release.yml

name: Release Builds

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      release_tag:
        description: "Optional release tag to publish, for example v0.1.0"
        required: false
        type: string

permissions:
  contents: write

jobs:
  build-release:
    name: Build ${{ matrix.os }}
    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
          - windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Checkout picoquic
        uses: actions/checkout@v5
        with:
          repository: private-octopus/picoquic
          ref: master
          path: third_party/picoquic

      - name: Checkout picotls
        uses: actions/checkout@v5
        with:
          repository: private-octopus/picotls
          ref: master
          path: third_party/picotls
          submodules: recursive

      - name: Set up Windows dependencies
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          # picotls requires pkg-config at configure time (even on Windows where
          # brotli is absent); install the lightweight pkgconfiglite shim.
          choco install pkgconfiglite --no-progress -y

          $candidates = @(
            "C:\Program Files\OpenSSL",
            "C:\Program Files\OpenSSL-Win64",
            "C:\OpenSSL-Win64"
          )
          $opensslFound = $false
          foreach ($candidate in $candidates) {
            if (Test-Path "$candidate\include\openssl\ssl.h") {
              "OPENSSL_ROOT_DIR=$candidate" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
              Write-Host "OpenSSL found at $candidate"
              $opensslFound = $true
              break
            }
          }
          if (-not $opensslFound) {
            choco install openssl --no-progress -y
            foreach ($candidate in $candidates) {
              if (Test-Path "$candidate\include\openssl\ssl.h") {
                "OPENSSL_ROOT_DIR=$candidate" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
                Write-Host "OpenSSL installed at $candidate"
                break
              }
            }
          }

      - name: Configure
        shell: bash
        run: |
          args=(
            cmake -S . -B build
            -DCMAKE_BUILD_TYPE=Release
            -DCMAKE_POLICY_VERSION_MINIMUM=3.5
            "-DOPENMOQ_PICOQUIC_SOURCE_DIR=${{ github.workspace }}/third_party/picoquic"
            "-DOPENMOQ_PICOTLS_SOURCE_DIR=${{ github.workspace }}/third_party/picotls"
            -DOPENMOQ_RUN_PICOQUIC_SMOKE_TESTS=OFF
          )
          if [ -n "${OPENSSL_ROOT_DIR:-}" ]; then
            args+=("-DOPENSSL_ROOT_DIR=${OPENSSL_ROOT_DIR}")
          fi
          "${args[@]}"

      - name: Build
        run: cmake --build build --config Release --parallel

      - name: Package
        shell: bash
        run: |
          set -euo pipefail
          version="${{ github.event.inputs.release_tag }}"
          if [[ -z "${version}" ]]; then
            version="${GITHUB_REF_NAME}"
          fi
          if [[ -z "${version}" || "${GITHUB_REF_TYPE}" != "tag" && -z "${{ github.event.inputs.release_tag }}" ]]; then
            version="manual-${GITHUB_RUN_NUMBER}"
          fi

          package_root="openmoq-publisher-${version}-${RUNNER_OS}"
          mkdir -p "${package_root}/lib"

          # Stage every static library needed to link openmoq_publisher
          # standalone: the publisher archive plus its picoquic/picotls/picohttp
          # transitive dependencies (whose symbols are otherwise undefined in
          # libopenmoq_publisher.a). OpenSSL stays a system dependency the
          # consumer provides. The build tree differs by generator: single-config
          # on Linux/macOS, a Release/ subdir on MSVC, so the deps are located
          # recursively rather than by fixed path.
          if [[ "${RUNNER_OS}" == "Windows" ]]; then
            cp build/Release/openmoq-publisher.exe "${package_root}/"
            cp build/Release/openmoq_publisher.lib "${package_root}/lib/"
            find build -type f \( -name 'picoquic*.lib' -o -name 'picohttp*.lib' \
              -o -name 'picotls*.lib' \) -exec cp {} "${package_root}/lib/" \;
            archive="${package_root}.zip"
          else
            cp build/openmoq-publisher "${package_root}/"
            cp build/libopenmoq_publisher.a "${package_root}/lib/"
            find build -type f \( -name 'libpicoquic*.a' -o -name 'libpicohttp*.a' \
              -o -name 'libpicotls*.a' \) -exec cp {} "${package_root}/lib/" \;
            archive="${package_root}.tar.gz"
          fi

          cp -R include "${package_root}/include"
          cp README.md LICENSE "${package_root}/"
          cp -R docs "${package_root}/docs"

          # Fail the release if the dependency static libs did not get staged,
          # rather than shipping an SDK that cannot link.
          echo "Staged libraries:"; ls -1 "${package_root}/lib/"
          lib_count="$(find "${package_root}/lib" -type f \( -name '*.a' -o -name '*.lib' \) | wc -l)"
          if [[ "${lib_count}" -lt 5 ]]; then
            echo "ERROR: expected the openmoq library plus picoquic/picotls deps in lib/, found ${lib_count}" >&2
            exit 1
          fi

          if [[ "${RUNNER_OS}" == "Windows" ]]; then
            7z a "${archive}" "${package_root}"
          else
            tar -czf "${archive}" "${package_root}"
          fi

          if [[ "${version}" == v* ]]; then
            echo "release_enabled=true" >> "${GITHUB_ENV}"
          else
            echo "release_enabled=false" >> "${GITHUB_ENV}"
          fi
          echo "release_tag=${version}" >> "${GITHUB_ENV}"
          echo "artifact_name=${package_root}" >> "${GITHUB_ENV}"
          echo "archive=${archive}" >> "${GITHUB_ENV}"

      - name: Upload workflow artifact
        uses: actions/upload-artifact@v6
        with:
          name: ${{ env.artifact_name }}
          path: ${{ env.archive }}
          if-no-files-found: error

      - name: Attach assets to GitHub release
        if: env.release_enabled == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -euo pipefail
          tag="${{ env.release_tag }}"

          if gh release view "${tag}" >/dev/null 2>&1; then
            gh release upload "${tag}" "${{ env.archive }}" --clobber
          else
            gh release create "${tag}" "${{ env.archive }}" \
              --title "${tag}" \
              --target "${GITHUB_SHA}" \
              --generate-notes
          fi