release.yml

# .github/workflows/release.yml
# cargo-dist driven release pipeline.
# Spec: zerodds-deployment-1.0.md §6.
# Triggers on git tag push v*.*.*, computes a release plan, builds per-target
# artefacts, then dispatches the platform-specific publish-jobs declared in
# [workspace.metadata.dist].publish-jobs.
name: release

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g. v1.0.0-rc.1)"
        required: true
        type: string

permissions:
  contents: write
  packages: write
  id-token: write   # OIDC for cosign keyless signing

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  plan:
    name: cargo-dist plan
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.plan.outputs.tag }}
      val: ${{ steps.plan.outputs.val }}
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-dist
        run: cargo install cargo-dist --version 0.22.1 --locked
      - name: Plan
        id: plan
        run: |
          TAG="${{ github.event.inputs.tag || github.ref_name }}"
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          PLAN=$(cargo dist plan --output-format=json)
          echo "val<<JSON_EOF" >> "$GITHUB_OUTPUT"
          echo "$PLAN" >> "$GITHUB_OUTPUT"
          echo "JSON_EOF" >> "$GITHUB_OUTPUT"

  build:
    name: Build (${{ matrix.target }})
    needs: plan
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-22.04
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-22.04
          - target: x86_64-unknown-linux-musl
            os: ubuntu-22.04
          - target: aarch64-unknown-linux-musl
            os: ubuntu-22.04
          # macos-13 is effectively no longer available on the public
          # GH Action runners (>1h queue times). We build
          # x86_64-apple-darwin via cross-compile on a macos-14
          # (Apple Silicon) runner — `cargo --target x86_64-apple-darwin`
          # is natively supported by Apple tooling.
          - target: x86_64-apple-darwin
            os: macos-14
          - target: aarch64-apple-darwin
            os: macos-14
          - target: x86_64-pc-windows-msvc
            os: windows-2022
          - target: aarch64-pc-windows-msvc
            os: windows-2022
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - name: Install cross deps (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends pkg-config libssl-dev musl-tools
          case "${{ matrix.target }}" in
            aarch64-unknown-linux-gnu)
              # aarch64 cross-compile: needs the compiler PLUS multi-arch
              # libc headers (otherwise "bits/libc-header-start.h not found"
              # in ring's C builds via cc-rs).
              sudo apt-get install -y --no-install-recommends \
                  gcc-aarch64-linux-gnu libc6-dev-arm64-cross
              ;;
            aarch64-unknown-linux-musl)
              # musl-cross: gcc-aarch64-linux-musl is not in the default
              # archive; use gcc-aarch64-linux-gnu with musl-libc because
              # musl links statically and cc-rs only needs the compiler for
              # syscall headers.
              sudo apt-get install -y --no-install-recommends \
                  gcc-aarch64-linux-gnu libc6-dev-arm64-cross
              ;;
          esac
      - name: Configure cross-compile linker for aarch64
        if: runner.os == 'Linux' && startsWith(matrix.target, 'aarch64-unknown-linux-')
        run: |
          mkdir -p ~/.cargo
          {
            echo "[target.aarch64-unknown-linux-gnu]"
            echo 'linker = "aarch64-linux-gnu-gcc"'
            echo "[target.aarch64-unknown-linux-musl]"
            echo 'linker = "aarch64-linux-gnu-gcc"'
          } >> ~/.cargo/config.toml
          {
            echo "CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc"
            echo "AR_aarch64_unknown_linux_gnu=aarch64-linux-gnu-ar"
