release.yml

name: Release Shim Artifacts

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build-artifacts:
    name: Build Artifact (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
          - windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Normalize line endings on Windows
        if: runner.os == 'Windows'
        shell: bash
        run: |
          git config --local core.autocrlf false
          git config --local core.eol lf
          git reset --hard HEAD

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable branch commit (no semver tag)
        with:
          toolchain: stable

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
        with:
          workspaces: "shim -> target"

      - name: Set up protoc
        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
        with:
          version: "31.x"
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Rust shim (release)
        working-directory: shim
        run: cargo build --locked --release

      - name: Package release artifact and checksum
        shell: pwsh
        run: |
          $platform = switch ("${{ runner.os }}") {
            "Linux" { "linux" }
            "macOS" { "macos" }
            "Windows" { "windows" }
            default { throw "Unsupported OS: ${{ runner.os }}" }
          }

          $libName = switch ("${{ runner.os }}") {
            "Linux" { "libchroma_go_shim.so" }
            "macOS" { "libchroma_go_shim.dylib" }
            "Windows" { "chroma_go_shim.dll" }
            default { throw "Unsupported OS: ${{ runner.os }}" }
          }

          $arch = switch ("${{ runner.arch }}") {
            "X64" { "amd64" }
            "ARM64" { "arm64" }
            default { "${{ runner.arch }}".ToLowerInvariant() }
          }

          $artifactBase = "chroma-go-shim-$platform-$arch"
          $stagingDir = Join-Path $env:RUNNER_TEMP $artifactBase
          $distDir = Join-Path $env:GITHUB_WORKSPACE "dist"
          New-Item -ItemType Directory -Path $stagingDir -Force | Out-Null
          New-Item -ItemType Directory -Path $distDir -Force | Out-Null

          Copy-Item -Path (Join-Path $env:GITHUB_WORKSPACE "shim/target/release/$libName") -Destination (Join-Path $stagingDir $libName) -Force

          $archiveName = "$artifactBase.tar.gz"
          $archivePath = Join-Path $distDir $archiveName
          tar -C $stagingDir -czf $archivePath .

          $hash = (Get-FileHash -Algorithm SHA256 -Path $archivePath).Hash.ToLowerInvariant()
          Set-Content -Path (Join-Path $distDir "$artifactBase.sha256") -Value "$hash  $archiveName" -Encoding ascii

          Write-Host "Created $archiveName"

      - name: Upload artifact bundle
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: shim-${{ runner.os }}
          path: |
            dist/*.tar.gz
            dist/*.sha256
          if-no-files-found: error

  publish-release:
    name: Publish release assets
    needs: build-artifacts
    # publish only on tag pushes; workflow_dispatch is for matrix build verification
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Download artifact bundles
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          pattern: shim-*
          path: dist
          merge-multiple: true

      - name: Build checksum manifest
        shell: bash
        run: |
          set -euo pipefail
          cat dist/*.sha256 > dist/chroma-go-shim_SHA256SUMS.txt
          ls -lah dist

      - name: Publish GitHub release
        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
        with:
          generate_release_notes: true
          files: |
            dist/*.tar.gz
            dist/chroma-go-shim_SHA256SUMS.txt