ci: move Swift xcframework build/upload from tag-CI to PR-CI (draft-release flow)

The Swift xcframework was the only artifact this repo built twice — once
locally during prepare-release to bake the SHA into Package.swift, once
on tag-CI to upload the zip — with the two builds expected to produce
byte-identical bytes. Cross-host determinism kept failing (Xcode patch
versions, macOS SDK skew), forcing manual zip-clobber rituals
post-publish.

Single build, single source of truth:

- release_swift.yml: new workflow that fires on push to release/v*
  branches (the convention prepare-release sets up). Builds xcframework
  + verifies layout + iOS sim test, computes SHA-256, commits the SHA
  into Package.swift on the PR branch (a bot commit marked
  [skip swift-release] so it doesn't re-fire), uploads the zip to a
  draft GitHub release v<version>.

- release.yml's create-release: replaced actions/create-release@v1
  (deprecated) with gh CLI that promotes the existing draft release to
  published — the swift zip baked in PR-CI is already attached. Falls
  through to fresh-create if no draft exists (manual tag without PR).

- release.yml's build-and-publish-libs: switched
  actions/upload-release-asset to `gh release upload --clobber` since
  the new create-release no longer produces an upload_url output.

- release.yml's build-and-publish-swift: deleted. The swift zip ships
  with the promoted draft.

- prepare-release: stripped the xcframework build + checksum bake. No
  Xcode required locally anymore — versions-only edit, PR-CI fills the
  SHA when you push.

Author: dignifiedquire

.github/workflows/release.yml

@@ -1,18 +1,10 @@
-# The way this works is the following:
+# Release pipeline. Fires on `v*` tag push, after the release PR has merged.
 #
-# The create-release job runs purely to initialize the GitHub release itself
-# and to output upload_url for the following job.
-#
-# The build-release job runs only once create-release is finished. It gets the
-# release upload URL from create-release job outputs, then builds the release
-# executables for each supported platform and attaches them as release assets
-# to the previously created release.
-#
-# The key here is that we create the release only once.
-#
-# Reference:
-# https://eugene-babichenko.github.io/blog/2020/05/09/github-actions-cross-platform-auto-releases/
-# https://github.com/crate-ci/cargo-release/blob/91549dbf9db9915ba5f121890ad0816c7d851679/.github/workflows/post-release.yml
+# The Swift xcframework zip is built upstream by release_swift.yml on the
+# `release/v*` PR branch and uploaded to a draft GitHub release. This
+# workflow's create-release job promotes that draft to published; the other
+# jobs then `gh release upload` the rest of the assets to the same release.
+# Single Swift build (in PR CI), no cross-host determinism requirement.
 
 name: release
 on:
@@ -25,33 +17,50 @@ env:
   PACKAGE_NAME: libiroh
   IROH_FORCE_STAGING_RELAYS: "1"
 
-jobs:
+# `gh release upload` + `gh release edit --draft=false` both need write
+# access to the release.
+permissions:
+  contents: write
+
+  # Tag-push publish: PR-CI (release_swift.yml) created a draft release with
+  # the Swift xcframework zip already attached and the SHA already baked into
+  # Package.swift on main. Tag time, this job just promotes the draft to
+  # published (or creates fresh if no draft, e.g. a manual tag without a PR).
+  # Other jobs then `gh release upload` the rest of the assets.
   create-release:
     name: create-release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     outputs:
-      upload_url: ${{ steps.release.outputs.upload_url }}
       release_version: ${{ env.RELEASE_VERSION }}
     steps:
     - name: Get the release version from the tag
       shell: bash
       if: env.RELEASE_VERSION == ''
       run: |
-        # See: https://github.community/t5/GitHub-Actions/How-to-get-just-the-tag-name/m-p/32167/highlight/true#M1027
         echo "RELEASE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-        echo "version is: ${{ env.RELEASE_VERSION }}"
+        echo "version is: ${GITHUB_REF#refs/tags/}"
     - name: Checkout repository
       uses: actions/checkout@v4
       with:
         fetch-depth: 1
-    - name: Create GitHub release
-      id: release
-      uses: actions/create-release@v1
+    - name: Promote draft release (or create fresh)
       env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        tag_name: ${{ env.RELEASE_VERSION }}
-        release_name: ${{ env.RELEASE_VERSION }}
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        TAG: ${{ env.RELEASE_VERSION }}
+      shell: bash
+      run: |
+        set -eu
+        if gh release view "$TAG" --json isDraft -q .isDraft 2>/dev/null | grep -q true; then
+          echo "Promoting existing draft $TAG to published"
+          gh release edit "$TAG" --draft=false
+        elif ! gh release view "$TAG" >/dev/null 2>&1; then
+          echo "Creating fresh published release $TAG (no draft from release_swift.yml)"
+          gh release create "$TAG" --title "$TAG" --notes ""
+        else
+          echo "Release $TAG already published"
+        fi
 
