release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: Existing tag to publish
        required: true
        type: string

permissions:
  contents: read

env:
  RUNNER_RELEASE: v0.9.0
  RUNNER_SHA256: 1f7ddac305e63562a8ac5317d956d19907c3fffc06132471fd586f63c43c35d4
  RELEASE_TAG: ${{ inputs.tag }}

jobs:
  linux:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          ref: ${{ inputs.tag }}
      - uses: AndreBaltazar8/setup-abla@b21e1290aa49862e7bf187dc84b6b3511f4b571e # v1.0.0
        with:
          version: '0.2.10'
      - name: Test and compile CLI
        run: |
          ablac package update --project .
          make test build COMPILER=ablac
      - name: Link portable Linux executable
        run: |
          docker run --rm \
            -e RELEASE_VERSION="${RELEASE_TAG#v}" \
            -v "$PWD:/micro-cli" \
            ubuntu:22.04@sha256:3b06811b2afd352be909dd088a004166d665dc76d38b13eada33522a9d915c6f \
            bash -ceu '
              export DEBIAN_FRONTEND=noninteractive
              apt-get update
              apt-get install -y --no-install-recommends clang lld libssl-dev
              cd /micro-cli
              clang -fuse-ld=lld build/micro.o \
                -Wl,-Bstatic -lssl -lcrypto -Wl,-Bdynamic \
                -lpthread -ldl -o build/micro-linux-x86_64
              strip build/micro-linux-x86_64
              test "$(build/micro-linux-x86_64 --version)" = "micro $RELEASE_VERSION"
              if ldd build/micro-linux-x86_64 | grep -Eq "lib(ssl|crypto)"; then
                echo "OpenSSL was not linked into the portable CLI" >&2
                exit 1
              fi
            '
          cd build
          sha256sum micro-linux-x86_64 > micro-linux-x86_64.sha256
      - name: Fetch the pinned static Linux runner
        run: |
          curl --fail --location --silent --show-error \
            "https://github.com/microdotdo/micro-cli/releases/download/$RUNNER_RELEASE/micro-runner-linux-x86_64-static" \
            -o build/micro-runner-linux-x86_64
          echo "$RUNNER_SHA256  build/micro-runner-linux-x86_64" | sha256sum --check
          chmod 0755 build/micro-runner-linux-x86_64
          file build/micro-runner-linux-x86_64 | grep -F 'static-pie linked'
          build/micro-runner-linux-x86_64 --version | grep -Fx 'micro-runner 0.1.0'
          (cd build && sha256sum micro-runner-linux-x86_64 > micro-runner-linux-x86_64.sha256)
      - name: Package the self-contained Linux toolchain
        run: |
          docker run --rm \
            -v "$PWD:/micro-cli" \
            -v "$ABLA_HOME:/abla:ro" \
            ubuntu:22.04@sha256:3b06811b2afd352be909dd088a004166d665dc76d38b13eada33522a9d915c6f \
            bash -ceu '
              export DEBIAN_FRONTEND=noninteractive
              apt-get update
              apt-get install -y --no-install-recommends \
                binaryen ca-certificates curl gnupg patchelf
              curl -fsSL https://apt.llvm.org/llvm-snapshot.gpg.key \
                -o /tmp/llvm.asc
              fingerprint=$(gpg --show-keys --with-colons /tmp/llvm.asc |
                awk -F: '\''$1 == "fpr" { print $10; exit }'\'')
              test "$fingerprint" = 6084F3CF814B57C1CF12EFD515CF4D18AF4F7421
              gpg --dearmor -o /usr/share/keyrings/apt.llvm.org.gpg \
                /tmp/llvm.asc
              echo "deb [signed-by=/usr/share/keyrings/apt.llvm.org.gpg] http://apt.llvm.org/jammy/ llvm-toolchain-jammy-21 main" \
                > /etc/apt/sources.list.d/llvm.list
              apt-get update
              apt-get install -y --no-install-recommends \
                clang-21 llvm-21 lld-21 libssl3
              export PATH=/usr/lib/llvm-21/bin:$PATH
              /micro-cli/tools/package-linux-toolchain.sh \
                /micro-cli/build/micro-linux-x86_64 \
                /micro-cli/build/micro-runner-linux-x86_64 \
                /abla/libexec/ablac.bin \
                /abla/share/abla \
                /micro-cli/build/micro-toolchain-linux-x86_64.tar.gz
            '
      - name: Exercise the bundle without Nix or Homebrew
        run: |
          docker run --rm \
            -v "$PWD/build:/release:ro" \
            ubuntu:22.04@sha256:3b06811b2afd352be909dd088a004166d665dc76d38b13eada33522a9d915c6f \
            bash -ceu '
              mkdir -p /opt/micro /work
              tar -xzf /release/micro-toolchain-linux-x86_64.tar.gz \
                -C /opt/micro --strip-components=1
              export PATH=/opt/micro/bin:$PATH
              test "$(micro --version)" = "micro '${RELEASE_TAG#v}'"
              test "$(ablac --version)" = "ablac 0.2.10"
              test "$(micro-runner --version)" = "micro-runner 0.1.0"
              mkdir -p /work/hello/public
              printf "@export(\\042micro_sign_extension_probe\\042)\\nfun signExtensionProbe(value: i8): int = value\\n\\nfun main: int = 0\\n" \
                > /work/hello/app.ab
              printf "<!doctype html><title>Portable Micro test</title>\\n" \
                > /work/hello/public/index.html
              cd /work/hello
              micro build
              test -s .micro/build/app.wasm
              test ! -e .micro/build-driver
              test ! -e .micro/build-driver.o
              test ! -e .micro/build-driver.ll
            '
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: micro-linux-x86_64
          path: |
            build/micro-linux-x86_64
            build/micro-linux-x86_64.sha256
            build/micro-runner-linux-x86_64
            build/micro-runner-linux-x86_64.sha256
            build/micro-toolchain-linux-x86_64.tar.gz
            build/micro-toolchain-linux-x86_64.tar.gz.sha256
          if-no-files-found: error

