release.yml

name: Release

# Triggered when a `v*` tag is pushed (e.g. `v0.1.0`, `v0.2.0-rc.1`).
# Builds the workspace + chat-ui on each supported platform, packages the
# binaries into a tarball, and attaches them to a GitHub release.
#
# Note: cc-connect is not currently published to crates.io because of the
# vendored ed25519 patch (see TODOS.md). When that patch is dropped, add a
# `cargo publish` step here gated on the version not being a pre-release.

on:
  push:
    tags:
      # `v[0-9]*` anchors the leading `v` to a digit, so this matcher
      # does NOT collide with `vscode-extension-v*` (which would
      # otherwise match the unanchored `v*.*.*` pattern and double-
      # trigger this workflow on every extension release).
      - "v[0-9]*.*.*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to release (e.g. v0.1.0). Must already exist on origin."
        required: true

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    name: build (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            archive: tar.gz
          - os: macos-latest
            target: aarch64-apple-darwin
            archive: tar.gz
          # macos-13 (Apple Intel x86_64) was dropped 2026-05-06:
          # GitHub's public macos-13 runner pool sustains multi-hour
          # queues for tagged releases that consistently blocked the
          # release job. Apple Intel ≤ 2020 is rare enough among
          # cc-connect's audience that requiring those users to set
          # CC_CONNECT_FROM_SOURCE=1 in bootstrap.sh is a worthwhile
          # tradeoff. If Apple Intel runner availability recovers (or
          # we run a self-hosted Intel mac), re-add the matrix entry.
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.tag || github.ref }}

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          key: release-${{ matrix.target }}

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Build Rust workspace
        run: cargo build --workspace --release --target ${{ matrix.target }}

      - name: Build chat-ui
        working-directory: chat-ui
        run: |
          bun install --frozen-lockfile
          bun build src/main.tsx --compile --outfile=../target/${{ matrix.target }}/release/cc-chat-ui

      - name: Package
        id: pkg
        shell: bash
        run: |
          ref="${{ github.event.inputs.tag || github.ref_name }}"
          version="${ref#v}"
          name="cc-connect-${version}-${{ matrix.target }}"
          mkdir -p "dist/${name}"
          # All five binaries the workspace produces. install.sh
          # hard-requires cc-connect-mcp (line ~210) and warns if
          # cc-connect-tui is missing (line ~393), so ship both.
          for bin in cc-connect cc-connect-tui cc-connect-hook cc-connect-mcp cc-chat-ui; do
            cp "target/${{ matrix.target }}/release/${bin}" "dist/${name}/"
          done
          # install.sh — bootstrap.sh's tarball path runs it with
          # `--skip-build` to register the hook + MCP server. Bundling
          # it here keeps the tarball self-contained (no second curl
          # to raw.githubusercontent.com needed at install time).
          cp install.sh "dist/${name}/"
          cp README.md LICENSE-MIT LICENSE-APACHE SECURITY.md "dist/${name}/"
          cd dist && tar -czf "${name}.tar.gz" "${name}"
          shasum -a 256 "${name}.tar.gz" > "${name}.tar.gz.sha256"
          echo "name=${name}" >> "$GITHUB_OUTPUT"

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.pkg.outputs.name }}
          path: |
            dist/*.tar.gz
            dist/*.sha256
          if-no-files-found: error

  release:
    name: GitHub release
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.tag || github.ref }}

      - uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
          draft: false
          prerelease: ${{ contains(github.event.inputs.tag || github.ref_name, '-') }}
          generate_release_notes: true
          files: |
            dist/*.tar.gz
            dist/*.sha256
          body: |
            ## Install

            Download the tarball for your platform below, extract, and put the binaries on your `PATH`. Or run the installer from a fresh clone:

            ```bash
            git clone https://github.com/Minara-AI/cc-connect.git
            cd cc-connect
            git checkout ${{ github.event.inputs.tag || github.ref_name }}
            ./install.sh
            ```

            See [`SECURITY.md`](https://github.com/Minara-AI/cc-connect/blob/${{ github.event.inputs.tag || github.ref_name }}/SECURITY.md) before inviting anyone to a Room.

            ## Verify

            Each tarball ships with a sibling `.sha256` file:

            ```bash
            shasum -a 256 -c cc-connect-*.tar.gz.sha256
            ```