release-please.yml

name: release-please

on:
  push:
    branches: [main]

permissions:
  contents: write
  pull-requests: write

jobs:
  # Maintains a "chore: release X.Y.Z" PR from conventional commits. Merging
  # that PR bumps the version, tags it, and creates a draft GitHub Release.
  # The release is published only after binaries have been attached, which is
  # required when GitHub immutable releases are enabled.
  release-please:
    runs-on: ubuntu-latest
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
    steps:
      - uses: googleapis/release-please-action@v4
        id: release
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  # cladding's build.rs embeds the Linux mcp-run/run-remote helpers, which run
  # inside cladding's arm64 sandbox containers on Apple silicon. GitHub's macOS
  # runners can't run a Linux container to build them, so cross-compile the
  # aarch64-linux (glibc, matching the Debian base image) helpers here and hand
  # them to the macOS job as an artifact.
  build-helpers:
    needs: release-please
    if: ${{ needs.release-please.outputs.release_created == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-unknown-linux-gnu
      - uses: Swatinem/rust-cache@v2
      - name: Install aarch64 cross toolchain
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu
      - name: Build helpers (aarch64 Linux)
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
          CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
          AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
        run: |
          cargo build -p mcp-run --release --locked \
            --target aarch64-unknown-linux-gnu \
            --bin mcp-run --bin run-remote
      - name: Stage helpers
        run: |
          mkdir helpers
          cp target/aarch64-unknown-linux-gnu/release/mcp-run helpers/
          cp target/aarch64-unknown-linux-gnu/release/run-remote helpers/
      - uses: actions/upload-artifact@v4
        with:
          name: mcp-run-helpers-aarch64-linux
          path: helpers/

  # Only runs on the push that merges the release PR (release_created == true).
  # Builds a release binary per target and attaches it to the draft Release.
  upload-binaries:
    needs: [release-please, build-helpers]
    if: ${{ needs.release-please.outputs.release_created == 'true' }}
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: macos-latest
            target: aarch64-apple-darwin
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
      # macOS can't run a Linux container to build the embedded helpers, so pull
      # the prebuilt aarch64-linux binaries and let build.rs copy them in via the
      # CLADDING_MCP_RUN_BIN / CLADDING_RUN_REMOTE_BIN escape hatch. On Linux the
      # build.rs builds them locally, so this step is skipped.
      - name: Fetch prebuilt helpers
        if: runner.os == 'macOS'
        uses: actions/download-artifact@v4
        with:
          name: mcp-run-helpers-aarch64-linux
          path: helpers
      - name: Point build.rs at prebuilt helpers
        if: runner.os == 'macOS'
        run: |
          echo "CLADDING_MCP_RUN_BIN=$GITHUB_WORKSPACE/helpers/mcp-run" >> "$GITHUB_ENV"
          echo "CLADDING_RUN_REMOTE_BIN=$GITHUB_WORKSPACE/helpers/run-remote" >> "$GITHUB_ENV"
      # --locked is safe: the cargo-workspace plugin keeps the root Cargo.lock
      # in sync with the version bump on the release commit.
      - name: Build
        run: cargo build --release --locked --target ${{ matrix.target }} -p cladding
      - name: Package
        shell: bash
        run: |
          bin=cladding
          staging="${bin}-${{ needs.release-please.outputs.tag_name }}-${{ matrix.target }}"
          mkdir "$staging"
          cp "target/${{ matrix.target }}/release/${bin}" "$staging/"
          cp README.md "$staging/"
          tar czf "$staging.tar.gz" "$staging"
          echo "ASSET=$staging.tar.gz" >> "$GITHUB_ENV"
      - name: Upload to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release upload "${{ needs.release-please.outputs.tag_name }}" "$ASSET" --clobber

  publish-release:
    needs: [release-please, upload-binaries]
    if: ${{ needs.release-please.outputs.release_created == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Publish release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
        run: gh release edit "${{ needs.release-please.outputs.tag_name }}" --draft=false