            echo "CC_aarch64_unknown_linux_musl=aarch64-linux-gnu-gcc"
            echo "AR_aarch64_unknown_linux_musl=aarch64-linux-gnu-ar"
          } >> $GITHUB_ENV
      # macOS code-signing: import the Developer ID Application + Installer
      # certs into an ad-hoc keychain. apple-actions/import-codesign-certs
      # dislikes two imports into the same keychain (set-key-partition-list
      # collides), so do it directly via /usr/bin/security.
      - name: Import Apple codesigning certs (macOS)
        if: runner.os == 'macOS'
        env:
          APP_P12:    ${{ secrets.APPLE_CERT_APP_BASE64 }}
          APP_PWD:    ${{ secrets.APPLE_CERT_APP_PASSWORD }}
          INST_P12:   ${{ secrets.APPLE_CERT_INSTALLER_BASE64 }}
          INST_PWD:   ${{ secrets.APPLE_CERT_INSTALLER_PASSWORD }}
        run: |
          set -e
          KC="zerodds-signing.keychain"
          KC_PWD=$(uuidgen)
          # 1) Create + unlock keychain + prepend to the search path.
          security create-keychain -p "$KC_PWD" "$KC"
          security set-keychain-settings -lut 21600 "$KC"
          security unlock-keychain -p "$KC_PWD" "$KC"
          security list-keychains -d user -s "$KC" $(security list-keychains -d user | tr -d '"')
          # 2) Import both P12s one after another (-A grants all tools access).
          echo "$APP_P12"  | base64 -D > /tmp/cert-app.p12
          echo "$INST_P12" | base64 -D > /tmp/cert-installer.p12
          security import /tmp/cert-app.p12       -k "$KC" -P "$APP_PWD"  -A -T /usr/bin/codesign -T /usr/bin/productsign -T /usr/bin/security
          security import /tmp/cert-installer.p12 -k "$KC" -P "$INST_PWD" -A -T /usr/bin/codesign -T /usr/bin/productsign -T /usr/bin/security
          # 3) Set the partition list once for both (Apple-tool access
          #    without a password prompt at runtime).
          security set-key-partition-list -S apple-tool:,apple: -s -k "$KC_PWD" "$KC"
          # 4) Clean up p12 files.
          rm -f /tmp/cert-app.p12 /tmp/cert-installer.p12
          # 5) Verification.
          security find-identity -v -p codesigning "$KC"
      - name: Install cargo-dist
        run: cargo install cargo-dist --version 0.22.1 --locked
      - name: Build target
        run: cargo dist build --target ${{ matrix.target }}
      - name: Sign with minisign (Linux)
        if: runner.os == 'Linux'
        env:
          MINISIGN_KEY: ${{ secrets.MINISIGN_SECRET_KEY }}
          MINISIGN_PWD: ${{ secrets.MINISIGN_PASSWORD }}
        run: bash packaging/github-actions/sign-artifacts.sh target/distrib
      - name: Codesign + notarize + .pkg macOS binaries
        if: runner.os == 'macOS'
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_NOTARY_PASSWORD: ${{ secrets.APPLE_NOTARY_PASSWORD }}
          # Apple cert naming convention (checked via security find-identity):
          # "Developer ID Application: <Common-Name> (<TEAMID>)" — external distribution + notarization
          # "Developer ID Installer:   <Common-Name> (<TEAMID>)" — .pkg-installer signing
          DEV_ID_APPLICATION: "Developer ID Application: Sandra Theresa Keler (YU6XNW6DG7)"
          DEV_ID_INSTALLER:   "Developer ID Installer: Sandra Theresa Keler (YU6XNW6DG7)"
          ZERODDS_PKG_VERSION: "1.0.0"
        run: bash packaging/github-actions/sign-macos.sh target/distrib
      - uses: actions/upload-artifact@v7
        with:
          name: artifacts-${{ matrix.target }}
          path: target/distrib/

  package-deb:
    name: Build .deb packages
    needs: [plan, build]
    uses: ./.github/workflows/publish-deb.yml
    secrets: inherit
    with:
      plan: ${{ needs.plan.outputs.val }}

  package-rpm:
    name: Build .rpm packages
    needs: [plan, build]
    uses: ./.github/workflows/publish-rpm.yml
    secrets: inherit
    with:
      plan: ${{ needs.plan.outputs.val }}

