release.yml

name: Release Artifacts

on:
  release:
    types: [created]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag to build for (e.g., 1.4.0)'
        required: true

jobs:
  # Build native riddlc binaries on each target platform
  native-build:
    timeout-minutes: 60
    permissions:
      contents: write
      packages: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            artifact: riddlc-macos-arm64
            arch: arm64
          - os: ubuntu-latest
            artifact: riddlc-linux-x86_64
            arch: x86_64
    runs-on: ${{ matrix.os }}
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
    - name: Checkout Code
      uses: actions/checkout@v4
      with:
        ref: ${{ github.event.release.tag_name || github.event.inputs.tag }}

    - name: Set Up JDK 25
      uses: actions/setup-java@v4
      with:
        java-version: '25'
        distribution: temurin
        cache: sbt

    - name: Set Up SBT
      uses: sbt/setup-sbt@7e33f738678e47369c83dcb4b1d9c65d66eb3cdd # v1

    - name: Coursier Caching
      uses: coursier/cache-action@2addd381bd2c931f42d4b734b9d0c9b73aac16fb # v6

    - name: Configure sbt GitHub Packages credentials
      run: |
        mkdir -p ~/.sbt/1.0
        cat > ~/.sbt/1.0/github.sbt << 'CREDSEOF'
        credentials += Credentials(
          "GitHub Package Registry",
          "maven.pkg.github.com",
          "x-access-token",
          sys.env.getOrElse("GITHUB_TOKEN", "")
        )
        CREDSEOF

    - name: Install LLVM and Clang (Linux only)
      if: runner.os == 'Linux'
      run: |
        sudo apt-get update && sudo apt-get install -y clang llvm

    - name: Install curl dev dependencies (Linux only)
      if: runner.os == 'Linux'
      run: |
        sudo apt-get update
        sudo apt-get install -y libcurl4-openssl-dev libidn2-dev

    - name: Build Native Binary
      run: sbt riddlcNative/nativeLink

    - name: Package Native Binary
      run: |
        mkdir -p staging/bin
        cp riddlc/native/target/scala-3.7.4/riddlc staging/bin/riddlc
        cd staging && zip -r ../${{ matrix.artifact }}.zip bin/

    - name: Upload to Release
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        TAG="${{ github.event.release.tag_name || github.event.inputs.tag }}"
        gh release upload "$TAG" "${{ matrix.artifact }}.zip" --clobber

    - name: Upload Build Artifact
      uses: actions/upload-artifact@v4
      with:
        name: ${{ matrix.artifact }}
        retention-days: 30
        path: ${{ matrix.artifact }}.zip

  # Build JVM version (universal, runs on any platform with JDK)
  jvm-build:
    timeout-minutes: 60
    permissions:
      contents: write
      packages: read
    runs-on: ubuntu-latest
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
    - name: Checkout Code
      uses: actions/checkout@v4
      with:
        ref: ${{ github.event.release.tag_name || github.event.inputs.tag }}

    - name: Set Up JDK 25
      uses: actions/setup-java@v4
      with:
        java-version: '25'
        distribution: temurin
        cache: sbt

    - name: Set Up SBT
      uses: sbt/setup-sbt@7e33f738678e47369c83dcb4b1d9c65d66eb3cdd # v1

    - name: Coursier Caching
      uses: coursier/cache-action@2addd381bd2c931f42d4b734b9d0c9b73aac16fb # v6

    - name: Configure sbt GitHub Packages credentials
      run: |
        mkdir -p ~/.sbt/1.0
        cat > ~/.sbt/1.0/github.sbt << 'CREDSEOF'
        credentials += Credentials(
          "GitHub Package Registry",
          "maven.pkg.github.com",
          "x-access-token",
          sys.env.getOrElse("GITHUB_TOKEN", "")
        )
        CREDSEOF

    - name: Build and Stage JVM Version
      run: |
        sbt riddlc/stage
        cd riddlc/jvm/target/universal/stage && zip -r ../../../../../riddlc.zip bin/ lib/

    - name: Upload to Release
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        TAG="${{ github.event.release.tag_name || github.event.inputs.tag }}"
        gh release upload "$TAG" riddlc.zip --clobber

    - name: Upload Build Artifact
      uses: actions/upload-artifact@v4
      with:
        name: riddlc-jvm
        retention-days: 30
        path: riddlc.zip

  # Notify homebrew-tap to update formula with new SHA256 hashes
  update-homebrew:
    needs: [native-build, jvm-build]
    timeout-minutes: 10
    runs-on: ubuntu-latest
    steps:
    - name: Download all artifacts
      uses: actions/download-artifact@v4
      with:
        path: artifacts

    - name: Compute SHA256 hashes
      id: hashes
      run: |
        echo "macos_arm64=$(shasum -a 256 artifacts/riddlc-macos-arm64/riddlc-macos-arm64.zip | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
        echo "linux_x86=$(shasum -a 256 artifacts/riddlc-linux-x86_64/riddlc-linux-x86_64.zip | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
        echo "jvm=$(shasum -a 256 artifacts/riddlc-jvm/riddlc.zip | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"

    - name: Dispatch formula update to homebrew-tap
      uses: peter-evans/repository-dispatch@v3
      with:
        token: ${{ secrets.HOMEBREW_TAP_SECRET }}
        repository: ossuminc/homebrew-tap
        event-type: update-formula
        client-payload: >-
          {
            "version": "${{ github.event.release.tag_name || github.event.inputs.tag }}",
            "sha_macos_arm64": "${{ steps.hashes.outputs.macos_arm64 }}",
            "sha_linux_x86": "${{ steps.hashes.outputs.linux_x86 }}",
            "sha_jvm": "${{ steps.hashes.outputs.jvm }}"
          }