release.yml

name: Release

on:
  push:
    tags:
      - "[0-9]+.*"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            os: macos-14
          - target: x86_64-apple-darwin
            os: macos-15-intel
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-22.04
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-22.04-arm
          - target: x86_64-pc-windows-msvc
            os: windows-latest
    runs-on: ${{ matrix.os }}
    timeout-minutes: 45
    defaults:
      run:
        shell: bash
    env:
      TARGET: ${{ matrix.target }}
      PYTHON: ${{ startsWith(matrix.os, 'windows') && 'python' || 'python3' }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.10
      - uses: dtolnay/rust-toolchain@stable
      - name: Build and package
        env:
          RELEASE_TAG: ${{ github.ref_type == 'tag' && github.ref_name || '' }}
        run: |
          version=$(cargo metadata --no-deps --format-version 1 | "$PYTHON" -c 'import json, sys; print(next(p["version"] for p in json.load(sys.stdin)["packages"] if p["name"] == "diffr-cli"), end="")')
          if [ -n "$RELEASE_TAG" ] && [ "$RELEASE_TAG" != "$version" ]; then
            echo "Tag $RELEASE_TAG does not match Cargo version $version" >&2
            exit 1
          fi
          echo "VERSION=$version" >> "$GITHUB_ENV"
          cargo xtask install --root "$RUNNER_TEMP/install"
          "$PYTHON" scripts/release.py pack --version "$version" --target "$TARGET" --install "$RUNNER_TEMP/install" --output dist
      - name: Verify extracted archives without Bun or checkout assets
        run: |
          # The TUI smoke test drives a Unix PTY.
          if [ "$RUNNER_OS" != Windows ]; then
            mkdir -p "$RUNNER_TEMP/extracted/bin"
            tar -xzf "dist/diffr-$VERSION-$TARGET.tar.gz" -C "$RUNNER_TEMP/extracted/bin"
            "$PYTHON" xtask/tests/smoke_install.py "$RUNNER_TEMP/extracted"
          fi
          "$PYTHON" scripts/smoke_cli_archive.py "dist/diffr-cli-$VERSION-$TARGET.tar.gz" "$VERSION"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: ${{ matrix.target }}
          path: dist/*.tar.gz
          if-no-files-found: error

  prepare:
    needs: build
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          path: dist
          merge-multiple: true
      - name: Generate checksums and Homebrew formula
        run: |
          version=$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -1)
          python3 scripts/release.py formula --version "$version" --output dist
          (cd dist && sha256sum --check SHA256SUMS)
          ruby -c dist/diffr.rb
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: release
          path: dist/*
          if-no-files-found: error

  homebrew:
    needs: prepare
    strategy:
      fail-fast: false
      matrix:
        os: [macos-14, macos-15-intel, ubuntu-22.04, ubuntu-22.04-arm]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    env:
      HOMEBREW_NO_AUTO_UPDATE: '1'
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: release
          path: dist
      - name: Install and test the formula against staged archives
        shell: bash
        run: |
          if [ -x /home/linuxbrew/.linuxbrew/bin/brew ]; then
            eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
          fi
          tap="$(brew --repository)/Library/Taps/devdotfast/homebrew-tap"
          mkdir -p "$tap/Formula"
          python3 - "$tap/Formula/diffr.rb" <<'PYTHON'
          from pathlib import Path
          import re
          import sys
          formula = Path("dist/diffr.rb").read_text()
          formula = re.sub(r'https://github.com/devdotfast/diffr/releases/download/[^/]+/', Path("dist").resolve().as_uri() + "/", formula)
          Path(sys.argv[1]).write_text(formula)
          PYTHON
          brew install devdotfast/tap/diffr
          brew test devdotfast/tap/diffr
          python3 - "$tap/Formula/diffr.rb" <<'PYTHON'
          from pathlib import Path
          import sys
          path = Path(sys.argv[1])
          path.write_text(path.read_text().replace('  license ', '  revision 1\n  license ', 1))
          PYTHON
          brew upgrade devdotfast/tap/diffr
          brew test devdotfast/tap/diffr
          python3 xtask/tests/smoke_install.py "$(brew --prefix devdotfast/tap/diffr)"
          brew uninstall devdotfast/tap/diffr

  packaging:
    name: Release packaging
    if: always()
    needs: [build, prepare, homebrew]
    runs-on: ubuntu-22.04
    steps:
      - name: Require all packaging checks to pass
        env:
          BUILD: ${{ needs.build.result }}
          PREPARE: ${{ needs.prepare.result }}
          HOMEBREW: ${{ needs.homebrew.result }}
        run: test "$BUILD" = success && test "$PREPARE" = success && test "$HOMEBREW" = success

  publish:
    if: github.event_name == 'push' && github.ref_type == 'tag'
    needs: packaging
    permissions:
      contents: write
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: release
          path: dist
      - name: Publish complete release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          gh release create "$RELEASE_TAG" dist/* --verify-tag --draft --title "$RELEASE_TAG" --generate-notes
          gh release edit "$RELEASE_TAG" --draft=false --latest

  npm:
    needs: publish
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.10
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: release
          path: dist
      - name: Publish platform packages, then @dev.fast/diffr
        env:
          VERSION: ${{ github.ref_name }}
          # Unset once npm trusted publishing is configured for every package.
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          (cd diffr-ts && bun install --frozen-lockfile)
          python3 scripts/release.py npm --version "$VERSION" --dist dist --output npm
          for package in npm/*/ diffr-ts/; do
            name=$(node -p "require('./${package}package.json').name")
            if npm view "$name@$VERSION" version >/dev/null 2>&1; then
              echo "$name@$VERSION is already published"
            else
              npm publish "$package" --provenance --access public
            fi
          done

  npm-smoke:
    needs: npm
    strategy:
      fail-fast: false
      matrix:
        os: [macos-14, macos-15-intel, ubuntu-22.04, ubuntu-22.04-arm, windows-latest]
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 24
      - name: Install from npm and run the platform binary
        env:
          VERSION: ${{ github.ref_name }}
        run: |
          cd "$RUNNER_TEMP"
          npm init -y >/dev/null
          for _ in 1 2 3 4 5 6; do
            npm install --no-audit --no-fund "@dev.fast/diffr@$VERSION" zod && break
            sleep 20
          done
          node --input-type=module -e "
            import { execFileSync } from 'node:child_process';
            import { diffrBinaryPath } from '@dev.fast/diffr';
            const binary = diffrBinaryPath();
            if (!binary) throw new Error('no platform package installed');
            const version = execFileSync(binary, ['--version'], { encoding: 'utf8' }).trim();
            if (version !== 'diffr $VERSION') throw new Error(version);
            console.log(binary, version);
          "