release.yml

name: Release

on:
  workflow_call:
    inputs:
      ref:
        description: Git revision containing the release packages
        required: true
        type: string
      tag:
        description: GitHub Release tag created by release-please
        required: true
        type: string
      commit:
        description: Release commit used for version identity
        required: true
        type: string
    secrets:
      GH_TOKEN:
        description: Dedicated cross-repository token with write access to wrightkit/homebrew-tap
        required: true
      NPM_TOKEN:
        description: Optional npmjs.org publication token
        required: false

permissions:
  contents: write
  id-token: write
  packages: write

jobs:
  release-gates:
    name: Release gates
    runs-on: ubuntu-latest
    env:
      RELEASE_TAG: ${{ inputs.tag }}
      RELEASE_COMMIT: ${{ inputs.commit }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v7
        with:
          ref: ${{ env.RELEASE_TAG }}
          fetch-depth: 0

      - name: Verify release revision and tag identity
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.tag }}
          RELEASE_COMMIT: ${{ inputs.commit }}
        run: |
          set -euo pipefail
          test "$(git rev-parse HEAD)" = "${RELEASE_COMMIT}"
          tag_commit="$(gh api \
            "repos/${GITHUB_REPOSITORY}/commits/${RELEASE_TAG}" \
            --jq .sha)"
          test "${tag_commit}" = "${RELEASE_COMMIT}"

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable
          components: clippy, rustfmt

      - name: Verify tag version matches the workspace implementation version
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"
          PACKAGE_VERSION="$(cargo metadata --locked --no-deps --format-version 1 | \
            python3 -c 'import json, sys; print(next(p["version"] for p in json.load(sys.stdin)["packages"] if p["name"] == "wright-cli"))')"
          if [[ "$VERSION" != "$PACKAGE_VERSION" ]]; then
            echo "tag $RELEASE_TAG does not match the workspace implementation version $PACKAGE_VERSION"
            exit 1
          fi
          echo "workspace version $PACKAGE_VERSION matches tag $RELEASE_TAG"

      - name: Run release gates (fmt, clippy, tests, v1 gates, scenarios, benchmarks, standalone proof)
        run: scripts/release.sh "${RELEASE_TAG#v}"

      - name: Verify checked-in distribution metadata
        run: python3 scripts/verify-dist.py

      - name: Upload gate reports
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: release-gate-reports
          path: |
            target/v1-gates-report.json
            target/scenarios-report.json
            target/wright-bench-report.json

  build:
    name: Build ${{ matrix.target }}
    needs: release-gates
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            ext: tar.gz
          - os: macos-15-intel
            target: x86_64-apple-darwin
            ext: tar.gz
          - os: macos-15
            target: aarch64-apple-darwin
            ext: tar.gz
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            ext: zip
    defaults:
      run:
        shell: bash
    env:
      RELEASE_TAG: ${{ inputs.tag }}
      TARGET: ${{ matrix.target }}
      EXT: ${{ matrix.ext }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable

      - name: Add cross-compile target
        run: rustup target add "$TARGET"

      - name: Build release binaries
        run: cargo build --locked --release -p wright-cli -p wright-lsp --target "$TARGET"

      - name: Package archive with version stamp
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"
          PAYLOAD="wright-$VERSION-$TARGET"
          mkdir -p "dist/$PAYLOAD"
          scripts/make-version-stamp.sh "$VERSION" "dist/$PAYLOAD/version.json"
          if [[ "$RUNNER_OS" == "Windows" ]]; then EXE=".exe"; else EXE=""; fi
          cp "target/$TARGET/release/wright$EXE" "dist/$PAYLOAD/"
          cp "target/$TARGET/release/wright-lsp$EXE" "dist/$PAYLOAD/"
          if [[ "$EXT" == "zip" ]]; then
            (cd dist && pwsh -NoLogo -NoProfile -NonInteractive -Command \
              "Compress-Archive -Path '$PAYLOAD' -DestinationPath '$PAYLOAD.zip' -Force")
          else
            (cd dist && tar -czf "$PAYLOAD.tar.gz" "$PAYLOAD")
          fi
          if command -v sha256sum >/dev/null 2>&1; then
            (cd dist && sha256sum "$PAYLOAD.$EXT" > "$PAYLOAD.$EXT.sha256")
          else
            (cd dist && shasum -a 256 "$PAYLOAD.$EXT" > "$PAYLOAD.$EXT.sha256")
          fi
          ls -l dist/

