local-binary-release.yml

name: Local Binary Release

# Builds the distributable `maple` local binary (a single Bun-compiled
# executable: CLI + OTLP-ingest/query server + bundled SPA) for macOS and Linux,
# then attaches a 2-file bundle (`maple` + `libchdb.so`) per platform to a
# GitHub release.
#
# Why native runners (no cross-compilation): the bundle ships a prebuilt,
# platform-specific `libchdb.so` (downloaded from chdb-io/chdb-core releases),
# which `maple` dlopens via bun:ffi at runtime. We fetch the engine matching the
# host, so each target is built on a matching native runner.
#
# Each build job publishes its own tarball immediately after packaging — no
# separate aggregation step — so a slow or queued runner can never block the
# other platforms from appearing on the release.
#
# Each bundle ships `<bundle>.sha256` (`<hash>  <bundle file>`), an Ed25519
# signature over it (`.sha256.sig`, checked by `maple update` and install.sh),
# and a GitHub build-provenance attestation. See docs/local-mode.md
# "Release signing".
#
# Trigger: workflow_dispatch. With `tag` (release.yml dispatches it on `main` for each new
# CLI version) it builds that tag's commit and publishes; without it, it only builds the
# dispatched ref as artifacts. A publishing run must be dispatched on `main`, the tag must
# be `v<apps/cli version>` and on main's history, and only then does the job enter the
# `cli-release` environment that holds the signing key.

on:
    workflow_dispatch:
        inputs:
            tag:
                description: "Existing `v*` tag to build and publish (run on main). Leave blank to only produce build artifacts."
                required: false
                type: string

concurrency:
    group: ${{ github.workflow }}-${{ inputs.tag || github.ref }}
    cancel-in-progress: false

permissions:
    contents: write

jobs:
    # Resolves what to build before any of the repo's code runs, so the signing key only ever
    # meets a commit that main already contains.
    preflight:
        if: ${{ vars.MAPLE_RELEASE_ENABLED == 'true' }}
        runs-on: ubuntu-latest
        timeout-minutes: 5
        permissions:
            contents: read
        outputs:
            publish: ${{ steps.resolve.outputs.publish }}
            sha: ${{ steps.resolve.outputs.sha }}
            version: ${{ steps.resolve.outputs.version }}
        steps:
            # Keeps the read-only token: `git show` below lazily fetches the tagged commit's
            # blobs, and this job runs no repo code and uploads nothing.
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
              with:
                  fetch-depth: 0
                  filter: blob:none

            - name: Resolve the commit and version
              id: resolve
              env:
                  INPUT_TAG: ${{ inputs.tag }}
              run: |
                  set -euo pipefail
                  if [ -z "$INPUT_TAG" ]; then
                    {
                      echo "publish=false"
                      echo "sha=$GITHUB_SHA"
                      echo "version=$(git rev-parse --short "$GITHUB_SHA")"
                    } >> "$GITHUB_OUTPUT"
                    exit 0
                  fi
                  if [ "$GITHUB_REF" != "refs/heads/main" ]; then
                    echo "::error::A publishing run must be dispatched on main, not $GITHUB_REF."
                    exit 1
                  fi
                  if ! [[ "$INPUT_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
                    echo "::error::'$INPUT_TAG' is not a vX.Y.Z release tag."
                    exit 1
                  fi
                  sha="$(git rev-parse --verify --quiet "refs/tags/$INPUT_TAG^{commit}")" || {
                    echo "::error::Tag $INPUT_TAG does not exist."
                    exit 1
                  }
                  if ! git merge-base --is-ancestor "$sha" origin/main; then
                    echo "::error::Tag $INPUT_TAG ($sha) is not on main's history."
                    exit 1
                  fi
                  expected="v$(git show "$sha:apps/cli/package.json" | jq -r .version)"
                  if [ "$INPUT_TAG" != "$expected" ]; then
                    echo "::error::Tag $INPUT_TAG does not match apps/cli/package.json at that commit ($expected)."
                    exit 1
                  fi
                  {
                    echo "publish=true"
                    echo "sha=$sha"
                    echo "version=$INPUT_TAG"
                  } >> "$GITHUB_OUTPUT"