  macos:
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-15
            architecture: arm64
          - runner: macos-15-intel
            architecture: x86_64
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          ref: ${{ inputs.tag }}
      - uses: AndreBaltazar8/setup-abla@b21e1290aa49862e7bf187dc84b6b3511f4b571e # v1.0.0
        with:
          version: '0.2.10'
      - name: Test and compile native CLI
        run: |
          ablac package update --project .
          make test build COMPILER=ablac
          test "$(build/micro --version)" = "micro ${RELEASE_TAG#v}"
          test "$(uname -m)" = "${{ matrix.architecture }}"
          otool -L build/micro | grep -F '/opt/openssl@3/lib/libssl.3.dylib'
          mv build/micro "build/micro-macos-${{ matrix.architecture }}"
          cd build
          shasum -a 256 "micro-macos-${{ matrix.architecture }}" > "micro-macos-${{ matrix.architecture }}.sha256"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: micro-macos-${{ matrix.architecture }}
          path: |
            build/micro-macos-${{ matrix.architecture }}
            build/micro-macos-${{ matrix.architecture }}.sha256
          if-no-files-found: error

  publish:
    needs: [linux, macos]
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          path: dist
          merge-multiple: true
      - name: Verify release payload
        run: |
          test "$(find dist -maxdepth 1 -type f | wc -l)" -eq 10
          cd dist
          sha256sum --check micro-linux-x86_64.sha256
          sha256sum --check micro-runner-linux-x86_64.sha256
          sha256sum --check micro-toolchain-linux-x86_64.tar.gz.sha256
          sha256sum --check micro-macos-arm64.sha256
          sha256sum --check micro-macos-x86_64.sha256
      - name: Publish immutable release
        env:
          GH_TOKEN: ${{ github.token }}
        run: >-
          gh release create "$RELEASE_TAG"
          dist/micro-linux-x86_64
          dist/micro-linux-x86_64.sha256
          dist/micro-runner-linux-x86_64
          dist/micro-runner-linux-x86_64.sha256
          dist/micro-toolchain-linux-x86_64.tar.gz
          dist/micro-toolchain-linux-x86_64.tar.gz.sha256
          dist/micro-macos-arm64
          dist/micro-macos-arm64.sha256
          dist/micro-macos-x86_64
          dist/micro-macos-x86_64.sha256
          --repo "$GITHUB_REPOSITORY"
          --verify-tag
          --title "micro ${RELEASE_TAG#v}"
          --generate-notes