release.yml

name: Stable release
run-name: Stable v${{ inputs.version }} plan:${{ inputs.plan_id }}

on:
  workflow_dispatch:
    inputs:
      version:
        description: SemVer without v prefix
        required: true
      rc_tag:
        description: Soaked RC tag
        required: true
      ref:
        description: Candidate ref or commit
        required: true
      plan_id:
        description: Confirmed cargo-xtask plan ID
        required: true

permissions:
  contents: read

concurrency:
  group: stable-${{ inputs.version }}
  cancel-in-progress: false

jobs:
  authorize:
    runs-on: ubuntu-latest
    env:
      GH_TOKEN: ${{ github.token }}
    permissions:
      contents: read
      attestations: read
    timeout-minutes: 120
    outputs:
      commit: ${{ steps.commit.outputs.sha }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
        with:
          toolchain: 1.95.0
      - id: commit
        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
      - name: Install pinned contract API tool
        run: |
          rustup toolchain install nightly-2026-04-15 --profile minimal
          cargo install cargo-public-api --version '=0.50.1' --locked
      - name: Recompute every promotion gate and verify plan
        shell: bash
        env:
          VERSION: ${{ inputs.version }}
          RC_TAG: ${{ inputs.rc_tag }}
          CANDIDATE_REF: ${{ inputs.ref }}
          PLAN_ID: ${{ inputs.plan_id }}
        run: |
          cargo xtask release plan \
            --version "$VERSION" \
            --rc-tag "$RC_TAG" \
            --ref "$CANDIDATE_REF" \
            --output recomputed-plan.json --json > recomputed-plan-report.json
          actual=$(python3 -c 'import json; print(json.load(open("recomputed-plan.json"))["plan_id"])')
          test "$actual" = "$PLAN_ID"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: stable-plan
          path: recomputed-plan.json

  build-assets:
    needs: authorize
    name: build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
          - target: aarch64-apple-darwin
            os: macos-14
          - target: x86_64-apple-darwin
            os: macos-14
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ needs.authorize.outputs.commit }}
      - name: Install native build dependencies
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y musl-tools cmake
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
        with:
          toolchain: 1.95.0
          targets: ${{ matrix.target }}
      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-stable-${{ matrix.target }}-${{ hashFiles('Cargo.lock') }}
      - name: Build release binary
        env:
          CC_x86_64_unknown_linux_musl: musl-gcc
          CXX_x86_64_unknown_linux_musl: g++
        run: cargo build --release --locked --target '${{ matrix.target }}' --bin rosalind
      - name: Stage bundle
        run: scripts/stage-release.sh '${{ matrix.target }}'
      - name: Install-smoke staged bundle
        if: matrix.target != 'x86_64-apple-darwin'
        shell: bash
        run: |
          install_root=$(mktemp -d)
          tar -xzf "dist/rosalind-${{ matrix.target }}.tar.gz" -C "$install_root"
          "$install_root/rosalind-${{ matrix.target }}/rosalind" --version
      - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0
      - name: Generate SPDX SBOM
        run: syft 'dir:dist/rosalind-${{ matrix.target }}' -o 'spdx-json=dist/rosalind-${{ matrix.target }}.spdx.json'
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: stable-${{ matrix.target }}
          path: |
            dist/rosalind-${{ matrix.target }}.tar.gz
            dist/rosalind-${{ matrix.target }}.tar.gz.sha256
            dist/rosalind-${{ matrix.target }}.spdx.json

  publish-crates:
    needs: [authorize, build-assets]
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: read
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ needs.authorize.outputs.commit }}
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
        with:
          toolchain: 1.95.0
      - name: Resume byte-verified crates.io publication
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: scripts/release-publish.sh
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: crate-publication-state
          if-no-files-found: warn
          path: publish-state.json

  published-install-smoke:
    needs: [authorize, publish-crates]
    name: fresh registry install (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-14]
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ needs.authorize.outputs.commit }}
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
        with:
          toolchain: 1.95.0
      - name: Install native build dependencies
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y cmake
      - name: Empty-cache install, demo, scaffold, and conformance
        env:
          VERSION: ${{ inputs.version }}
        run: scripts/post-publish-smoke.sh "$VERSION"

  publish-release:
    needs: [authorize, build-assets, publish-crates, published-install-smoke]
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: write
      id-token: write
      attestations: write
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ needs.authorize.outputs.commit }}
          fetch-depth: 0
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          pattern: stable-*
          path: release-assets
          merge-multiple: true
      - uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
        with:
          subject-path: release-assets/*.tar.gz
      - name: Create stable tag and GitHub Release last
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: v${{ inputs.version }}
          COMMIT: ${{ needs.authorize.outputs.commit }}
        shell: bash
        run: |
          remote=$(git ls-remote origin "refs/tags/$TAG" | awk '{print $1}')
          if [ -n "$remote" ]; then
            git fetch --force origin "refs/tags/$TAG:refs/tags/$TAG"
            test "$(git rev-list -n 1 "$TAG")" = "$COMMIT" || { echo "$TAG targets another commit" >&2; exit 5; }
          else
            git tag -a "$TAG" "$COMMIT" -m "Rosalind $TAG"
            git push origin "refs/tags/$TAG"
          fi
          if gh release view "$TAG" --repo '${{ github.repository }}' >/dev/null 2>&1; then
            test "$(gh release view "$TAG" --repo '${{ github.repository }}' --json isPrerelease --jq .isPrerelease)" = false
          else
            gh release create "$TAG" release-assets/* \
              --repo '${{ github.repository }}' --verify-tag --target "$COMMIT" --latest \
              --title "Rosalind $TAG" --generate-notes
          fi