release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: read

jobs:
  build-linux:
    strategy:
      fail-fast: false
      matrix:
        include:
          - goarch: amd64
            runner: ubuntu-latest
            container: quay.io/pypa/manylinux_2_28_x86_64@sha256:853663dc8253b62be437bb52a5caecffd020792af4442f55d927d22e0ea795ae
          - goarch: arm64
            runner: ubuntu-24.04-arm
            container: quay.io/pypa/manylinux_2_28_aarch64@sha256:ca1f9d96910e129d38f999644a1f211a6cdb4147da9f19157a49d72c5092453a

    runs-on: ${{ matrix.runner }}
    container: ${{ matrix.container }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version-file: go.mod

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
        with:
          node-version: "24"

      - name: Build frontend
        run: npm ci && npm run build
        working-directory: frontend

      - name: Embed frontend
        shell: bash
        run: |
          rm -rf internal/web/dist
          cp -r frontend/dist internal/web/dist

      - name: Build
        shell: bash
        env:
          GOOS: linux
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: "1"
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          COMMIT=${GITHUB_SHA::8}
          BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")

          mkdir -p dist
          LDFLAGS="-s -w -X main.version=v${VERSION} -X main.commit=${COMMIT} -X main.buildDate=${BUILD_DATE}"
          go build -tags fts5 -buildvcs=false -ldflags="$LDFLAGS" -trimpath \
            -o dist/periscope ./cmd/periscope

          # Smoke test (native builds — no cross-compilation)
          ./dist/periscope --version

          # Verify glibc compatibility
          MAX_GLIBC="GLIBC_2.28"
          HIGHEST=$(objdump -T dist/periscope | grep -oP 'GLIBC_\d+\.\d+' | sort -t. -k1,1n -k2,2n | tail -1)
          echo "Highest glibc symbol: $HIGHEST (max allowed: $MAX_GLIBC)"
          if [ "$(printf '%s\n%s' "$MAX_GLIBC" "$HIGHEST" | sort -t. -k1,1n -k2,2n | tail -1)" != "$MAX_GLIBC" ]; then
            echo "ERROR: Binary requires $HIGHEST but wheel claims $MAX_GLIBC"
            exit 1
          fi

          cd dist
          ARCHIVE="periscope_${VERSION}_linux_${{ matrix.goarch }}.tar.gz"
          tar czf "$ARCHIVE" periscope
          rm periscope

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: periscope-linux-${{ matrix.goarch }}
          path: dist/*.tar.gz

  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-15
            goos: darwin
            goarch: amd64
          - os: macos-15
            goos: darwin
            goarch: arm64
          - os: windows-latest
            goos: windows
            goarch: amd64

    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version-file: go.mod

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
        with:
          node-version: "24"

      - name: Build frontend
        run: npm ci && npm run build
        working-directory: frontend

      - name: Embed frontend
        shell: bash
        run: |
          rm -rf internal/web/dist
          cp -r frontend/dist internal/web/dist

      - name: Setup MinGW (Windows)
        if: matrix.goos == 'windows'
        uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c  # v2
        with:
          msystem: MINGW64
          update: false
          install: mingw-w64-x86_64-gcc
          path-type: inherit

      - name: Build
        shell: bash
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: "1"
          MACOSX_DEPLOYMENT_TARGET: ${{ matrix.goos == 'darwin' && '11.0' || '' }}
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          COMMIT=${GITHUB_SHA::8}
          BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
          EXT=""
          if [ "$GOOS" = "windows" ]; then EXT=".exe"; fi

          mkdir -p dist
          LDFLAGS="-s -w -X main.version=v${VERSION} -X main.commit=${COMMIT} -X main.buildDate=${BUILD_DATE}"
          go build -tags fts5 -ldflags="$LDFLAGS" -trimpath \
            -o dist/periscope${EXT} ./cmd/periscope

          # Smoke test (skip cross-compiled darwin/amd64 on ARM runner)
          if [ "$GOARCH" = "$(go env GOHOSTARCH)" ]; then
            ./dist/periscope${EXT} --version
          fi

