release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always

defaults:
  run:
    shell: bash

jobs:
  build:
    name: Build (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            artifact: agnix
          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            artifact: agnix
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            artifact: agnix
            cross: true
          - os: macos-latest
            target: aarch64-apple-darwin
            artifact: agnix
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact: agnix.exe

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install musl tools
        if: matrix.target == 'x86_64-unknown-linux-musl'
        run: sudo apt-get update && sudo apt-get install -y musl-tools

      - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
        with:
          key: release-${{ matrix.target }}
          save-if: ${{ startsWith(github.ref, 'refs/tags/') }}

      - name: Install cross
        if: matrix.cross
        uses: taiki-e/install-action@2723513a70062521fb56e5df87a04967751efd2f # v2.68.4
        with:
          tool: cross@0.2.5

      - name: Build release binary
        if: ${{ !matrix.cross }}
        run: cargo build --release --target ${{ matrix.target }} -p agnix-cli -p agnix-lsp -p agnix-mcp

      - name: Build release binary (cross)
        if: matrix.cross
        run: cross build --release --target ${{ matrix.target }} -p agnix-cli -p agnix-lsp -p agnix-mcp

      - name: Create CLI archive (Unix)
        if: runner.os != 'Windows'
        run: |
          set -euo pipefail
          cd target/${{ matrix.target }}/release
          tar czvf ../../../agnix-${{ matrix.target }}.tar.gz ${{ matrix.artifact }}
          cd ../../..
          shasum -a 256 agnix-${{ matrix.target }}.tar.gz > agnix-${{ matrix.target }}.tar.gz.sha256

      - name: Create LSP archive (Unix)
        if: runner.os != 'Windows'
        run: |
          set -euo pipefail
          cd target/${{ matrix.target }}/release
          if [ -f agnix-lsp ]; then
            tar czvf ../../../agnix-lsp-${{ matrix.target }}.tar.gz agnix-lsp
            cd ../../..
            shasum -a 256 agnix-lsp-${{ matrix.target }}.tar.gz > agnix-lsp-${{ matrix.target }}.tar.gz.sha256
          fi

      - name: Create CLI archive (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          cd target/${{ matrix.target }}/release
          Compress-Archive -Path ${{ matrix.artifact }} -DestinationPath ../../../agnix-${{ matrix.target }}.zip
          cd ../../..
          (Get-FileHash agnix-${{ matrix.target }}.zip -Algorithm SHA256).Hash.ToLower() + "  agnix-${{ matrix.target }}.zip" | Out-File -Encoding ASCII agnix-${{ matrix.target }}.zip.sha256

      - name: Create LSP archive (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          cd target/${{ matrix.target }}/release
          if (Test-Path agnix-lsp.exe) {
            Compress-Archive -Path agnix-lsp.exe -DestinationPath ../../../agnix-lsp-${{ matrix.target }}.zip
            cd ../../..
            (Get-FileHash agnix-lsp-${{ matrix.target }}.zip -Algorithm SHA256).Hash.ToLower() + "  agnix-lsp-${{ matrix.target }}.zip" | Out-File -Encoding ASCII agnix-lsp-${{ matrix.target }}.zip.sha256
          }

      - name: Create MCP archive (Unix)
        if: runner.os != 'Windows'
        run: |
          set -euo pipefail
          cd target/${{ matrix.target }}/release
          if [ -f agnix-mcp ]; then
            tar czvf ../../../agnix-mcp-${{ matrix.target }}.tar.gz agnix-mcp
            cd ../../..
            shasum -a 256 agnix-mcp-${{ matrix.target }}.tar.gz > agnix-mcp-${{ matrix.target }}.tar.gz.sha256
          fi

      - name: Create MCP archive (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          cd target/${{ matrix.target }}/release
          if (Test-Path agnix-mcp.exe) {
            Compress-Archive -Path agnix-mcp.exe -DestinationPath ../../../agnix-mcp-${{ matrix.target }}.zip
            cd ../../..
            (Get-FileHash agnix-mcp-${{ matrix.target }}.zip -Algorithm SHA256).Hash.ToLower() + "  agnix-mcp-${{ matrix.target }}.zip" | Out-File -Encoding ASCII agnix-mcp-${{ matrix.target }}.zip.sha256
          }

      - name: Upload artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: agnix-${{ matrix.target }}
          path: |
            agnix-${{ matrix.target }}.*
            agnix-lsp-${{ matrix.target }}.*
            agnix-mcp-${{ matrix.target }}.*
          if-no-files-found: error

  release:
    name: Create Release
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Download all artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: artifacts
          merge-multiple: true

      - name: Generate release notes
        id: notes
        run: |
          set -euo pipefail
          VERSION=${GITHUB_REF#refs/tags/}
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

          # Extract changelog section for this version
          if grep -q "## \[${VERSION#v}\]" CHANGELOG.md 2>/dev/null; then
            sed -n "/## \[${VERSION#v}\]/,/## \[/p" CHANGELOG.md | sed '1d;$d' > release_notes.md
          else
            echo "Release $VERSION" > release_notes.md
          fi