      - name: Smoke test the packaged archive
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"
          PAYLOAD="wright-$VERSION-$TARGET"
          if [[ "$EXT" == "zip" ]]; then
            EXTRACT="dist/smoke-extract"
            pwsh -NoLogo -NoProfile -NonInteractive -Command \
              "Expand-Archive -LiteralPath 'dist/$PAYLOAD.$EXT' -DestinationPath '$EXTRACT' -Force"
          else
            EXTRACT="$(mktemp -d)"
            tar -xf "dist/$PAYLOAD.$EXT" -C "$EXTRACT"
          fi
          if [[ "$RUNNER_OS" == "Windows" ]]; then EXE=".exe"; else EXE=""; fi
          WRIGHT="$EXTRACT/$PAYLOAD/wright$EXE"
          LSP="$EXTRACT/$PAYLOAD/wright-lsp$EXE"
          test -f "$WRIGHT" || { echo "missing $WRIGHT"; exit 1; }
          test -f "$LSP" || { echo "missing $LSP"; exit 1; }
          "$WRIGHT" --version | grep -F "$VERSION" || { echo "wright does not report $VERSION"; exit 1; }
          "$LSP" --version | grep -F "$VERSION" || { echo "wright-lsp does not report $VERSION"; exit 1; }
          "$WRIGHT" compile compatibility/fixtures/synthetic/basic-rule/source.opy \
            --profile compat >/dev/null
          "$WRIGHT" check scenarios/loops.opy --profile compat >/dev/null
          echo "packaged $PAYLOAD executes and reports $VERSION"

      - name: Upload release artifacts
        uses: actions/upload-artifact@v7
        with:
          name: wright-${{ matrix.target }}
          path: |
            dist/wright-*.tar.gz
            dist/wright-*.tar.gz.sha256
            dist/wright-*.zip
            dist/wright-*.zip.sha256

  upload-artifacts:
    name: Upload native release artifacts
    needs: build
    runs-on: ubuntu-latest
    env:
      RELEASE_TAG: ${{ inputs.tag }}
    steps:
      - name: Download release artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: wright-*
          path: artifacts

      - name: Verify the complete artifact set
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"
          mkdir -p release
          for triple in x86_64-unknown-linux-gnu x86_64-apple-darwin aarch64-apple-darwin x86_64-pc-windows-msvc; do
            ext="tar.gz"
            [[ "$triple" == "x86_64-pc-windows-msvc" ]] && ext="zip"
            archive="wright-$VERSION-$triple.$ext"
            test -f "artifacts/wright-$triple/$archive" || { echo "missing $archive"; exit 1; }
            test -f "artifacts/wright-$triple/$archive.sha256" || { echo "missing $archive.sha256"; exit 1; }
            cp "artifacts/wright-$triple/$archive" "release/"
            cp "artifacts/wright-$triple/$archive.sha256" "release/"
          done
          (cd release && sha256sum wright-*.tar.gz wright-*.zip > SHA256SUMS)
          ls -l release/

      - name: Verify the release-please draft Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          release="$(gh release view "${RELEASE_TAG}" \
            --repo "${GITHUB_REPOSITORY}" \
            --json tagName,isDraft,isImmutable,url)"
          echo "${release}"
          test "$(jq -r .tagName <<<"${release}")" = "${RELEASE_TAG}"
          test "$(jq -r .isDraft <<<"${release}")" = "true"

      - name: Attach native archives and checksums
        env:
          GH_TOKEN: ${{ github.token }}
        run: >-
          gh release upload "${RELEASE_TAG}" release/* --clobber
          --repo "${GITHUB_REPOSITORY}"

  package-manifests:
    name: Generate package-manager manifests
    needs: upload-artifacts
    runs-on: ubuntu-latest
    env:
      RELEASE_TAG: ${{ inputs.tag }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 0

      - name: Download release artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: wright-*
          path: artifacts

