build.yml

name: Build Package

# Main PowerMem release (Python packages). Does not run on plugin-only tags (plugins-v*).
on:
  push:
    branches: [main, develop]
    tags:
      - 'v*'
  pull_request:
    branches: [main, develop]
  workflow_dispatch:
    inputs:
      python_version:
        description: 'Python version to build with'
        required: false
        default: '3.11'
        type: choice
        options:
          - '3.11'
          - '3.12'

env:
  GO_VERSION: '1.22.12'

jobs:
  build-dashboard:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "24"

      - name: Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10

      - name: Build Dashboard
        run: |
          cd dashboard
          pnpm install
          pnpm build

      - name: Upload dashboard dist
        uses: actions/upload-artifact@v7
        with:
          name: dashboard-dist
          path: dashboard/dist/

  build:
    runs-on: ubuntu-latest
    needs: build-dashboard
    strategy:
      matrix:
        python-version: ["3.11", "3.12"]
      fail-fast: false

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Download dashboard artifact
        uses: actions/download-artifact@v8
        with:
          name: dashboard-dist
          path: dashboard-dist

      - name: Inject Dashboard into package
        run: |
          mkdir -p src/server/dashboard
          cp -r dashboard-dist/* src/server/dashboard/

      - name: Set up uv and Python ${{ matrix.python-version }}
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
        with:
          python-version: ${{ matrix.python-version }}
          enable-cache: true

      - name: Check Python package versions
        run: |
          uv run --no-project --python "${{ matrix.python-version }}" python scripts/check_package_versions.py

      - name: Clean previous builds
        run: |
          rm -rf dist/ build/ *.egg-info/

      - name: Build package
        run: |
          uv build --python "${{ matrix.python-version }}"

      - name: Check package
        run: |
          uv run --no-project --python "${{ matrix.python-version }}" --with twine python -m twine check dist/*

      - name: Clean previous MCP wrapper builds
        run: |
          rm -rf packages/powermem-mcp/dist/ packages/powermem-mcp/build/
          rm -rf packages/powermem-mcp/*.egg-info/ packages/powermem-mcp/src/*.egg-info/

      - name: Build MCP wrapper package
        run: |
          uv build --python "${{ matrix.python-version }}" --out-dir packages/powermem-mcp/dist packages/powermem-mcp

      - name: Check MCP wrapper package
        run: |
          uv run --no-project --python "${{ matrix.python-version }}" --with twine python -m twine check packages/powermem-mcp/dist/*

      - name: List built files
        run: |
          ls -lh dist/
          ls -lh packages/powermem-mcp/dist/

      - name: Upload build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: dist-python-${{ matrix.python-version }}
          path: dist/*
          retention-days: 30

      - name: Upload MCP wrapper build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: dist-mcp-python-${{ matrix.python-version }}
          path: packages/powermem-mcp/dist/*
          retention-days: 30

  combine-artifacts:
    runs-on: ubuntu-latest
    needs: build
    if: success()

    steps:
      - name: Download package artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: dist-*
          path: dist-all

      - name: Combine distribution files
        run: |
          mkdir -p dist
          find dist-all -name "*.whl" -exec cp {} dist/ \;
          find dist-all -name "*.tar.gz" -exec cp {} dist/ \;
          echo "Combined distribution files:"
          ls -lh dist/
          echo ""
          echo "Total files:"
          ls -1 dist/ | wc -l

      - name: Upload combined artifacts
        uses: actions/upload-artifact@v7
        with:
          name: dist-packages
          path: dist/*
          retention-days: 30

  package-claude-plugin:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Set up uv and Python
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
        with:
          python-version: "3.11"
          enable-cache: true

      - name: Package Claude Code plugin
        run: bash apps/claude-code-plugin/scripts/package-plugin.sh

      - name: Upload Claude Code plugin zip
        uses: actions/upload-artifact@v7
        with:
          name: powermem-claude-code-plugin-zip
          path: apps/claude-code-plugin/dist/powermem-claude-code-plugin-*.zip
          if-no-files-found: error
          retention-days: 30

  build-linux-binaries-centos7:
    name: Build Linux amd64 binaries on CentOS 7
    runs-on: ubuntu-latest
    needs: build-dashboard
    env:
      DOCKER_BUILDKIT: 1

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Download dashboard artifact
        uses: actions/download-artifact@v8
        with:
          name: dashboard-dist
          path: dashboard-dist

      - name: Inject Dashboard into binary package source
        run: |
          mkdir -p src/server/dashboard
          cp -r dashboard-dist/* src/server/dashboard/

      - name: Docker build Linux binaries on CentOS 7
        run: |
          set -eux
          docker build \
            -t powermem-binaries-centos7 \
            -f docker/Dockerfile.binaries-centos7 \
            .

      - name: Verify Linux amd64 binary package in CentOS 7
        run: |
          set -eux
          docker run --rm \
            --entrypoint /bin/bash \
            powermem-binaries-centos7 \
            -lc '
              set -eux
              uv run --no-project --python /opt/miniconda3/envs/powermem/bin/python python scripts/smoke_binary_package.py \
                --dist /powermem/dist-binaries \
                --target-os linux \
                --target-arch amd64 \
                --require-individual-assets
            '

      - name: Copy Linux binaries out of image
        run: |
          set -eux
          mkdir -p dist-binaries
          docker run --rm \
            -v "${GITHUB_WORKSPACE}/dist-binaries:/out" \
            --entrypoint /bin/bash \
            powermem-binaries-centos7 \
            -c 'find /powermem/dist-binaries -maxdepth 1 -type f -print -exec cp -av {} /out/ \;'