      - name: Create GitHub Release
        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
        with:
          name: ${{ steps.notes.outputs.version }}
          body_path: release_notes.md
          files: artifacts/*
          draft: false
          prerelease: ${{ contains(github.ref, '-') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  publish:
    name: Publish to crates.io
    needs: build
    runs-on: ubuntu-latest
    # Skip prereleases (tags with hyphens like v0.1.0-beta)
    if: ${{ !contains(github.ref, '-') }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable

      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2

      - name: Verify version matches tag
        id: version
        run: |
          set -euo pipefail
          TAG_VERSION=${GITHUB_REF#refs/tags/v}
          CARGO_VERSION=$(sed -n '/\[workspace\.package\]/,/^\[/p' Cargo.toml | grep '^version' | head -1 | sed 's/.*"\(.*\)".*/\1/')
          if [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
            echo "Error: Tag version ($TAG_VERSION) doesn't match Cargo.toml version ($CARGO_VERSION)"
            exit 1
          fi
          echo "version=$TAG_VERSION" >> "$GITHUB_OUTPUT"

      - name: Create crate indexing wait helper
        run: |
          set -euo pipefail
          cat > /tmp/wait-for-crate.sh << 'SCRIPT'
          #!/usr/bin/env bash
          set -euo pipefail
          if [ $# -ne 2 ]; then
            echo "Usage: $0 <crate> <version>" >&2
            exit 1
          fi
          crate="$1"
          version="$2"
          # crates.io indexing is typically <60s, allow 5 min (30 x 10s) for high-load scenarios
          max_retries=30
          interval=10
          echo "Waiting for $crate $version to appear on crates.io index..."
          for i in $(seq 1 $max_retries); do
            output=$(cargo search "$crate" --limit 1 2>&1) || {
              if [ "$i" -lt "$max_retries" ]; then
                echo "Attempt $i/$max_retries: cargo search failed, retrying in ${interval}s..."
                sleep "$interval"
                continue
              else
                echo "Attempt $i/$max_retries: cargo search failed, no retries left."
                break
              fi
            }
            if echo "$output" | grep -qF "$crate = \"$version\""; then
              echo "$crate $version indexed after $(((i - 1) * interval))s"
              exit 0
            fi
            if [ "$i" -lt "$max_retries" ]; then
              echo "Attempt $i/$max_retries: $crate $version not yet indexed, retrying in ${interval}s..."
              sleep "$interval"
            fi
          done
          echo "Error: $crate $version not indexed after $((max_retries * interval))s"
          exit 1
          SCRIPT
          chmod +x /tmp/wait-for-crate.sh

      # Publish order: agnix-rules (leaf) -> agnix-core -> agnix-cli/agnix-lsp/agnix-mcp
      # Each step tolerates "already exists" errors so re-runs work correctly
      - name: Publish agnix-rules
        run: |
          set -euo pipefail
          VERSION="${{ steps.version.outputs.version }}"
          cargo publish -p agnix-rules 2>&1 || {
            if cargo search agnix-rules --limit 1 | grep -qF "agnix-rules = \"$VERSION\""; then
              echo "agnix-rules $VERSION already published, skipping"
            else
              echo "Publish failed and crate not found on crates.io"
              exit 1
            fi
          }
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

      - name: Wait for agnix-rules indexing
        run: /tmp/wait-for-crate.sh agnix-rules ${{ steps.version.outputs.version }}

      - name: Publish agnix-core
        run: |
          set -euo pipefail
          VERSION="${{ steps.version.outputs.version }}"
          cargo publish -p agnix-core 2>&1 || {
            if cargo search agnix-core --limit 1 | grep -qF "agnix-core = \"$VERSION\""; then
              echo "agnix-core $VERSION already published, skipping"
            else
              echo "Publish failed and crate not found on crates.io"
              exit 1
            fi
          }
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

      - name: Wait for agnix-core indexing
        run: /tmp/wait-for-crate.sh agnix-core ${{ steps.version.outputs.version }}

      - name: Publish agnix-cli
        run: |
          set -euo pipefail
          VERSION="${{ steps.version.outputs.version }}"
          cargo publish -p agnix-cli 2>&1 || {
            if cargo search agnix-cli --limit 1 | grep -qF "agnix-cli = \"$VERSION\""; then
              echo "agnix-cli $VERSION already published, skipping"
            else
              echo "Publish failed and crate not found on crates.io"
              exit 1
            fi
          }
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

      - name: Publish agnix-lsp
        run: |
          set -euo pipefail
          VERSION="${{ steps.version.outputs.version }}"
          cargo publish -p agnix-lsp 2>&1 || {
            if cargo search agnix-lsp --limit 1 | grep -qF "agnix-lsp = \"$VERSION\""; then
              echo "agnix-lsp $VERSION already published, skipping"
            else
              echo "Publish failed and crate not found on crates.io"
              exit 1
            fi
          }
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

