binaries.yml

name: Binaries

on:
  release:
    types: [published]
  pull_request:

concurrency:
  group:
    ${{ github.workflow }}-${{ github.ref_protected == 'true' && github.sha ||
    github.ref }}-{{ github.event_name	}}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

permissions:
  id-token: write
  contents: write
  attestations: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        crate:
          - name: stellar-cli
            binary: stellar
        sys:
          - os: ubuntu-22.04 # Use 22 to get an older version of glibc for increased compat
            target: x86_64-unknown-linux-gnu
          - os: ubuntu-22.04-arm # Use 22 to get an older version of glibc for increased compat
            target: aarch64-unknown-linux-gnu
    runs-on: ${{ matrix.sys.os }}
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/build-binary
        with:
          target: ${{ matrix.sys.target }}
          crate-name: ${{ matrix.crate.name }}
          binary-name: ${{ matrix.crate.binary }}

  build-macos:
    if:
      github.event_name == 'release' || github.ref == 'refs/heads/main' ||
      startsWith(github.ref, 'refs/heads/release/') || startsWith(github.head_ref, 'release/')
    strategy:
      fail-fast: false
      matrix:
        crate:
          - name: stellar-cli
            binary: stellar
        sys:
          - os: macos-15
            target: aarch64-apple-darwin
          - os: macos-15-intel
            target: x86_64-apple-darwin
    runs-on: ${{ matrix.sys.os }}
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/build-binary
        with:
          target: ${{ matrix.sys.target }}
          crate-name: ${{ matrix.crate.name }}
          binary-name: ${{ matrix.crate.binary }}

  build-windows:
    if:
      github.event_name == 'release' || github.ref == 'refs/heads/main' ||
      startsWith(github.ref, 'refs/heads/release/') || startsWith(github.head_ref, 'release/')
    strategy:
      fail-fast: false
      matrix:
        crate:
          - name: stellar-cli
            binary: stellar
        sys:
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            ext: .exe
    runs-on: ${{ matrix.sys.os }}
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/build-binary
        with:
          target: ${{ matrix.sys.target }}
          crate-name: ${{ matrix.crate.name }}
          binary-name: ${{ matrix.crate.binary }}
          binary-ext: ${{ matrix.sys.ext }}

  deb:
    needs: [build]
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            arch: amd64
            os: ubuntu-22.04
          - target: aarch64-unknown-linux-gnu
            arch: arm64
            os: ubuntu-22.04-arm
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6

      - name: Setup vars
        run: |
          version="$(cargo metadata --format-version 1 --no-deps | jq -r '.packages[] | select(.name == "stellar-cli") | .version')"
          echo "VERSION=${version}" >> $GITHUB_ENV
          echo "ARTIFACT_NAME=stellar-cli-${version}-${{ matrix.target }}.tar.gz" >> $GITHUB_ENV
          echo "DEB_NAME=stellar-cli_${version}_${{ matrix.arch }}.deb" >> $GITHUB_ENV
          echo "DEB_PKG_DIR=stellar-cli_${version}_${{ matrix.arch }}" >> $GITHUB_ENV

      - name: Download Artifact
        uses: actions/download-artifact@v8.0.1
        with:
          name: ${{ env.ARTIFACT_NAME }}

      - name: Build deb
        run: |
          mkdir -p ${{ env.DEB_PKG_DIR }}/usr/bin
          mkdir -p ${{ env.DEB_PKG_DIR }}/DEBIAN
          tar xzvf ${{ env.ARTIFACT_NAME }} -C ${{ env.DEB_PKG_DIR }}/usr/bin

          cat > ${{ env.DEB_PKG_DIR }}/DEBIAN/control <<EOF
          Package: stellar-cli
          Version: ${{ env.VERSION }}
          Section: utils
          Priority: optional
          Architecture: ${{ matrix.arch }}
          Depends: libc6, libdbus-1-3, libudev1, libssl3
          Maintainer: Stellar Development Foundation <info@stellar.org>
          Homepage: https://github.com/stellar/stellar-cli
          Description: Stellar CLI
           Command-line interface for interacting with the Stellar network.
          EOF

          dpkg-deb --root-owner-group --build ${{ env.DEB_PKG_DIR }}

      - name: Validate deb
        run: |
          dpkg-deb --info ${{ env.DEB_NAME }}
          dpkg-deb --contents ${{ env.DEB_NAME }}
          sudo dpkg -i ${{ env.DEB_NAME }}
          stellar --version

      - name: Upload Artifact
        uses: ./.github/actions/artifact-upload
        with:
          name: ${{ env.DEB_NAME }}
          path: ${{ env.DEB_NAME }}

  installer:
    needs: [build, build-macos, build-windows]
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v6

      - name: Setup vars
        run: |
          version="$(cargo metadata --format-version 1 --no-deps | jq -r '.packages[] | select(.name == "stellar-cli") | .version')"
          installer_basename="stellar-cli-installer-${version}-x86_64-pc-windows-msvc"
          echo "VERSION=${version}" >> $GITHUB_ENV
          echo "STELLAR_CLI_INSTALLER_BASENAME=${installer_basename}" >> $GITHUB_ENV
          echo "STELLAR_CLI_INSTALLER=${installer_basename}.exe" >> $GITHUB_ENV
          echo "ARTIFACT_NAME=stellar-cli-${version}-x86_64-pc-windows-msvc.tar.gz" >> $GITHUB_ENV
          echo "SM_CLIENT_CERT_FILE=D:\\sm_client_cert.p12" >> "$GITHUB_ENV"

      - name: Download Artifact
        uses: actions/download-artifact@v8.0.1
        with:
          name: ${{ env.ARTIFACT_NAME }}

      - name: Uncompress Artifact
        run: tar xvf ${{ env.ARTIFACT_NAME }}

      - shell: powershell
        run: winget install --id JRSoftware.InnoSetup --scope machine --silent --accept-package-agreements --accept-source-agreements --force

      - shell: powershell
        run: |
          $innoPath = "C:\Program Files (x86)\Inno Setup 6"
          echo $innoPath | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

      - name: Build Installer
        shell: powershell
        run: |
          $Env:STELLAR_CLI_VERSION = "${{ env.VERSION }}"
          ISCC.exe installer.iss
          mv Output/stellar-installer.exe ${{ env.STELLAR_CLI_INSTALLER }}

      - name: Setup SM_CLIENT_CERT_FILE
        run: |
          echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/sm_client_cert.p12
        shell: bash

      - name: Setup Software Trust Manager
        env:
          SM_HOST: https://clientauth.one.digicert.com
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
        if:
          github.event_name == 'release' || startsWith(github.ref, 'refs/heads/release/') || startsWith(github.head_ref, 'release/')
        id: stm-setup
        uses: digicert/code-signing-software-trust-action@v1.2.0
        with:
          simple-signing-mode: true
          keypair-alias: key_1412258126
          input: ${{ env.STELLAR_CLI_INSTALLER }}

      - name: Upload Artifact
        uses: ./.github/actions/artifact-upload
        with:
          name: ${{ env.STELLAR_CLI_INSTALLER }}
          path: ${{ env.STELLAR_CLI_INSTALLER }}