  package-docker:
    name: Build + push Docker images
    needs: [plan, build]
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        # Daemons are service images (ENTRYPOINT-driven), runtimes are
        # sandbox environments for learner/demo workflows (Python/C/C++/
        # TS toolchain plus libzerodds.so + zerodds-idlc). Both are
        # published with the same tag scheme — consumers distinguish
        # via the image name (zerodds-cli vs. zerodds-py-runtime).
        image:
          - ws-bridged
          - mqtt-bridged
          - coap-bridged
          - amqp-bridged
          - grpc-bridged
          - corba-bridged
          - ros2-shim
          - cli
          - py-runtime
          - cpp-runtime
          - ts-node-runtime
    steps:
      - uses: actions/checkout@v7
      - uses: docker/setup-qemu-action@v4
      - uses: docker/setup-buildx-action@v4
      - name: Login to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build + push (${{ matrix.image }})
        uses: docker/build-push-action@v7
        with:
          context: .
          file: packaging/docker/${{ matrix.image }}/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            fishermen21/zerodds-${{ matrix.image }}:${{ needs.plan.outputs.tag }}
            fishermen21/zerodds-${{ matrix.image }}:1.0
            ghcr.io/zero-objects/zerodds-${{ matrix.image }}:${{ needs.plan.outputs.tag }}
            ghcr.io/zero-objects/zerodds-${{ matrix.image }}:1.0
          # No GHA build cache: the `type=gha` exporter hits the GitHub Actions
          # cache backend, which returns `not_found` on export ("failed to solve:
          # not_found") across the parallel multi-image matrix — a cache-service
          # issue, not scope collision (per-image scope did not help; it whipsawed
          # to a different image each run). The images build + push fine; only the
          # cache export failed, and it was caching nothing anyway. Dropped for
          # reliability — builds are slower (no cross-run layer reuse) but green.

  package-msi:
    name: Build Windows MSI
    needs: [plan, build]
    continue-on-error: true
    runs-on: windows-2022
    steps:
      - uses: actions/checkout@v7
      - uses: actions/download-artifact@v8
        with:
          name: artifacts-x86_64-pc-windows-msvc
          path: payload\
      - name: Reshape payload to flat bin/ dir
        shell: pwsh
        run: |
          # cargo-dist payload layout (verified on the CI runner with a
          # real download of artifact-x86_64-pc-windows-msvc): the .exes
          # live in payload\<binname>-x86_64-pc-windows-msvc\<binname>.exe.
          # IMPORTANT: separate payload-flat\ tree so Get-ChildItem
          # -Recurse does not see the just-copied files twice (race
          # with lazy iteration). Plus eager eval via @() before copy.
          New-Item -ItemType Directory -Force -Path payload-flat\bin | Out-Null
          $exes = @(Get-ChildItem -Path payload -Filter *.exe -Recurse -File)
          Write-Host "found $($exes.Count) .exe files in payload/"
          $exes | ForEach-Object { Copy-Item $_.FullName -Destination "payload-flat\bin\$($_.Name)" -Force }
          Write-Host "=== payload-flat\bin\ jetzt ==="
          Get-ChildItem payload-flat\bin | ForEach-Object { Write-Host "  $($_.Name) ($($_.Length) bytes)" }
      - name: Install WiX 4 + extensions
        run: |
          # Verified on the CI runner (gitlab branch wix-debug, pipeline 1001 = MSI built 749 KiB):
          # WiX 4 split the classic in-process extensions (Util, UI, Bal, ...)
          # into separate NuGet packages. We need Util + UI:
          #   - WixToolset.Util.wixext  for <util:ServiceConfig>
          #   - WixToolset.UI.wixext    for <ui:WixUI Id="WixUI_Mondo">
          dotnet tool install --global wix --version 4.0.5
          wix extension add WixToolset.Util.wixext/4.0.5
          wix extension add WixToolset.UI.wixext/4.0.5
      - name: Prepare LICENSE.rtf
        shell: pwsh
        run: |
          # The WixUI_Mondo dialog set shows a license-acceptance page; the
          # Apache-2.0 LICENSE only exists as plain text. Convert it to
          # minimal RTF so the WixUILicenseRtf variable has a valid
          # file path.
          $rtfHeader = '{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1031{\fonttbl{\f0\fnil\fcharset0 Calibri;}}'
          $rtfStart = '{\*\generator ZeroDDS-CI;}\viewkind4\uc1\pard\sa200\sl276\slmult1\f0\fs20\lang7'
          $body = (Get-Content -Path LICENSE -Raw) -replace '\\','\\' -replace '\{','\{' -replace '\}','\}' -replace "`r?`n",'\par '
          Set-Content -Path LICENSE.rtf -Value "$rtfHeader $rtfStart $body }"
      - name: Compile MSI
        run: |
          wix build -arch x64 `
                -ext WixToolset.Util.wixext `
                -ext WixToolset.UI.wixext `
                -d PayloadDir=payload-flat `
                packaging/windows/msi/zerodds.wxs -o dist/zerodds-1.0.0-x64.msi
      - name: Sign MSI (skipped if WIN_CERT not provided)
        continue-on-error: true
        env:
          WIN_CERT_PFX: ${{ secrets.WIN_CERT_PFX_BASE64 }}
          WIN_CERT_PWD: ${{ secrets.WIN_CERT_PWD }}
        run: |
          if (-not $env:WIN_CERT_PFX) {
              Write-Host "WIN_CERT_PFX_BASE64 not set; shipping unsigned MSI."
              exit 0
          }
          [System.IO.File]::WriteAllBytes("cert.pfx",
              [Convert]::FromBase64String($env:WIN_CERT_PFX))
          signtool sign /f cert.pfx /p $env:WIN_CERT_PWD `
                   /tr http://timestamp.digicert.com /td SHA256 /fd SHA256 `
                   dist/zerodds-1.0.0-x64.msi
      - uses: actions/upload-artifact@v7
        with:
          name: zerodds-msi
          path: dist/*.msi