   build-and-publish-libs:
     name: Build & publish release libraries
@@ -121,50 +130,17 @@ jobs:
           echo "ASSET=$staging.tar.gz" >> $GITHUB_ENV
         fi
     - name: Upload release archive
-      uses: actions/upload-release-asset@v1.0.2
       env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        upload_url: ${{ needs.create-release.outputs.upload_url }}
-        asset_path: ${{ env.ASSET }}
-        asset_name: ${{ env.ASSET }}
-        asset_content_type: application/octet-stream
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        TAG: ${{ needs.create-release.outputs.release_version }}
+      shell: bash
+      run: gh release upload "$TAG" "$ASSET" --clobber
+
+  # build-and-publish-swift was here. The Swift xcframework now ships from
+  # release_swift.yml on the release/v* PR branch (it's already attached to
+  # the draft release that create-release promotes), so there's nothing to do
+  # here on tag.
 
-  build-and-publish-swift:
-    name: Build & publish swift libraries
-    timeout-minutes: 30
-    runs-on: [self-hosted, macOS, ARM64, xcode16]
-    needs: create-release
-    steps:
-    - uses: actions/checkout@master
-    - uses: dtolnay/rust-toolchain@stable
-      with:
-        targets: aarch64-apple-ios,aarch64-apple-ios-sim,x86_64-apple-ios,aarch64-apple-darwin
-    - uses: davidB/rust-cargo-make@v1
-    - name: Make swift
-      # Same deterministic zip recipe as local `cargo make prepare-release`,
-      # so the SHA-256 baked into Package.swift in the release PR matches
-      # the asset uploaded here.
-      # Two pre-publish gates: verify-swift-xcframework checks per-slice bundle
-      # layout (catches iroh-ffi#247-class bugs); verify-swift-consumer
-      # xcodebuild-builds the iOS device + iOS sim destinations against the
-      # just-built xcframework, catching link/symbol issues that the macOS-only
-      # test would miss.
-      run: |
-        cargo make swift-xcframework
-        cargo make verify-swift-xcframework
-        cargo make verify-swift-consumer
-        bash scripts/release/zip_xcframework.sh
-    - name: Upload release archive
-      uses: actions/upload-release-asset@v1.0.2
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        upload_url: ${{ needs.create-release.outputs.upload_url }}
-        asset_path: IrohLib.xcframework.zip 
-        asset_name: IrohLib.xcframework.zip 
-        asset_content_type: application/octet-stream
-        
   # Cross-build the desktop cdylibs for each JVM host the Maven artifact
   # should support. JNI libs are loaded by JNA from classpath at
   # `<jna-platform>/libname.{so,dylib,dll}`; see the staging step below.