    build:
        needs: preflight
        name: Build ${{ matrix.target }}
        runs-on: ${{ matrix.runner }}
        timeout-minutes: 60
        # Holds MAPLE_RELEASE_SIGNING_KEY; deployable from main only. Build-only runs skip it.
        environment: ${{ needs.preflight.outputs.publish == 'true' && 'cli-release' || '' }}
        permissions:
            contents: write # create the release and upload assets
            id-token: write # OIDC identity for the build-provenance attestation
            attestations: write # store that attestation
        strategy:
            fail-fast: false
            matrix:
                # x86_64-apple-darwin builds on macos-15-intel. The previous Intel
                # label (macos-13) was retired in Dec 2025 and its job sat queued
                # forever, which is why the target was dropped; macos-15-intel is the
                # supported replacement and is available now. Intel macOS is EOL on
                # GitHub in Fall 2027 — drop this entry then, not before.
                #
                # Intel runners are the scarcest capacity in the pool, so this job can
                # sit queued far longer than the others. Publishing is per-job (see the
                # header), so a slow Intel build delays only its own tarball.
                include:
                    - target: aarch64-apple-darwin
                      runner: macos-14
                      os: macos
                    - target: x86_64-apple-darwin
                      runner: macos-15-intel
                      os: macos
                    - target: x86_64-unknown-linux-gnu
                      runner: ubuntu-22.04
                      os: linux
                    - target: aarch64-unknown-linux-gnu
                      runner: ubuntu-24.04-arm
                      os: linux
        env:
            PUBLISH: ${{ needs.preflight.outputs.publish }}
            VERSION: ${{ needs.preflight.outputs.version }}
            TARGET: ${{ matrix.target }}
        steps:
            # The commit preflight checked, not the tag name, which could move in between.
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
              with:
                  ref: ${{ needs.preflight.outputs.sha }}
                  persist-credentials: false

            - uses: ./.github/actions/setup
              with:
                  turbo-cache: "false"

            - name: Build local binary bundle
              # Builds the SPA, inlines it into the binary, compiles apps/cli with
              # `bun build --compile`, and downloads the matching libchdb beside it.
              # Output bundle lands in ./dist (maple + libchdb.so). MAPLE_BUILD_VERSION
              # bakes the resolved tag into `maple --version`.
              env:
                  MAPLE_BUILD_VERSION: ${{ env.VERSION }}
                  # Added when `packages/effect-sdk` emitted its .d.mts in-process on
                  # TypeScript 6: Node sizes its default old-space from host RAM, and
                  # v0.0.15 OOM'd on the 7 GB macos-14 runner ("Ineffective
                  # mark-compacts near heap limit") while both 16 GB Linux runners
                  # passed. Types now come from a native TypeScript 7 child process;
                  # keep the pin until a release confirms that runner no longer needs it.
                  NODE_OPTIONS: --max-old-space-size=5120
              run: scripts/build-local-binary.sh

            - name: Ad-hoc codesign (macOS)
              # bun-compiled binaries run locally once Gatekeeper quarantine is
              # cleared; ad-hoc sign both files for good measure. Production
              # distribution should layer Developer ID signing + notarization on
              # top (requires APPLE_* secrets not configured here).
              if: ${{ matrix.os == 'macos' }}
              run: |
                  set -euo pipefail
                  codesign --force --sign - dist/libchdb.so
                  codesign --force --sign - dist/maple
                  codesign --verify --verbose dist/maple