  publish-homebrew-tap:
    name: Update Homebrew tap
    needs: [plan, build, package-msi]
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v7
        with:
          repository: zero-objects/homebrew-zerodds
          token: ${{ secrets.HOMEBREW_TAP_PAT }}
          path: tap
      - name: Checkout main repo
        uses: actions/checkout@v7
        with:
          path: main
      - name: Render formulae
        working-directory: main
        run: bash packaging/github-actions/render-homebrew.sh ../tap/Formula
      - name: Commit + push
        working-directory: tap
        run: |
          git config user.name  "zerodds-release-bot"
          git config user.email "release@zerodds.org"
          git add Formula
          git commit -m "release: ${{ needs.plan.outputs.tag }}" || echo "(no changes)"
          git push

  publish-aur:
    name: Update AUR (zerodds + zerodds-bin)
    needs: [plan, github-release]
    # Run even if github-release "failed" — the ensure-published
    # step corrects softprops' draft-state pseudo-failures.
    # We check AT RUNTIME whether the release is actually published.
    if: always() && needs.plan.outputs.tag != ''
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v7
      - name: Verify release is published before AUR update
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -e
          for attempt in 1 2 3; do
            if gh release view "${{ needs.plan.outputs.tag }}" \
                 --repo "${{ github.repository }}" \
                 --json isDraft,assets \
                 --jq '. | if .isDraft then error("release still draft") else "ok: \(.assets | length) assets" end'; then
              break
            fi
            echo "release not yet published, attempt $attempt"
            sleep 60
          done
      - name: Setup AUR SSH key
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          printf '%s\n' "${{ secrets.AUR_SSH_KEY }}" > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          cat <<'CFG' > ~/.ssh/config
          Host aur.archlinux.org
              User aur
              IdentityFile ~/.ssh/aur
              IdentitiesOnly yes
              StrictHostKeyChecking accept-new
          CFG
      - name: Render + push PKGBUILDs
        env:
          TAG: ${{ needs.plan.outputs.tag }}
        run: bash packaging/github-actions/aur-publish.sh "$TAG"

  publish-scoop-bucket:
    name: Update Scoop bucket
    needs: [plan, build, package-msi]
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v7
        with:
          repository: zero-objects/scoop-zerodds
          token: ${{ secrets.SCOOP_BUCKET_PAT }}
          path: bucket
      - name: Checkout main repo
        uses: actions/checkout@v7
        with:
          path: main
      - name: Render manifest
        run: cp main/packaging/windows/scoop/zerodds.json bucket/zerodds.json
      - name: Commit + push
        working-directory: bucket
        run: |
          git config user.name  "zerodds-release-bot"
          git config user.email "release@zerodds.org"
          git add zerodds.json
          git commit -m "release: ${{ needs.plan.outputs.tag }}" || echo "(no changes)"
          git push