      - name: Verify copied Linux binary artifacts
        run: |
          set -eux
          cd dist-binaries
          sha256sum -c powermem-*-linux-amd64-*.sha256
          ls -lh \
            powermem-*-linux-amd64-binaries.tar.gz \
            powermem-*-linux-amd64-binaries.tar.gz.sha256 \
            powermem-*-linux-amd64-powermem*

      - name: Upload Linux amd64 binaries
        uses: actions/upload-artifact@v7
        with:
          name: powermem-linux-amd64-binaries
          path: |
            dist-binaries/powermem-*-linux-amd64-binaries.tar.gz
            dist-binaries/powermem-*-linux-amd64-binaries.tar.gz.sha256
            dist-binaries/powermem-*-linux-amd64-powermem*
          if-no-files-found: error
          retention-days: 30

  build-native-binaries:
    name: Build ${{ matrix.binary-os }} ${{ matrix.binary-arch }} binaries
    runs-on: ${{ matrix.runner }}
    needs: build-dashboard
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-15-intel
            binary-os: macos
            binary-arch: amd64
            archive-format: tar.gz
          - runner: macos-15
            binary-os: macos
            binary-arch: aarch64
            archive-format: tar.gz
          - runner: windows-2022
            binary-os: windows
            binary-arch: amd64
            archive-format: zip

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Download dashboard artifact
        uses: actions/download-artifact@v8
        with:
          name: dashboard-dist
          path: dashboard-dist

      - name: Inject Dashboard into binary package source
        shell: bash
        run: |
          mkdir -p src/server/dashboard
          cp -r dashboard-dist/* src/server/dashboard/

      - name: Set up uv and Python
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
        with:
          python-version: "3.11"
          enable-cache: true

      - name: Check Python package versions
        shell: bash
        run: |
          uv run --no-project --python "3.11" python scripts/check_package_versions.py

      - name: Build native binary package
        shell: bash
        env:
          POWERMEM_BINARY_OS: ${{ matrix.binary-os }}
          POWERMEM_BINARY_ARCH: ${{ matrix.binary-arch }}
          POWERMEM_BINARY_FORMAT: ${{ matrix.archive-format }}
        run: UV_PYTHON=3.11 bash scripts/build_binary_package.sh

      - name: Verify native binary package
        shell: bash
        run: |
          uv run --no-project --python "3.11" python scripts/smoke_binary_package.py \
            --dist dist-binaries \
            --target-os "${{ matrix.binary-os }}" \
            --target-arch "${{ matrix.binary-arch }}" \
            --require-individual-assets

      - name: Upload native binaries
        uses: actions/upload-artifact@v7
        with:
          name: powermem-${{ matrix.binary-os }}-${{ matrix.binary-arch }}-binaries
          path: |
            dist-binaries/powermem-*-${{ matrix.binary-os }}-${{ matrix.binary-arch }}-binaries.*
            dist-binaries/powermem-*-${{ matrix.binary-os }}-${{ matrix.binary-arch }}-powermem*
          if-no-files-found: error
          retention-days: 30

  build-and-release:
    runs-on: ubuntu-latest
    # Only release on version tags v*; do not run for plugin-only tags (plugins-v*)
    if: startsWith(github.ref, 'refs/tags/v') && !startsWith(github.ref, 'refs/tags/plugins-')
    needs:
      - combine-artifacts
      - package-claude-plugin
      - build-linux-binaries-centos7
      - build-native-binaries
    permissions:
      contents: write

    steps:
      - name: Download combined artifacts
        uses: actions/download-artifact@v8
        with:
          name: dist-packages
          path: dist

      - name: Download Claude Code plugin zip
        uses: actions/download-artifact@v8
        with:
          name: powermem-claude-code-plugin-zip
          path: plugin-dist

      - name: Download binary packages
        uses: actions/download-artifact@v8
        with:
          pattern: powermem-*-binaries
          path: binary-artifacts
          merge-multiple: true

      - name: Inspect existing release notes
        id: release-notes
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          release_error="$(mktemp)"
          trap 'rm -f "$release_error"' EXIT

          if body_length="$(gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --json body --jq '(.body // "") | length' 2>"$release_error")"; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
            if [ "${body_length:-0}" -gt 0 ]; then
              echo "has_body=true" >> "$GITHUB_OUTPUT"
            else
              echo "has_body=false" >> "$GITHUB_OUTPUT"
            fi
          elif grep -qi "release not found" "$release_error"; then
            echo "exists=false" >> "$GITHUB_OUTPUT"
            echo "has_body=false" >> "$GITHUB_OUTPUT"
          else
            cat "$release_error" >&2
            exit 1
          fi

      - name: Create Release
        uses: softprops/action-gh-release@v3
        with:
          files: |
            dist/*
            plugin-dist/powermem-claude-code-plugin-*.zip
            binary-artifacts/*
          draft: false
          prerelease: false
          generate_release_notes: ${{ steps.release-notes.outputs.exists != 'true' || steps.release-notes.outputs.has_body != 'true' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  dispatch-pypi-publish:
    runs-on: ubuntu-latest
    # Releases created with GITHUB_TOKEN do not emit a release.published event
    # that starts another workflow. workflow_dispatch is the supported exception,
    # and keeps PyPI trusted publishing bound to publish.yml.
    if: startsWith(github.ref, 'refs/tags/v') && !startsWith(github.ref, 'refs/tags/plugins-')
    needs: build-and-release
    permissions:
      actions: write
      contents: read

    steps:
      - name: Dispatch PyPI publish workflow
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: gh workflow run publish.yml --repo "$GITHUB_REPOSITORY" --ref "$RELEASE_TAG" -f release_tag="$RELEASE_TAG"