            - name: Package bundle
              id: package
              run: |
                  set -euo pipefail
                  name="maple-${VERSION}-${TARGET}"
                  staging="$RUNNER_TEMP/$name"
                  rm -rf "$staging"
                  mkdir -p "$staging"
                  cp dist/maple "$staging/maple"
                  cp dist/libchdb.so "$staging/libchdb.so"
                  # Smoke-check the relocatable 2-file bundle (maple + libchdb.so).
                  ( cd "$staging" && ./maple --help >/dev/null 2>&1 ) || \
                    echo "::warning::'maple --help' smoke check did not exit cleanly on $TARGET"
                  tarball="$RUNNER_TEMP/${name}.tar.gz"
                  tar -C "$RUNNER_TEMP" -czf "$tarball" "$name"
                  # `<hash>  <file>` (sha256sum format), run beside the tarball so
                  # the name is bare. The signature covers this line, so it binds
                  # the hash to this exact version and target. Older clients read
                  # only the first field.
                  if command -v shasum >/dev/null 2>&1; then
                    ( cd "$RUNNER_TEMP" && shasum -a 256 "${name}.tar.gz" ) > "${tarball}.sha256"
                  else
                    ( cd "$RUNNER_TEMP" && sha256sum "${name}.tar.gz" ) > "${tarball}.sha256"
                  fi
                  echo "tarball=$tarball" >> "$GITHUB_OUTPUT"
                  echo "name=$name" >> "$GITHUB_OUTPUT"

            - name: Sign checksum manifest
              # Writes <tarball>.sha256.sig. Build-only runs never get the key and stay
              # unsigned; a publishing run fails without it rather than ship a release
              # every binary rejects. The key is scoped to this step only.
              env:
                  MAPLE_RELEASE_SIGNING_KEY: ${{ env.PUBLISH == 'true' && secrets.MAPLE_RELEASE_SIGNING_KEY || '' }}
                  MAPLE_RELEASE_SIGNING_REQUIRED: ${{ env.PUBLISH == 'true' && '1' || '0' }}
                  MANIFEST: ${{ steps.package.outputs.tarball }}.sha256
              run: bun scripts/sign-local-release.ts "$MANIFEST"

            - name: Upload build artifact
              uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
              with:
                  name: ${{ steps.package.outputs.name }}
                  # The glob picks up the .sig when one was written.
                  path: |
                      ${{ steps.package.outputs.tarball }}
                      ${{ steps.package.outputs.tarball }}.sha256*
                  if-no-files-found: error
                  retention-days: 7

            - name: Attest build provenance
              # Verify with: gh attestation verify <bundle>.tar.gz --repo MapleTechLabs/maple
              if: ${{ env.PUBLISH == 'true' }}
              uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
              with:
                  subject-path: ${{ steps.package.outputs.tarball }}