  github-release:
    name: Publish GitHub release
    # `package-msi` is `continue-on-error: true` — the overall release
    # must NOT be skipped if only the Win MSI fails. The rest
    # (deb/rpm/docker/macos/linux/windows-zip) is fully sufficient for
    # a technically functional release. `if: always()` + explicit
    # success checks for the hard-required artifacts.
    needs: [plan, build, package-deb, package-rpm, package-docker, package-msi]
    if: |
      always()
      && needs.plan.result == 'success'
      && needs.build.result == 'success'
      && needs.package-deb.result == 'success'
      && needs.package-rpm.result == 'success'
      && needs.package-docker.result == 'success'
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/download-artifact@v8
        with: { path: dist }
      - name: Create release
        id: gh_release
        continue-on-error: true
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.plan.outputs.tag }}
          generate_release_notes: true
          prerelease: ${{ contains(needs.plan.outputs.tag, '-') }}
          draft: false
          body: |
            ## Installation

            ### macOS
            **Recommended:** `zerodds-bundle-*.pkg` (signed + notarized + stapled — Gatekeeper accepts it without a workaround).

            **Tarball variant** (`*.tar.xz`): Apple notarytool does not accept .tar.xz, so the tarball binary carries no notarization ticket. After unpacking:
            ```bash
            xattr -d com.apple.quarantine zerodds-* 2>/dev/null
            chmod +x zerodds-*
            ```

            ### Linux
            - **Arch**: `paru -S zerodds-bin` (precompiled) or `paru -S zerodds` (build from source)
            - **Debian/Ubuntu**: download `*.deb` + `sudo dpkg -i`
            - **Fedora/RHEL**: download `*.rpm` + `sudo dnf install`
            - **Generic**: `*.tar.xz` for whichever component you want

            ### Windows
            - **MSI installer**: `zerodds-1.0.0-x64.msi` (signed if WIN_CERT_PFX is set)
            - **Portable**: download `*.zip` + extract

            ### Docker
            Multi-arch (amd64/arm64) auf ghcr.io + Docker Hub:
            ```bash
            docker pull ghcr.io/zero-objects/zerodds-cli:1.0.0-rc.1
            docker pull fishermen21/zerodds-mqtt-bridged:1.0.0-rc.1
            ```

            ### Crates.io
            ```bash
            cargo install zerodds-record zerodds-bench zerodds-monitor-cli zerodds-spy zerodds-snitch zerodds-pcap zerodds-mq
            ```

            ---
          files: |
            dist/**/*.tar.gz
            dist/**/*.tar.xz
            dist/**/*.tar.xz.sha512
            dist/**/*.zip
            dist/**/*.zip.sha512
            dist/**/*.deb
            dist/**/*.rpm
            dist/**/*.msi
            dist/**/*.pkg
            dist/**/*.pkg.sha512
            dist/**/*.AppImage
            dist/**/SHA512SUMS*
      # Workaround: softprops/action-gh-release@v2 sometimes sets
      # draft=true on secondary-rate-limit errors during asset upload
      # (e.g. a 7x metadata-update retry for source.tar.gz triggers it).
      # We publish explicitly + wait briefly for the rate-limit cooldown.
      - name: Ensure release is published (draft → published)
        if: always() && needs.plan.outputs.tag != ''
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -e
          sleep 60
          # Idempotent: sets draft=false and prerelease according to the tag.
          PRERELEASE_FLAG=""
          case "${{ needs.plan.outputs.tag }}" in
            *-*) PRERELEASE_FLAG="--prerelease" ;;
            *)   PRERELEASE_FLAG="--latest" ;;
          esac
          for attempt in 1 2 3; do
            if gh release edit "${{ needs.plan.outputs.tag }}" \
                 --repo "${{ github.repository }}" \
                 --draft=false $PRERELEASE_FLAG; then
              echo "release published (attempt $attempt)"
              break
            fi
            echo "publish attempt $attempt failed, retrying in 30s..."
            sleep 30
          done
          # Verify
          gh release view "${{ needs.plan.outputs.tag }}" \
            --repo "${{ github.repository }}" \
            --json isDraft,assets \
            --jq '"  isDraft=\(.isDraft) assets=\(.assets | length)"'