fix: use gh release download to fetch pg-ffi native libraries

Author: rubenhensen

.github/workflows/build.yml

@@ -21,14 +21,13 @@ jobs:
       # Download pre-built native library for CI
       - name: Download pg-ffi native library
         run: |
-          # Fetch the latest pg-ffi release from the postguard repo
-          DOWNLOAD_URL=$(gh release view --repo encryption4all/postguard --json assets -q '.assets[] | select(.name == "pg-ffi-linux-x64.tar.gz") | .url' 2>/dev/null || true)
-          if [ -n "$DOWNLOAD_URL" ]; then
+          TAG=$(gh release list --repo encryption4all/postguard --json tagName -q '[.[] | select(.tagName | startswith("pg-ffi-"))][0].tagName' 2>/dev/null || true)
+          if [ -n "$TAG" ]; then
             mkdir -p src/runtimes/linux-x64/native
-            curl -sL "$DOWNLOAD_URL" | tar xz -C src/runtimes/linux-x64/native
+            gh release download "$TAG" --repo encryption4all/postguard --pattern "pg-ffi-linux-x64.tar.gz" --dir /tmp
+            tar xzf /tmp/pg-ffi-linux-x64.tar.gz -C src/runtimes/linux-x64/native
           else
             echo "::warning::No pg-ffi release found. Building from source."
-            # Fallback: build from source if no release exists yet
             rustup default stable
             git clone --depth 1 https://github.com/encryption4all/postguard.git /tmp/postguard
             cargo build --release -p pg-ffi --manifest-path /tmp/postguard/Cargo.toml

.github/workflows/publish.yml

@@ -20,34 +20,29 @@ jobs:
       # Download native libraries for all platforms from the postguard repo
       - name: Download pg-ffi native libraries
         run: |
-          TARGETS=("linux-x64:tar.gz" "linux-arm64:tar.gz" "osx-arm64:tar.gz" "osx-x64:tar.gz" "win-x64:zip")
           RUNTIMES_DIR="src/runtimes"
+          # Find the latest pg-ffi release tag
+          TAG=$(gh release list --repo encryption4all/postguard --json tagName -q '[.[] | select(.tagName | startswith("pg-ffi-"))][0].tagName')
+          if [ -z "$TAG" ]; then
+            echo "::error::No pg-ffi release found"
+            exit 1
+          fi
+          echo "Using release: $TAG"
 
-          for entry in "${TARGETS[@]}"; do
-            TARGET="${entry%%:*}"
-            EXT="${entry##*:}"
-            ASSET="pg-ffi-${TARGET}.${EXT}"
-
+          # Download each platform asset
+          for TARGET in linux-x64 linux-arm64 osx-arm64 osx-x64; do
+            ASSET="pg-ffi-${TARGET}.tar.gz"
             mkdir -p "${RUNTIMES_DIR}/${TARGET}/native"
-
             echo "Downloading ${ASSET}..."
-            DOWNLOAD_URL=$(gh release list --repo encryption4all/postguard --json tagName,assets -q "
-              [.[] | .assets[] | select(.name == \"${ASSET}\")] | first | .url // empty
-            " 2>/dev/null || true)
-
-            if [ -z "$DOWNLOAD_URL" ]; then
-              echo "::warning::Could not find ${ASSET} in postguard releases"
-              continue
-            fi
-
-            if [ "$EXT" = "tar.gz" ]; then
-              curl -sL "$DOWNLOAD_URL" | tar xz -C "${RUNTIMES_DIR}/${TARGET}/native"
-            else
-              curl -sL "$DOWNLOAD_URL" -o /tmp/pg-ffi.zip
-              unzip -o /tmp/pg-ffi.zip -d "${RUNTIMES_DIR}/${TARGET}/native"
-              rm /tmp/pg-ffi.zip
-            fi
+            gh release download "$TAG" --repo encryption4all/postguard --pattern "$ASSET" --dir /tmp
+            tar xzf "/tmp/${ASSET}" -C "${RUNTIMES_DIR}/${TARGET}/native"
           done
+
+          # Windows
+          mkdir -p "${RUNTIMES_DIR}/win-x64/native"
+          echo "Downloading pg-ffi-win-x64.zip..."
+          gh release download "$TAG" --repo encryption4all/postguard --pattern "pg-ffi-win-x64.zip" --dir /tmp
+          unzip -o /tmp/pg-ffi-win-x64.zip -d "${RUNTIMES_DIR}/win-x64/native"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}