            - name: Publish to release
              # Each platform publishes its own tarball as soon as it's built — no
              # waiting for other platforms. `gh release create` is idempotent (the
              # `|| true` swallows the "already exists" error from concurrent jobs).
              # A tarball already on the release is never replaced; a re-run only
              # finishes a platform whose upload did not complete.
              if: ${{ env.PUBLISH == 'true' }}
              env:
                  GH_TOKEN: ${{ github.token }}
                  REPO: ${{ github.repository }}
                  TAG: ${{ env.VERSION }}
                  TARBALL: ${{ steps.package.outputs.tarball }}
              run: |
                  set -euo pipefail
                  tarball="$TARBALL"
                  # Only a completed upload counts; a broken one is retried.
                  published="$(gh release view "$TAG" --repo "$REPO" --json assets \
                    --jq '.assets[] | select(.state == "uploaded") | .name' 2>/dev/null || true)"
                  if grep -Fqx "$(basename "$tarball")" <<<"$published"; then
                    echo "::notice::$(basename "$tarball") is already on release $TAG; leaving it as published."
                    exit 0
                  fi
                  # Create the release if it doesn't exist yet. Multiple platforms
                  # may race here; ignore the "already exists" error.
                  # Write notes to a file using printf so we avoid heredoc indentation
                  # issues inside a YAML literal block scalar.
                  # This version's section of the CLI changelog (written by the changesets
                  # Version Packages PR) leads the notes; older tags have none.
                  awk -v v="## ${TAG#v}" '$0 == v { on = 1; next } on && /^## / { exit } on' \
                    apps/cli/CHANGELOG.md > "$RUNNER_TEMP/changes.md" || true
                  if [ -s "$RUNNER_TEMP/changes.md" ]; then
                    { cat "$RUNNER_TEMP/changes.md"; printf '\n---\n\n'; } > "$RUNNER_TEMP/release-notes.md"
                  else
                    : > "$RUNNER_TEMP/release-notes.md"
                  fi
                  printf '%s\n\n%s\n```\n%s\n```\n\n%s\n\n%s\n' \
                    'Local Maple (`maple start`) bundles.' \
                    '**Install (macOS / Linux):**' \
                    'curl -fsSL https://maple.dev/cli/install | sh' \
                    'Or download a bundle below. Each archive contains `maple` + `libchdb.so` — keep both in the same directory. macOS: run `xattr -dr com.apple.quarantine maple libchdb.so` after extracting.' \
                    'Verify a downloaded bundle with `gh attestation verify <bundle>.tar.gz --repo MapleTechLabs/maple`. The `.sha256.sig` files are Ed25519 signatures over the `.sha256` files, checked by `maple update` and the installer.' \
                    >> "$RUNNER_TEMP/release-notes.md"
                  gh release create "$TAG" --repo "$REPO" --verify-tag \
                    --title "$TAG" \
                    --notes-file "$RUNNER_TEMP/release-notes.md" 2>/dev/null || true
                  # Verification assets first: once the tarball is visible, its
                  # checksum and signature already are.
                  verify_assets=("${tarball}.sha256")
                  if [ -f "${tarball}.sha256.sig" ]; then
                    verify_assets+=("${tarball}.sha256.sig")
                  fi
                  gh release upload "$TAG" "${verify_assets[@]}" --repo "$REPO" --clobber
                  gh release upload "$TAG" "$tarball" --repo "$REPO" --clobber

    # The self-hosted image (apps/cli/docker) around the two Linux bundles above.
    # Only a fully published release gets an image. A run without a tag builds and
    # smokes the image, no push.
    image:
        name: Container image
        needs: [preflight, build]
        runs-on: ubuntu-latest
        timeout-minutes: 30
        permissions:
            contents: read
            packages: write # push to ghcr.io
            id-token: write # OIDC identity for the provenance attestation
            attestations: write
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
              with:
                  ref: ${{ needs.preflight.outputs.sha }}
                  persist-credentials: false

            - name: Resolve tags
              id: tags
              env:
                  PUBLISH: ${{ needs.preflight.outputs.publish }}
                  VERSION: ${{ needs.preflight.outputs.version }}
                  REPO: ${{ github.repository }}
              run: |
                  set -euo pipefail
                  tag=""
                  if [ "$PUBLISH" = "true" ]; then tag="$VERSION"; fi
                  image="ghcr.io/${REPO,,}"
                  echo "image=$image" >> "$GITHUB_OUTPUT"
                  if [ -z "$tag" ]; then
                    echo "publish=false" >> "$GITHUB_OUTPUT"
                    exit 0
                  fi
                  tags="$image:$tag"
                  # `latest` follows the newest stable release only: never a pre-release
                  # (v1.2.3-rc.1), never a re-run of an older tag.
                  newest="$(git ls-remote --tags --refs origin 'v*' | sed 's|.*refs/tags/||' | { grep -ve '-' || true; } | sort -V | tail -1)"
                  if [ "$tag" = "$newest" ]; then tags="$tags,$image:latest"; fi
                  echo "publish=true" >> "$GITHUB_OUTPUT"
                  echo "tags=$tags" >> "$GITHUB_OUTPUT"

            - name: Download Linux bundles
              uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
              with:
                  pattern: maple-*-linux-gnu
                  path: ${{ runner.temp }}/artifacts
                  merge-multiple: true

