOKEN }}" ]; then
            echo "publish=true" >> "$GITHUB_OUTPUT"
          else
            echo "publish=false" >> "$GITHUB_OUTPUT"
            echo "::warning::Skipping winget publish because WINGET_TOKEN is not configured."
          fi
      - name: Submit to winget-pkgs
        if: steps.gate.outputs.publish == 'true'
        uses: michidk/winget-updater@latest
        with:
          token: ${{ secrets.WINGET_TOKEN }}
          identifier: runxhq.runx
          version: ${{ needs.prepare.outputs.version }}
          url: "https://github.com/${{ github.repository }}/releases/download/cli-v${{ needs.prepare.outputs.version }}/runx-${{ needs.prepare.outputs.version }}-x86_64-pc-windows-msvc.zip"

  publish-aur:
    needs: [prepare, package-managers]
    if: needs.prepare.outputs.publish == 'true'
    runs-on: ubuntu-24.04
    steps:
      - name: Check AUR credentials
        id: gate
        run: |
          if [ -n "${{ secrets.AUR_SSH_PRIVATE_KEY }}" ]; then
            echo "publish=true" >> "$GITHUB_OUTPUT"
          else
            echo "publish=false" >> "$GITHUB_OUTPUT"
            echo "::warning::Skipping AUR publish because AUR_SSH_PRIVATE_KEY is not configured."
          fi
      - name: Download rendered manifests
        if: steps.gate.outputs.publish == 'true'
        uses: actions/download-artifact@v5
        with:
          name: channel-manifests
          path: channels
      - name: Publish to AUR
        if: steps.gate.outputs.publish == 'true'
        uses: KSXGitHub/github-actions-deploy-aur@v3
        with:
          pkgname: runx-bin
          pkgbuild: channels/aur/PKGBUILD
          commit_username: github-actions[bot]
          commit_email: 41898282+github-actions[bot]@users.noreply.github.com
          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
          commit_message: "runx ${{ needs.prepare.outputs.version }}"

  publish-docker:
    needs: [prepare, github-release]
    if: needs.prepare.outputs.publish == 'true'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6
      - uses: docker/setup-buildx-action@v3
      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: packaging/docker/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: |
            VERSION=${{ needs.prepare.outputs.version }}
          tags: |
            ghcr.io/runxhq/runx:${{ needs.prepare.outputs.version }}
            ghcr.io/runxhq/runx:latest