release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to build (e.g. v0.1.0)'
        required: true
        type: string

env:
  # jmax-cli lives at crates/jmax-cli inside the standalone jmax-core workspace.
  BIN_NAME: jmax
  RELEASE_NAME: jmax
  # The private "openie" cargo registry hosts the flowG substrate crates
  # (flowg-emit-*, flowg-ingest-*, lux-flowg, joule-web) that jmax-cli links.
  # Defining it here lets cargo resolve those deps; the token authenticates
  # index reads + downloads. registry.openie.dev is publicly reachable.
  CARGO_REGISTRIES_OPENIE_INDEX: "sparse+https://registry.openie.dev/api/v1/crates/"
  CARGO_REGISTRIES_OPENIE_TOKEN: ${{ secrets.OPENIE_REGISTRY_TOKEN }}

jobs:
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-apple-darwin
            os: macos-14
            archive: tar.gz
          - target: aarch64-apple-darwin
            os: macos-14
            archive: tar.gz
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            archive: tar.gz
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-24.04-arm
            archive: tar.gz
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            archive: zip

    steps:
      - name: Resolve tag
        id: tag
        shell: bash
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
          else
            echo "tag=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout public release surface
        uses: actions/checkout@v4

      - name: Checkout standalone source (jmax-core)
        uses: actions/checkout@v4
        with:
          repository: openIE-dev/jmax-core
          token: ${{ secrets.JMAX_CORE_READ_TOKEN }}
          path: jmax-core
          ref: ${{ steps.tag.outputs.tag }}

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install protoc
        # The flowG substrate crates (flowg-emit-*) build .proto via prost-build,
        # which needs the protobuf compiler on every runner.
        uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build
        shell: bash
        working-directory: jmax-core
        run: |
          # --locked: build the exact versions in jmax-core's committed Cargo.lock
          # (reproducible; without it a fresh resolve can pick a different patch of
          # a substrate crate and regress a platform, e.g. an un-Windows-fixed dep).
          cargo build --locked --release --target ${{ matrix.target }} -p jmax-cli

      - name: Package
        shell: bash
        run: |
          STAGE=$(mktemp -d)
          TAG="${{ steps.tag.outputs.tag }}"
          BASE="${RELEASE_NAME}-${TAG#v}-${{ matrix.target }}"
          mkdir -p "$STAGE/$BASE"

          if [ "${{ matrix.target }}" = "x86_64-pc-windows-msvc" ]; then
            cp "jmax-core/target/${{ matrix.target }}/release/${BIN_NAME}.exe" "$STAGE/$BASE/"
          else
            cp "jmax-core/target/${{ matrix.target }}/release/${BIN_NAME}" "$STAGE/$BASE/"
          fi

          cp LICENSE README.md "$STAGE/$BASE/" 2>/dev/null || true

          # shasum (perl) exists on macOS/Linux runners but not Windows git-bash,
          # which ships sha256sum instead. Pick whichever is present.
          sha256() { if command -v shasum >/dev/null 2>&1; then shasum -a 256 "$1"; else sha256sum "$1"; fi; }

          cd "$STAGE"
          if [ "${{ matrix.archive }}" = "zip" ]; then
            (cd "$BASE" && 7z a -tzip "../${BASE}.zip" .)
            mv "${BASE}.zip" "${{ github.workspace }}/"
            (cd "${{ github.workspace }}" && sha256 "${BASE}.zip" > "${BASE}.zip.sha256")
          else
            tar czf "${BASE}.tar.gz" "$BASE"
            mv "${BASE}.tar.gz" "${{ github.workspace }}/"
            (cd "${{ github.workspace }}" && sha256 "${BASE}.tar.gz" > "${BASE}.tar.gz.sha256")
          fi

          ls -la "${{ github.workspace }}"/*${BASE}*

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.RELEASE_NAME }}-${{ matrix.target }}
          path: |
            ${{ env.RELEASE_NAME }}-*-${{ matrix.target }}.tar.gz*
            ${{ env.RELEASE_NAME }}-*-${{ matrix.target }}.zip*

  release:
    name: Publish Release
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Collect
        run: |
          mkdir -p dist
          find artifacts -type f \( -name '*.tar.gz' -o -name '*.zip' -o -name '*.sha256' \) -exec mv {} dist/ \;
          ls -la dist/

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: dist/*
          generate_release_notes: true
          fail_on_unmatched_files: true