release.yml

name: Release

# Tag-driven: pushing a vX.Y.Z tag builds the cross matrix and publishes it.
# Nothing here runs on an ordinary push, so a release is always a deliberate
# act rather than a side effect of landing on main.
on:
  push:
    tags: ["v*"]

# Read by default; only the publishing job widens to contents: write, and
# only far enough to create a release.
permissions:
  contents: read

jobs:
  # Native darwin/amd64 + darwin/arm64 build, kept as its own job because
  # it needs an actual macOS runner: zig (what the linux/windows matrix
  # below uses) cannot supply a macOS SDK, so darwin has never been part of
  # `make cross`'s own matrix (docs/INSTALL.md § Cross builds). A real Mac's
  # own clang/SDK builds both darwin arches natively, no cross-compilation
  # toolchain needed at all -- see Makefile's cross-darwin target.
  release-darwin:
    name: build darwin (macOS runner)
    runs-on: macos-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - uses: Rethunk-Tech/gh-actions/setup-go@e04e0afa3e00c59e33030fdbc7df29c15000357b # v1.7

      # Same reason the linux/windows job installs this: without it
      # cross-darwin still builds, just SQL-less (docs/INSTALL.md § SQL
      # support). Kept in sync with that job's own step on purpose --
      # skipping it here would ship a darwin artifact silently missing the
      # grammar its linux/windows siblings carry.
      - run: npm install -g tree-sitter-cli

      - run: make cross-darwin

      # Only the runner's own native arch can be exec'd directly --
      # macos-latest is Apple Silicon (arm64) as of this writing, so the
      # amd64 artifact is verified by `file` alone (a real Intel Mac or
      # Rosetta would be needed to run it, neither of which this step
      # assumes). `uname -m` rather than a hardcoded arch, so this keeps
      # working the day GitHub's own default flips.
      - name: smoke-test the native-arch artifact
        run: |
          case "$(uname -m)" in
            arm64) suffix=darwin-arm64 ;;
            x86_64) suffix=darwin-amd64 ;;
            *) echo "::error::unrecognized runner arch $(uname -m)"; exit 1 ;;
          esac
          native=$(find dist -name "*-$suffix" -type f)
          chmod +x "$native"
          "$native" --version
          "$native" languages | grep -q '^sql' || {
            echo "::error::darwin artifact has no sql grammar"; exit 1;
          }
          for bin in dist/rgit-*-darwin-*; do file "$bin"; done

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.6.2
        with:
          name: darwin-binaries
          path: dist/rgit-*-darwin-*
          if-no-files-found: error

  release:
    name: build and publish
    needs: release-darwin
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: write
      id-token: write # keyless cosign signing (Sigstore OIDC)
    steps:
      # fetch-depth: 0 because the Makefile stamps the binary from
      # `git describe --tags`, which reports a bare vX.Y.Z only when the tag
      # and its history are both present. A shallow checkout would ship
      # binaries versioned as a bare SHA.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - uses: Rethunk-Tech/gh-actions/setup-go@e04e0afa3e00c59e33030fdbc7df29c15000357b # v1.7

      # zig is the single cross-compilation toolchain `make cross` drives;
      # rgit links tree-sitter through cgo, so CGO_ENABLED=0 is not an
      # option and every target needs a real C compiler
      # (docs/INSTALL.md § Cross builds).
      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1

      # The tree-sitter CLI is what lets the release carry SQL support: the
      # grammar module ships no usable parser.c, so `make cross` generates
      # one via cmd/rgit-install. Without this step every artifact would
      # still build, just SQL-less (docs/INSTALL.md § SQL support).
      - run: npm install -g tree-sitter-cli

      - run: make cross

      # Fail loudly rather than publishing a release whose binaries quietly
      # lack the grammar this workflow installed a toolchain for.
      - name: verify the linux/amd64 artifact carries SQL
        run: |
          bin=$(find dist -name '*-linux-amd64' -type f)
          chmod +x "$bin"
          "$bin" --version
          "$bin" languages | grep -q '^sql' || {
            echo "::error::release artifact has no sql grammar"; exit 1;
          }