      - name: Generate manifests from the published checksums
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"
          for triple in x86_64-unknown-linux-gnu aarch64-apple-darwin x86_64-apple-darwin x86_64-pc-windows-msvc; do
            ext="tar.gz"
            [[ "$triple" == "x86_64-pc-windows-msvc" ]] && ext="zip"
            sha256_file="artifacts/wright-$triple/wright-$VERSION-$triple.$ext.sha256"
            test -f "$sha256_file" || { echo "missing $sha256_file"; exit 1; }
            hash="$(awk 'NR == 1 { print $1 }' "$sha256_file")"
            [[ "$hash" =~ ^[0-9a-f]{64}$ ]] || { echo "invalid hash in $sha256_file"; exit 1; }
            case "$triple" in
              x86_64-unknown-linux-gnu) linux_x64_hash="$hash" ;;
              aarch64-apple-darwin)     darwin_arm64_hash="$hash" ;;
              x86_64-apple-darwin)      darwin_x64_hash="$hash" ;;
              x86_64-pc-windows-msvc)   windows_x64_hash="$hash" ;;
            esac
            echo "$triple: $hash"
          done
          python3 scripts/update-dist-manifests.py \
            --version "$VERSION" \
            --linux-x64-hash "$linux_x64_hash" \
            --darwin-arm64-hash "$darwin_arm64_hash" \
            --darwin-x64-hash "$darwin_x64_hash" \
            --windows-x64-hash "$windows_x64_hash" \
            --out-dir "$GITHUB_WORKSPACE/manifests"
          mkdir -p "$GITHUB_WORKSPACE/attach"
          cp "$GITHUB_WORKSPACE/manifests/dist/homebrew/wright.rb" \
            "$GITHUB_WORKSPACE/attach/wright-$VERSION.homebrew.rb"
          cp "$GITHUB_WORKSPACE/manifests/dist/scoop/wright.json" \
            "$GITHUB_WORKSPACE/attach/wright-$VERSION.scoop.json"
          (cd "$GITHUB_WORKSPACE/manifests/dist/winget" && tar -a -cf "$GITHUB_WORKSPACE/attach/wright-$VERSION.winget.zip" manifests)
          ls -l "$GITHUB_WORKSPACE/attach"

      - name: Upload Homebrew formula for tap publication
        uses: actions/upload-artifact@v7
        with:
          name: homebrew-formula
          path: ${{ github.workspace }}/manifests/dist/homebrew/wright.rb
          if-no-files-found: error

      - name: Attach package-manager manifests to the draft Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: >-
          gh release upload "${RELEASE_TAG}" attach/* --clobber
          --repo "${GITHUB_REPOSITORY}"

  publish-tap:
    name: Publish formula to homebrew-tap
    needs:
      - package-manifests
      - publish-release
    runs-on: ubuntu-latest
    env:
      RELEASE_TAG: ${{ inputs.tag }}
    steps:
      - name: Download generated Homebrew formula
        uses: actions/download-artifact@v8
        with:
          name: homebrew-formula
          path: formula

      - name: Check out wrightkit/homebrew-tap
        uses: actions/checkout@v7
        with:
          repository: wrightkit/homebrew-tap
          ref: main
          # Only this cross-repository tap operation uses secrets.GH_TOKEN.
          token: ${{ secrets.GH_TOKEN }}
          path: tap

      - name: Update wright.rb and push to the tap
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"
          if [[ -z "${GH_TOKEN}" ]]; then
            echo "error: GH_TOKEN secret is not set." >&2
            echo "Add a fine-grained PAT with Contents: Read and write on" >&2
            echo "wrightkit/homebrew-tap as an Actions secret available to this repository." >&2
            exit 1
          fi
          cp formula/wright.rb tap/wright.rb
          cd tap
          if git diff --quiet -- wright.rb; then
            echo "wright.rb is already current for ${RELEASE_TAG}; nothing to push"
            exit 0
          fi
          git -c user.name="wrightkit-bot" \
              -c user.email="wrightkit-bot@users.noreply.github.com" \
              commit -m "Update wright formula to ${VERSION}" -- wright.rb
          git push origin HEAD
          echo "pushed wright.rb for ${RELEASE_TAG} to wrightkit/homebrew-tap"

  package-npm:
    name: Package npm distribution
    needs: upload-artifacts
    runs-on: ubuntu-latest
    env:
      RELEASE_TAG: ${{ inputs.tag }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 22
          registry-url: "https://registry.npmjs.org"

      - name: Download release artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: wright-*
          path: artifacts

      - name: Package npm distribution tarballs
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"
          python3 scripts/package-npm.py \
            --version "$VERSION" \
            --artifacts-dir artifacts \
            --out-dir "$GITHUB_WORKSPACE/npm-packages"
          ls -lh "$GITHUB_WORKSPACE/npm-packages"

      - name: Smoke test host npm package (Linux x64)
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"
          SANDBOX="$(mktemp -d)"
          cd "$SANDBOX"
          npm init -y
          PLATFORM_TB="$(ls "$GITHUB_WORKSPACE"/npm-packages/wrightkit-wright-linux-x64-*.tgz "$GITHUB_WORKSPACE"/npm-packages/*wright-linux-x64-*.tgz 2>/dev/null | head -n 1)"
          META_TB="$(ls "$GITHUB_WORKSPACE"/npm-packages/wrightkit-wright-[0-9]*.tgz "$GITHUB_WORKSPACE"/npm-packages/*wright-[0-9]*.tgz 2>/dev/null | head -n 1)"
          npm install "$PLATFORM_TB" "$META_TB"
          npx wright --version | grep -F "$VERSION"
          npx wright-lsp --version | grep -F "$VERSION"
          npx wright compile "$GITHUB_WORKSPACE/compatibility/fixtures/synthetic/basic-rule/source.opy" --profile compat >/dev/null
          npx wright check "$GITHUB_WORKSPACE/scenarios/loops.opy" --profile compat >/dev/null
          node -e '
            const { getBinaryPath, getPlatformPackageName } = require("@wrightkit/wright");
            const p = getBinaryPath("wright");
            console.log("Resolved:", p);
          '
          echo "npm packages smoke test passed on $(uname -s) $(uname -m)"

