build-binaries.yml

name: Build CLI Binaries

on:
  workflow_dispatch: # Allow manual triggering (uses latest @neaps/cli release)
  push:
  release:
    types: [published]

jobs:
  resolve-tag:
    name: Resolve release tag
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.resolve.outputs.tag }}
      should_release: ${{ steps.resolve.outputs.should_release }}
    steps:
      - name: Resolve tag
        id: resolve
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if [ "${{ github.event_name }}" = "release" ]; then
            TAG="${{ github.event.release.tag_name }}"
            if [[ "$TAG" == @neaps/cli@* ]]; then
              echo "tag=$TAG" >> "$GITHUB_OUTPUT"
              echo "should_release=true" >> "$GITHUB_OUTPUT"
            else
              echo "should_release=false" >> "$GITHUB_OUTPUT"
            fi
          elif [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            TAG=$(gh api repos/${{ github.repository }}/releases --jq '[.[] | select(.tag_name | startswith("@neaps/cli@"))][0].tag_name')
            if [ -n "$TAG" ]; then
              echo "tag=$TAG" >> "$GITHUB_OUTPUT"
              echo "should_release=true" >> "$GITHUB_OUTPUT"
            else
              echo "should_release=false" >> "$GITHUB_OUTPUT"
            fi
          else
            echo "should_release=false" >> "$GITHUB_OUTPUT"
          fi

  build:
    name: Build ${{ matrix.target }}
    needs: resolve-tag
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        include:
          - target: linux-x64
            os: ubuntu-latest
          - target: darwin-arm64
            os: macos-latest
          - target: win-x64
            os: windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 25

      - name: Install dependencies
        run: npm install

      - name: Build packages
        run: npm run build --workspaces --if-present

      - name: Build SEA binary
        run: npm run build:sea --workspace=packages/cli

      - name: Smoke test binary
        shell: bash
        run: |
          EXT=${{ matrix.target == 'win-x64' && '".exe"' || '""' }}
          BIN="packages/cli/dist/neaps${EXT}"
          "$BIN" --version
          "$BIN" --help

      - name: Verify reproducible build
        shell: bash
        run: |
          if command -v sha256sum &>/dev/null; then
            SHASUM="sha256sum"
          else
            SHASUM="shasum -a 256"
          fi
          EXT=${{ matrix.target == 'win-x64' && '".exe"' || '""' }}
          BIN="packages/cli/dist/neaps${EXT}"
          HASH1=$($SHASUM "$BIN" | cut -d' ' -f1)
          npm run build:sea --workspace=packages/cli
          HASH2=$($SHASUM "$BIN" | cut -d' ' -f1)
          if [ "$HASH1" != "$HASH2" ]; then
            echo "::error::Build not reproducible! $HASH1 vs $HASH2"
            exit 1
          fi
          echo "Build is reproducible: $HASH1"

      - name: Package binary (Unix)
        if: matrix.target != 'win-x64'
        run: tar czf packages/cli/neaps-${{ matrix.target }}.tar.gz -C packages/cli/dist neaps

      - name: Package binary (Windows)
        if: matrix.target == 'win-x64'
        shell: pwsh
        run: Compress-Archive -Path packages/cli/dist/neaps.exe -DestinationPath packages/cli/neaps-${{ matrix.target }}.zip

      - name: Upload build artifact
        uses: actions/upload-artifact@v7
        with:
          name: neaps-${{ matrix.target }}
          path: packages/cli/neaps-${{ matrix.target }}.*

      - name: Upload to release
        if: needs.resolve-tag.outputs.should_release == 'true'
        uses: softprops/action-gh-release@v2
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
        with:
          tag_name: ${{ needs.resolve-tag.outputs.tag }}
          files: |
            packages/cli/neaps-${{ matrix.target }}.*

  checksums:
    if: needs.resolve-tag.outputs.should_release == 'true'
    name: Generate checksums
    needs: [resolve-tag, build]
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts

      - name: Generate checksums file
        run: |
          cd artifacts
          sha256sum */neaps-* | sed 's|[^ ]*/||' > ../checksums.txt
          cat ../checksums.txt

      - name: Upload checksums artifact
        uses: actions/upload-artifact@v7
        with:
          name: checksums
          path: checksums.txt

      - name: Upload checksums to release
        uses: softprops/action-gh-release@v2
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
        with:
          tag_name: ${{ needs.resolve-tag.outputs.tag }}
          files: checksums.txt

  update-homebrew:
    if: needs.resolve-tag.outputs.should_release == 'true'
    name: Update Homebrew tap
    needs: [resolve-tag, build, checksums]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download checksums artifact
        uses: actions/download-artifact@v8
        with:
          name: checksums

      - name: Generate formula
        env:
          TAG: ${{ needs.resolve-tag.outputs.tag }}
          REPO: ${{ github.repository }}
        run: |
          VERSION="${TAG##*@}"
          SHA_DARWIN_ARM64=$(grep neaps-darwin-arm64.tar.gz checksums.txt | cut -d' ' -f1)
          SHA_LINUX_X64=$(grep neaps-linux-x64.tar.gz checksums.txt | cut -d' ' -f1)

          sed \
            -e "s|{{TAG}}|${TAG}|g" \
            -e "s|{{VERSION}}|${VERSION}|g" \
            -e "s|{{REPO}}|${REPO}|g" \
            -e "s|{{SHA256_DARWIN_ARM64}}|${SHA_DARWIN_ARM64}|g" \
            -e "s|{{SHA256_LINUX_X64}}|${SHA_LINUX_X64}|g" \
            packages/cli/homebrew/neaps.rb > neaps.rb

      - name: Push to Homebrew tap
        env:
          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          git clone "https://x-access-token:${GH_TOKEN}@github.com/openwatersio/homebrew-tap.git" tap
          mkdir -p tap/Formula
          cp neaps.rb tap/Formula/neaps.rb
          cd tap
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Formula/neaps.rb
          git commit -m "Update neaps to ${{ needs.resolve-tag.outputs.tag }}"
          git push