      # linux/amd64 above is the runner's own native arch, execed directly.
      # linux/arm64 cannot be: it is dynamically linked against glibc
      # (rgit links tree-sitter through cgo, so this is not a static Go
      # binary), and bare QEMU user-mode emulation has no aarch64 sysroot
      # to resolve /lib/ld-linux-aarch64.so.1 against on an amd64 host --
      # confirmed directly (`qemu-aarch64 ./rgit-...-linux-arm64` fails
      # with exactly that "could not open" error). Registering QEMU's
      # binfmt_misc handlers and running the binary *inside* a real
      # arm64 container image is what actually works: the image supplies
      # the matching glibc, and QEMU (via binfmt) transparently emulates
      # the container's own arm64 process for it -- the same mechanism
      # `docker buildx` uses for multi-arch image builds, just running a
      # bare binary instead of a build. Verified directly against this
      # exact artifact before writing this step, not assumed from how
      # QEMU emulation is commonly described.
      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
        with:
          platforms: arm64

      - name: verify the linux/arm64 artifact carries SQL
        run: |
          bin=$(find dist -name '*-linux-arm64' -type f)
          docker run --rm --platform=linux/arm64 -v "$PWD/dist:/dist" debian:bookworm-slim \
            /dist/"$(basename "$bin")" --version
          docker run --rm --platform=linux/arm64 -v "$PWD/dist:/dist" debian:bookworm-slim \
            /dist/"$(basename "$bin")" languages | grep -q '^sql' || {
            echo "::error::release artifact has no sql grammar"; exit 1;
          }

      # Wine runs the windows/amd64 PE binary directly on the linux runner.
      # Not preinstalled on ubuntu-latest (actions/runner-images' own
      # software manifest), unlike shellcheck/sha256sum above -- installed
      # here rather than via a marketplace action, since it is a single
      # well-known apt package and this workflow already prefers plain
      # `run:` steps over an action wherever apt covers it in one line.
      # The apt package is "wine64" but the binary it installs is plain
      # "wine" -- confirmed directly (`dpkg -L wine64` lists /usr/bin/wine,
      # no wine64 binary at all on Ubuntu 24.04), a real trap the package
      # name alone does not warn you about.
      - name: install wine
        run: |
          sudo apt-get update
          sudo apt-get install -y wine64

      # First run is noisy on stderr -- wine lazily creates ~/.wine and
      # spawns its own explorer/services helper processes, which complain
      # about a missing display and missing 32-bit support (wine32,
      # irrelevant to a console-only 64-bit exe like this one). That noise
      # never reaches stdout, so it does not affect the grep below;
      # confirmed directly rather than assumed, since a wall of "err:"
      # lines looks alarming enough to mistake for a real failure.
      - name: verify the windows/amd64 artifact carries SQL
        run: |
          bin=$(find dist -name '*-windows-amd64.exe' -type f)
          wine "$bin" --version
          wine "$bin" languages | grep -q '^sql' || {
            echo "::error::release artifact has no sql grammar"; exit 1;
          }

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.0
        with:
          name: darwin-binaries
          path: dist

      # make cross's own SHA256SUMS (above) only ever covers the three
      # files it just built -- regenerated here, over whatever dist/ holds
      # once the darwin job's artifacts have landed alongside them, so the
      # published checksums and signature cover every artifact this release
      # actually ships, darwin included.
      - name: regenerate SHA256SUMS over every artifact
        run: |
          cd dist
          chmod +x rgit-*-darwin-*
          sha256sum rgit-* > SHA256SUMS

      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      # Keyless: signs with a short-lived OIDC-issued cert instead of a
      # managed private key, so there is no signing key to rotate or leak.
      # Signs SHA256SUMS, not each binary -- the checksums already commit to
      # every artifact's contents, one signature covers the whole release.
      - name: sign checksums
        run: cosign sign-blob --yes --bundle dist/SHA256SUMS.sigstore.json dist/SHA256SUMS

      - name: publish
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "$GITHUB_REF_NAME" dist/* \
            --title "$GITHUB_REF_NAME" \
            --generate-notes