      - name: Publish agnix-mcp
        run: |
          set -euo pipefail
          VERSION="${{ steps.version.outputs.version }}"
          cargo publish -p agnix-mcp 2>&1 || {
            if cargo search agnix-mcp --limit 1 | grep -qF "agnix-mcp = \"$VERSION\""; then
              echo "agnix-mcp $VERSION already published, skipping"
            else
              echo "Publish failed and crate not found on crates.io"
              exit 1
            fi
          }
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  vscode:
    name: Publish VS Code Extension
    needs: build
    runs-on: ubuntu-latest
    # Skip prereleases
    if: ${{ !contains(github.ref, '-') }}
    defaults:
      run:
        shell: bash
        working-directory: editors/vscode
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm ci

      - name: Sync all versions from tag
        working-directory: .
        run: |
          set -euo pipefail
          TAG_VERSION="${GITHUB_REF#refs/tags/v}"
          bash scripts/sync-versions.sh "${TAG_VERSION}"

      - name: Compile extension
        run: npm run compile -- --production

      - name: Package extension
        run: npx vsce package

      - name: Publish to VS Code Marketplace
        run: npx vsce publish
        env:
          VSCE_PAT: ${{ secrets.VSCE_PAT }}

      - name: Upload VSIX artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: vscode-extension
          path: editors/vscode/*.vsix

  npm:
    name: Publish npm Package
    needs: release
    runs-on: ubuntu-latest
    # Skip prereleases
    if: ${{ !contains(github.ref, '-') }}
    defaults:
      run:
        shell: bash
        working-directory: npm
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'

      - name: Sync all versions from tag
        working-directory: .
        run: |
          set -euo pipefail
          TAG_VERSION="${GITHUB_REF#refs/tags/v}"
          bash scripts/sync-versions.sh "${TAG_VERSION}"

      - name: Publish to npm
        run: npm publish --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  jetbrains:
    name: Publish JetBrains Plugin
    needs: release
    runs-on: ubuntu-latest
    if: ${{ !contains(github.ref, '-') }}
    defaults:
      run:
        shell: bash
        working-directory: editors/jetbrains
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v4
        with:
          distribution: 'temurin'
          java-version: '17'

      - name: Sync version from tag
        working-directory: .
        run: |
          set -euo pipefail
          TAG_VERSION="${GITHUB_REF#refs/tags/v}"
          bash scripts/sync-versions.sh "${TAG_VERSION}"

      - name: Build and publish plugin
        run: ./gradlew publishPlugin
        env:
          PUBLISH_TOKEN: ${{ secrets.PUBLISH_TOKEN }}

  zed:
    name: Publish Zed Extension
    needs: release
    runs-on: ubuntu-latest
    if: ${{ !contains(github.ref, '-') }}
    steps:
      - uses: huacnlee/zed-extension-action@8cd592a0d24e1e41157740f1a529aeabddc88a1b # v2
        with:
          extension-name: agnix
          push-to: avifenesh/extensions
        env:
          COMMITTER_TOKEN: ${{ secrets.COMMITTER_TOKEN }}

  version-docs:
    name: Version Docs & Push to Main
    needs: release
    runs-on: ubuntu-latest
    if: ${{ !contains(github.ref, '-') }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: main
          fetch-depth: 0
          token: ${{ secrets.COMMITTER_TOKEN }}

      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: '20'

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.x'

      - name: Extract and validate version from tag
        id: version
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF#refs/tags/v}"
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Invalid version format: $VERSION"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Install website dependencies
        run: npm --prefix website ci

      - name: Regenerate site data and rule docs
        run: python3 scripts/generate-docs-rules.py

      - name: Verify site data was generated
        run: |
          set -euo pipefail
          if [ ! -f website/src/data/siteData.json ]; then
            echo "siteData.json was not generated"
            exit 1
          fi
          python3 -c "import json; json.load(open('website/src/data/siteData.json'))"

      - name: Cut versioned docs snapshot
        run: npm --prefix website run version:cut -- "${{ steps.version.outputs.version }}"

      - name: Commit and push versioned docs
        env:
          GH_TOKEN: ${{ secrets.COMMITTER_TOKEN }}
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add website/src/data/siteData.json website/docs/rules/ website/versioned_docs/ website/versioned_sidebars/ website/versions.json
          if git diff --cached --quiet; then
            echo "No changes to commit"
          else
            BRANCH="docs/version-${{ steps.version.outputs.version }}"
            git checkout -b "$BRANCH"
            git commit -m "docs: version ${{ steps.version.outputs.version }} docs and update site data"
            git push origin "$BRANCH"
            gh pr create \
              --base main \
              --head "$BRANCH" \
              --title "docs: version ${{ steps.version.outputs.version }} docs" \
              --body "Auto-generated versioned docs snapshot for v${{ steps.version.outputs.version }}." \
              --label "documentation"
          fi