          # Verify macOS deployment target
          if [ "$GOOS" = "darwin" ]; then
            MINOS=$(otool -l dist/periscope | grep -A3 LC_BUILD_VERSION | grep minos | awk '{print $2}')
            echo "Minimum macOS version: $MINOS"
            if [ "$MINOS" != "11.0" ]; then
              echo "ERROR: Expected minos 11.0, got $MINOS"
              exit 1
            fi
          fi

          cd dist
          if [ "$GOOS" = "windows" ]; then
            ARCHIVE="periscope_${VERSION}_${{ matrix.goos }}_${{ matrix.goarch }}.zip"
            7z a "$ARCHIVE" periscope${EXT}
          else
            ARCHIVE="periscope_${VERSION}_${{ matrix.goos }}_${{ matrix.goarch }}.tar.gz"
            tar czf "$ARCHIVE" periscope${EXT}
          fi
          rm periscope${EXT}

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: periscope-${{ matrix.goos }}-${{ matrix.goarch }}
          path: |
            dist/*.tar.gz
            dist/*.zip

  release:
    needs: [build-linux, build]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: artifacts
          merge-multiple: true

      - name: Generate checksums
        run: |
          cd artifacts
          sha256sum *.tar.gz *.zip > SHA256SUMS
          cat SHA256SUMS

      - name: Get tag message
        id: tag_message
        run: |
          TAG_NAME="${GITHUB_REF#refs/tags/}"

          TAG_TYPE=$(git cat-file -t "$TAG_NAME")
          if [ "$TAG_TYPE" != "tag" ]; then
            echo "Warning: $TAG_NAME is a lightweight tag, using auto-generated notes"
            echo "has_body=false" >> $GITHUB_OUTPUT
            exit 0
          fi

          TAG_MSG=$(git tag -l --format='%(contents:body)' "$TAG_NAME")

          if [ -n "$TAG_MSG" ]; then
            DELIM="TAGMSG_$(date +%s%N)"
            echo "body<<$DELIM" >> $GITHUB_OUTPUT
            echo "$TAG_MSG" >> $GITHUB_OUTPUT
            echo "$DELIM" >> $GITHUB_OUTPUT
            echo "has_body=true" >> $GITHUB_OUTPUT
          else
            echo "has_body=false" >> $GITHUB_OUTPUT
          fi

      - name: Create Release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda  # v3.0.0
        with:
          files: |
            artifacts/*.tar.gz
            artifacts/*.zip
            artifacts/SHA256SUMS
          body: ${{ steps.tag_message.outputs.has_body == 'true' && steps.tag_message.outputs.body || '' }}
          generate_release_notes: ${{ steps.tag_message.outputs.has_body != 'true' }}

  pypi:
    # Disabled by default — the 'periscope' package name on PyPI is taken by an unrelated
    # project (Patrick Dessalle, v0.2.4). To enable: set the ENABLE_PYPI_PUBLISH repo
    # variable to 'true' AND configure an OIDC Trusted Publisher at pypi.org with:
    #   project name: <your-package-name>, owner: diazMelgarejo, repo: periscope,
    #   workflow: release.yml, environment: pypi
    if: vars.ENABLE_PYPI_PUBLISH == 'true'
    needs: [build-linux, build, release]
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: "3.12"

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: artifacts
          merge-multiple: true

      - name: Build wheels
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          python scripts/build_wheels.py \
            --version "$VERSION" \
            --input-dir artifacts \
            --output-dir wheels \
            --readme README.md \
            --require-all

      - name: Smoke test wheel
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          WHL_VERSION=$(python3 -c "import re,sys; v='${VERSION}'; m=re.match(r'^(\d+\.\d+\.\d+)-(.+)$',v); print(m.group(1)+'+'+m.group(2).replace('-','.')if m else v)")
          pip install "wheels/periscope-${WHL_VERSION}-py3-none-manylinux_2_28_x86_64.whl"
          periscope --version

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
        with:
          packages-dir: wheels/