release.yml

name: Release

on:
  push:
    branches: [main]

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always
  CARGO_TARGET_DIR: target

jobs:
  quality:
    uses: ./.github/workflows/quality.yml
    permissions:
      contents: read

  build-binaries:
    name: Build ${{ matrix.target }}
    needs: quality
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            target: x86_64-unknown-linux-gnu
            binary: cf-integration
          - runner: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            binary: cf-integration
          - runner: macos-15-intel
            target: x86_64-apple-darwin
            binary: cf-integration
          - runner: macos-15
            target: aarch64-apple-darwin
            binary: cf-integration
          - runner: windows-2025
            target: x86_64-pc-windows-msvc
            binary: cf-integration.exe
          - runner: windows-11-arm
            target: aarch64-pc-windows-msvc
            binary: cf-integration.exe
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    env:
      CARGO_TARGET_DIR: target
    steps:
      - name: Checkout candidate commit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@1.97.0
        with:
          targets: ${{ matrix.target }}

      - name: Restore Rust cache
        uses: Swatinem/rust-cache@v2.9.1

      - name: Build release candidate
        shell: bash
        env:
          TARGET: ${{ matrix.target }}
        run: cargo build --release --locked --bin cf-integration --target "$TARGET"

      - name: Smoke test release candidate
        shell: bash
        env:
          BINARY: ${{ matrix.binary }}
          TARGET: ${{ matrix.target }}
        run: '"target/$TARGET/release/$BINARY" --help'

      - name: Package release candidate
        shell: bash
        env:
          BINARY: ${{ matrix.binary }}
          TARGET: ${{ matrix.target }}
        run: |
          mkdir -p dist/package
          cp "target/$TARGET/release/$BINARY" dist/package/
          archive="cf-integration-$TARGET.tgz"
          tar -C dist/package -czf "dist/$archive" "$BINARY"
          if command -v sha256sum >/dev/null; then
            sha256sum "dist/$archive" | sed 's#dist/##' > "dist/$archive.sha256"
          else
            shasum -a 256 "dist/$archive" | sed 's#dist/##' > "dist/$archive.sha256"
          fi

      - name: Upload prevalidated candidate
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: cf-integration-${{ matrix.target }}
          path: |
            dist/*.tgz
            dist/*.sha256
          compression-level: 0
          if-no-files-found: error
          retention-days: 1

      - name: Upload release orchestration CLI
        if: matrix.target == 'x86_64-unknown-linux-gnu'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-orchestration-cli
          path: dist/package/cf-integration
          if-no-files-found: error
          retention-days: 1

  publish:
    name: Publish crate and tag
    needs: [quality, build-binaries]
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    outputs:
      tag: ${{ steps.root-release.outputs.tag }}
    steps:
      - name: Checkout prevalidated commit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@1.97.0

      - name: Download release orchestration CLI
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-orchestration-cli
          path: .integration/release-cli

      - name: Make release orchestration CLI executable
        run: chmod +x .integration/release-cli/cf-integration

      - name: Replace stale unpublished release state
        id: release-state
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: .integration/release-cli/cf-integration ci prepare-release

      - name: Publish root package
        id: release-plz
        uses: release-plz/action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9 # v0.5.131
        with:
          command: release
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Select CLI release
        id: root-release
        env:
          CANDIDATE_TAG: ${{ steps.release-state.outputs.tag }}
          RELEASES: ${{ steps.release-plz.outputs.releases }}
        run: .integration/release-cli/cf-integration ci select-release

  publish-binaries:
    name: Publish release binaries
    needs: [build-binaries, publish]
    if: needs.publish.outputs.tag != ''
    runs-on: ubuntu-24.04
    permissions:
      attestations: write
      contents: write
      id-token: write
    steps:
      - name: Download prevalidated candidates
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: cf-integration-*
          path: dist
          merge-multiple: true

      - name: Attest release archives
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: dist/*.tgz

      - name: Upload assets and publish release
        env:
          GH_REPO: ${{ github.repository }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ needs.publish.outputs.tag }}
        run: |
          gh release upload "$TAG" dist/* --clobber
          gh release edit "$TAG" --draft=false --latest

  release-pr:
    name: Prepare next release
    needs: publish
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@1.97.0

      - name: Open or update release PR
        uses: release-plz/action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9 # v0.5.131
        with:
          command: release-pr
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}