release.yml

name: Release

on:
  release:
    types: [published]
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag to build (e.g. v0.4.0)'
        required: true
        default: 'v0.4.0'

permissions:
  contents: write
  packages: write

env:
  CARGO_TERM_COLOR: always

jobs:
  publish-crate:
    name: Publish to crates.io
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libsasl2-dev \
            libssl-dev \
            libzstd-dev \
            libcurl4-openssl-dev \
            cmake \
            pkg-config \
            clang \
            libclang-dev

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Publish to crates.io
        run: |
          OUTPUT=$(cargo publish --locked --token ${CARGO_REGISTRY_TOKEN} 2>&1) && echo "$OUTPUT" || {
            echo "$OUTPUT"
            echo "$OUTPUT" | grep -q "already exists\|already uploaded" && echo "Already published, skipping." || exit 1
          }
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  build-release-binaries:
    name: Build Release Binaries (${{ matrix.asset_name }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            asset_name: streamforge-linux-x86_64
            docker_arch: amd64

          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            asset_name: streamforge-linux-aarch64
            docker_arch: arm64

          - os: macos-latest
            target: aarch64-apple-darwin
            asset_name: streamforge-macos-aarch64
            docker_arch: ""

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Install system dependencies (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libsasl2-dev \
            libssl-dev \
            libzstd-dev \
            libcurl4-openssl-dev \
            cmake \
            pkg-config \
            clang \
            libclang-dev

      - name: Install dependencies (macOS)
        if: runner.os == 'macOS'
        run: |
          brew install openssl@3 cyrus-sasl
          echo "OPENSSL_DIR=$(brew --prefix openssl@3)" >> $GITHUB_ENV
          echo "PKG_CONFIG_PATH=$(brew --prefix openssl@3)/lib/pkgconfig:$(brew --prefix cyrus-sasl)/lib/pkgconfig" >> $GITHUB_ENV

      - name: Build release binary
        run: cargo build --release --locked --target ${{ matrix.target }}

      - name: Smoke-test WebAssembly UDF startup
        run: >-
          target/${{ matrix.target }}/release/streamforge-validate
          tests/fixtures/wasm/release-smoke.yaml

      - name: Strip binary (Linux only)
        if: runner.os == 'Linux'
        run: strip target/${{ matrix.target }}/release/streamforge

      - name: Upload binary to release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${{ github.event.inputs.tag || github.ref_name }}"
          cp target/${{ matrix.target }}/release/streamforge ${{ matrix.asset_name }}
          gh release upload "$TAG" ${{ matrix.asset_name }} --clobber

      - name: Upload Linux binary as artifact for Docker (Linux only)
        if: matrix.docker_arch != ''
        uses: actions/upload-artifact@v4
        with:
          name: streamforge-linux-${{ matrix.docker_arch }}
          path: ${{ matrix.asset_name }}
          retention-days: 1

  build-docker-images:
    name: Build and Push Docker Images
    needs: build-release-binaries
    runs-on: ubuntu-latest
    continue-on-error: true
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Download amd64 binary
        uses: actions/download-artifact@v4
        with:
          name: streamforge-linux-amd64

      - name: Download arm64 binary
        uses: actions/download-artifact@v4
        with:
          name: streamforge-linux-arm64

      - name: Rename binaries for Dockerfile.release
        run: |
          mv streamforge-linux-x86_64 streamforge-linux-amd64
          mv streamforge-linux-aarch64 streamforge-linux-arm64

      - name: Set up QEMU (for multi-arch manifest only)
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GHCR_PAT || secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}},value=${{ github.event.inputs.tag || github.ref_name }}
            type=raw,value=latest

      - name: Build and push multi-arch Docker image (pre-built binaries)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile.release
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  build-operator-image:
    name: Build and Push Operator Image
    runs-on: ubuntu-latest
    continue-on-error: true
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GHCR_PAT || secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}-operator
          tags: |
            type=semver,pattern={{version}},value=${{ github.event.inputs.tag || github.ref_name }}
            type=raw,value=latest

      - name: Build and push Operator image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./operator/Dockerfile
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max