.github/workflows/release_swift.yml

@@ -0,0 +1,83 @@
+name: Release Swift artifact
+
+# Triggers on push to release/v* branches (the convention prepare-release sets
+# up). Builds the Apple xcframework on CI, verifies its layout + that the iOS
+# slices link + that the macOS slice's tests pass, then:
+#   1. Bakes the resulting SHA-256 into Package.swift on this branch via a
+#      bot commit ([skip swift-release] in the message prevents this workflow
+#      from re-firing on its own commit).
+#   2. Uploads IrohLib.xcframework.zip to a draft GitHub release v<version>.
+#
+# Once the release PR merges + the v<version> tag is pushed, release.yml's
+# build-and-publish-swift job promotes that draft to published — no rebuild,
+# so the SHA in Package.swift always matches the zip on the release. Cleanly
+# sidesteps the cross-host determinism problem the prior local-build flow
+# kept hitting.
+
+on:
+  push:
+    branches:
+      - 'release/v*'
+
+permissions:
+  contents: write
+
+jobs:
+  build-and-bake:
+    name: Build xcframework + bake SHA + upload draft
+    # Don't re-fire on the bot's own SHA-bake commit.
+    if: "!contains(github.event.head_commit.message, '[skip swift-release]')"
+    runs-on: [self-hosted, macOS, ARM64, xcode16]
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Full history so the bot can commit + push back to this branch.
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-apple-ios,aarch64-apple-ios-sim,x86_64-apple-ios,aarch64-apple-darwin
+      - uses: Swatinem/rust-cache@v2
+      - uses: davidB/rust-cargo-make@v1
+      - name: Build xcframework + verify layout + iOS consumer + zip
+        run: |
+          cargo make swift-xcframework
+          cargo make verify-swift-xcframework
+          cargo make verify-swift-consumer
+          bash scripts/release/zip_xcframework.sh
+      - name: Parse version from Package.swift
+        id: version
+        run: |
+          v=$(grep -oE 'let releaseTag = "v[^"]+"' Package.swift | sed -E 's/.*"v([^"]+)"/\1/')
+          [ -n "$v" ] || { echo "ERROR: couldn't parse releaseTag in Package.swift" >&2; exit 1; }
+          echo "version=$v" >> "$GITHUB_OUTPUT"
+      - name: Bake SHA into Package.swift (if changed)
+        run: |
+          CURRENT=$(grep -oE 'let releaseChecksum = "[a-f0-9]+"' Package.swift | sed -E 's/.*"([a-f0-9]+)"/\1/')
+          NEW=$(shasum -a 256 IrohLib.xcframework.zip | awk '{print $1}')
+          if [ "$CURRENT" = "$NEW" ]; then
+            echo "Checksum unchanged ($NEW) — skipping commit"
+            exit 0
+          fi
+          python3 scripts/release/bump_version.py --checksum "$NEW"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add Package.swift
+          git commit -m "chore(release): bake Swift xcframework SHA $NEW [skip swift-release]"
+          git push
+      - name: Upload zip to draft GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          V=${{ steps.version.outputs.version }}
+          # Create the draft release if it doesn't exist; replace its zip if it
+          # does (re-pushes to the release branch overwrite the previous draft
+          # asset, so the asset always matches the latest Package.swift SHA).
+          if ! gh release view "v$V" >/dev/null 2>&1; then
+            gh release create "v$V" \
+              --draft \
+              --title "v$V" \
+              --notes "Draft release — promoted to published by release.yml on tag push."
+          fi
+          gh release upload "v$V" IrohLib.xcframework.zip --clobber

Makefile.toml

@@ -645,17 +645,12 @@ echo "pre-release-check passed — safe to run cargo make prepare-release <VERSI
 '''
 
 [tasks.prepare-release]
-description = "Bump versions everywhere + build a deterministic xcframework zip + bake the checksum into Package.swift. Run on macOS (needs Xcode for the xcframework). Usage: cargo make prepare-release <VERSION>"
+description = "Bump version literals across every binding manifest. The Swift xcframework checksum is filled in by PR CI (release_swift.yml) once the release PR is open, so this no longer needs Xcode locally. Usage: cargo make prepare-release <VERSION>"
 script_runner = "@shell"
 script = '''
 set -eu
 VERSION="${1:?usage: cargo make prepare-release <VERSION> (no leading v)}"
 
-if [ "$(uname -s)" != "Darwin" ]; then
-  echo "ERROR: prepare-release must run on macOS (Xcode-required xcframework build)" >&2
-  exit 1
-fi
-
 echo "==> rewrite version literals"
 python3 scripts/release/bump_version.py "$VERSION"
 
@@ -665,28 +660,21 @@ cargo update -p iroh-ffi --precise "$VERSION" >/dev/null
 echo "==> refresh iroh-js/yarn.lock"
 ( cd iroh-js && yarn install --mode update-lockfile >/dev/null )
 
-echo "==> build full xcframework"
-cargo make swift-xcframework >/dev/null
-
-echo "==> deterministic zip + checksum"
-bash scripts/release/zip_xcframework.sh
-CHECKSUM=$(shasum -a 256 IrohLib.xcframework.zip | awk '{print $1}')
-
-echo "==> bake checksum into Package.swift"
-python3 scripts/release/bump_version.py --checksum "$CHECKSUM"
-
 cat <<EOF
 
-Prepared release v$VERSION.
-  zip: IrohLib.xcframework.zip ($(stat -f%z IrohLib.xcframework.zip) bytes)
-  sha256: $CHECKSUM
+Prepared release v$VERSION (versions only; Swift xcframework SHA is CI's job).
 
 Next:
   git checkout -b release/v$VERSION
   git commit -am "chore(release): v$VERSION"
-  # PR -> green CI -> merge to main
-  git tag v$VERSION <merge commit>
+  git push -u origin release/v$VERSION
+  # Open PR. release_swift.yml builds the xcframework on a CI runner, bakes
+  # the resulting SHA into Package.swift on this branch, and uploads the zip
+  # to a draft GitHub release at v$VERSION. Review the SHA-bake commit + the
+  # draft release asset, then merge and tag:
+  git tag v$VERSION <merge-commit-sha>
   git push origin v$VERSION
+  # release.yml promotes the draft release to published.
 EOF
 '''