            - name: Unpack bundles
              run: |
                  set -euo pipefail
                  bundles="$RUNNER_TEMP/bundles"
                  for pair in x86_64:amd64 aarch64:arm64; do
                    tarball="$(ls "$RUNNER_TEMP"/artifacts/maple-*-"${pair%%:*}"-unknown-linux-gnu.tar.gz)"
                    mkdir -p "$bundles/linux-${pair##*:}"
                    tar -xzf "$tarball" -C "$bundles/linux-${pair##*:}" --strip-components=1
                  done
                  echo "BUNDLES=$bundles" >> "$GITHUB_ENV"

            - name: Smoke the amd64 image
              timeout-minutes: 5
              env:
                  MAPLE_TELEMETRY: off
              run: |
                  apps/cli/docker/build-image.sh maple-local:release linux/amd64
                  apps/cli/docker/image-smoke.sh maple-local:release

            - name: Build and push both platforms
              id: push
              if: ${{ steps.tags.outputs.publish == 'true' }}
              env:
                  GH_TOKEN: ${{ github.token }}
                  ACTOR: ${{ github.actor }}
                  TAGS: ${{ steps.tags.outputs.tags }}
              run: |
                  set -euo pipefail
                  echo "$GH_TOKEN" | docker login ghcr.io -u "$ACTOR" --password-stdin
                  docker buildx create --use --name maple-release >/dev/null
                  tag_args=""
                  for tag in ${TAGS//,/ }; do tag_args="$tag_args --tag $tag"; done
                  EXTRA_ARGS="--push --metadata-file $RUNNER_TEMP/image-metadata.json$tag_args" \
                    apps/cli/docker/build-image.sh "${TAGS%%,*}" linux/amd64,linux/arm64
                  echo "digest=$(jq -r '."containerimage.digest"' "$RUNNER_TEMP/image-metadata.json")" >> "$GITHUB_OUTPUT"

            - name: Attest image provenance
              if: ${{ steps.tags.outputs.publish == 'true' }}
              uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
              with:
                  subject-name: ${{ steps.tags.outputs.image }}
                  subject-digest: ${{ steps.push.outputs.digest }}
                  push-to-registry: true

    # Points the flake's `maple` package (nix/release.json) at the published bundles.
    # Runs after every platform finished, even if one failed: the script leaves out a
    # platform whose bundle never made it to the release. Pre-releases keep the pin.
    nix-release:
        name: Nix release pin
        needs: [preflight, build]
        if: ${{ always() && needs.preflight.outputs.publish == 'true' && !contains(needs.preflight.outputs.version, '-') }}
        runs-on: ubuntu-latest
        timeout-minutes: 10
        permissions:
            contents: write
            pull-requests: write
            actions: write # dispatch the Nix check on the pin branch
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
              with:
                  ref: main

            - name: Open the pin PR
              env:
                  GH_TOKEN: ${{ github.token }}
                  TAG: ${{ needs.preflight.outputs.version }}
              run: |
                  set -euo pipefail
                  # Never pin a re-run of an older tag over a newer one.
                  newest="$(git ls-remote --tags --refs origin 'v*' | sed 's|.*refs/tags/||' | { grep -ve '-' || true; } | sort -V | tail -1)"
                  if [ "$TAG" != "$newest" ]; then
                    echo "::notice::$TAG is not the newest stable tag ($newest); keeping the pin."
                    exit 0
                  fi
                  scripts/update-nix-release.sh "$TAG"
                  if git diff --quiet -- nix/release.json; then
                    echo "::notice::nix/release.json already pins $TAG."
                    exit 0
                  fi
                  branch="nix/release-$TAG"
                  git config user.name "github-actions[bot]"
                  git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
                  git switch -c "$branch"
                  git commit -m "chore(nix): pin maple $TAG" -- nix/release.json
                  git push --force origin "$branch"
                  if [ -z "$(gh pr list --head "$branch" --state open --json number --jq '.[].number')" ]; then
                    gh pr create --base main --head "$branch" \
                      --title "chore(nix): pin maple $TAG" \
                      --body "Points the flake's \`maple\` package at the $TAG bundles (\`scripts/update-nix-release.sh $TAG\`)."
                  fi
                  # A push made with this token starts no workflows, so run the check explicitly.
                  gh workflow run nix.yml --ref "$branch"