      - name: Attach npm tarballs to the draft Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: >-
          gh release upload "${RELEASE_TAG}" npm-packages/*.tgz --clobber
          --repo "${GITHUB_REPOSITORY}"

      - name: Upload npm tarballs for registry publishing
        uses: actions/upload-artifact@v7
        with:
          name: npm-packages
          path: npm-packages/*.tgz
          if-no-files-found: error

  publish-npm:
    name: Publish packages to npm registry
    needs:
      - package-npm
      - publish-release
    runs-on: ubuntu-latest
    env:
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
    steps:
      - name: Download npm tarballs
        uses: actions/download-artifact@v8
        with:
          name: npm-packages
          path: npm-packages

      - name: Set up Node.js for npmjs.org
        uses: actions/setup-node@v7
        with:
          node-version: 22
          registry-url: "https://registry.npmjs.org"

      - name: Publish to npmjs.org
        if: env.NPM_TOKEN != ''
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          set -euo pipefail
          publish_if_missing() {
            local pkg="$1"
            local metadata name version published
            metadata="$(tar -xOf "${pkg}" package/package.json)"
            name="$(node -e 'let s=""; process.stdin.on("data", c => s += c).on("end", () => process.stdout.write(JSON.parse(s).name))' <<<"${metadata}")"
            version="$(node -e 'let s=""; process.stdin.on("data", c => s += c).on("end", () => process.stdout.write(JSON.parse(s).version))' <<<"${metadata}")"
            published="$(npm view "${name}@${version}" version --registry=https://registry.npmjs.org 2>/dev/null || true)"
            if [[ "${published}" == "${version}" ]]; then
              echo "${name}@${version} is already published; skipping"
              return
            fi
            echo "Publishing ${pkg} to npmjs.org..."
            npm publish "${pkg}" --access public --provenance
          }
          for pkg in "$GITHUB_WORKSPACE"/npm-packages/*.tgz; do
            publish_if_missing "${pkg}"
          done

      - name: Skip npmjs.org publication
        if: env.NPM_TOKEN == ''
        run: echo "NPM_TOKEN is not configured; skipping npmjs.org publication."

  publish-github-packages:
    name: Publish packages to GitHub Packages
    needs:
      - package-npm
      - publish-release
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Download npm tarballs
        uses: actions/download-artifact@v8
        with:
          name: npm-packages
          path: npm-packages

      - name: Set up Node.js for GitHub Packages
        uses: actions/setup-node@v7
        with:
          node-version: 22
          registry-url: "https://npm.pkg.github.com"

      - name: Publish to GitHub Packages
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          publish_if_missing() {
            local pkg="$1"
            local metadata name version published
            metadata="$(tar -xOf "${pkg}" package/package.json)"
            name="$(node -e 'let s=""; process.stdin.on("data", c => s += c).on("end", () => process.stdout.write(JSON.parse(s).name))' <<<"${metadata}")"
            version="$(node -e 'let s=""; process.stdin.on("data", c => s += c).on("end", () => process.stdout.write(JSON.parse(s).version))' <<<"${metadata}")"
            published="$(npm view "${name}@${version}" version --registry=https://npm.pkg.github.com 2>/dev/null || true)"
            if [[ "${published}" == "${version}" ]]; then
              echo "${name}@${version} is already published; skipping"
              return
            fi
            echo "Publishing ${pkg} to GitHub Packages..."
            npm publish "${pkg}" \
              --registry=https://npm.pkg.github.com \
              --access public
          }
          for pkg in "$GITHUB_WORKSPACE"/npm-packages/*.tgz; do
            publish_if_missing "${pkg}"
          done

  publish-release:
    name: Publish completed GitHub Release
    needs:
      - package-manifests
      - package-npm
    runs-on: ubuntu-latest
    environment: release
    steps:
      - name: Publish the completed draft Release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.tag }}
        run: >-
          gh release edit "${RELEASE_TAG}" --draft=false --latest
          --repo "${GITHUB_REPOSITORY}"