release.yml

name: Release

on:
  workflow_dispatch:
  push:
    tags: ['v*']

env:
  CARGO_TERM_COLOR: always

jobs:
  hygiene:
    name: Hygiene
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Check public tree contains no dev-meta paths
      shell: bash
      run: ./scripts/check_tree_clean.sh

  build:
    name: Build Release
    needs: hygiene
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            artifact_name: tslime
            asset_name: tslime-linux-x86_64
          - os: macos-latest
            target: aarch64-apple-darwin
            artifact_name: tslime
            asset_name: tslime-macos-arm64
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact_name: tslime.exe
            asset_name: tslime-windows-x86_64.exe

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Install Rust toolchain
      uses: dtolnay/rust-toolchain@stable
      with:
        targets: ${{ matrix.target }}

    - name: Install musl tools (Linux)
      if: runner.os == 'Linux'
      run: sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends musl-tools

    - name: Cache cargo registry
      uses: actions/cache@v4
      with:
        path: ~/.cargo/registry
        key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}

    - name: Cache cargo index
      uses: actions/cache@v4
      with:
        path: ~/.cargo/git
        key: ${{ runner.os }}-cargo-index-${{ hashFiles('**/Cargo.lock') }}

    - name: Cache cargo build
      uses: actions/cache@v4
      with:
        path: target
        key: ${{ runner.os }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}

    - name: Build release binary
      run: cargo build --release --verbose --target ${{ matrix.target }}

    - name: Check binary size
      if: runner.os == 'Linux'
      run: |
        BIN="target/${{ matrix.target }}/release/tslime"
        size "$BIN" || true
        SIZE=$(stat -c%s "$BIN")
        MAX_SIZE=4000000
        if [ "$SIZE" -gt "$MAX_SIZE" ]; then
          echo "Binary size $SIZE exceeds $MAX_SIZE limit"
          exit 1
        fi
        echo "Binary size $SIZE is under $MAX_SIZE limit"

    # Stage the binary under its release asset name so the downloaded artifact
    # is named correctly for `gh release create` (no post-download rename).
    - name: Stage binary
      shell: bash
      run: |
        mkdir -p dist
        cp "target/${{ matrix.target }}/release/${{ matrix.artifact_name }}" "dist/${{ matrix.asset_name }}"

    - name: Upload artifact
      uses: actions/upload-artifact@v4
      with:
        name: ${{ matrix.asset_name }}
        path: dist/${{ matrix.asset_name }}

  gui-build:
    name: GUI Build
    needs: hygiene
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        include:
          - os: ubuntu-latest
            artifact_name: tslime
            asset_name: tslime-gui-linux-x86_64
          - os: macos-latest
            artifact_name: tslime
            asset_name: tslime-gui-macos
          - os: windows-latest
            artifact_name: tslime.exe
            asset_name: tslime-gui-windows.exe

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Install Rust toolchain
      uses: dtolnay/rust-toolchain@stable

    - name: Install Linux GUI dependencies
      if: runner.os == 'Linux'
      run: |
        sudo apt-get update -qq
        sudo apt-get install -y --no-install-recommends \
          libxkbcommon-dev \
          libwayland-dev \
          libx11-dev libxcursor-dev libxrandr-dev libxi-dev \
          libvulkan-dev mesa-vulkan-drivers \
          libfontconfig1-dev libfreetype6-dev \
          libegl1-mesa-dev

    - name: Cache cargo registry
      uses: actions/cache@v4
      with:
        path: ~/.cargo/registry
        key: ${{ runner.os }}-cargo-registry-gui-${{ hashFiles('**/Cargo.lock') }}

    - name: Cache cargo index
      uses: actions/cache@v4
      with:
        path: ~/.cargo/git
        key: ${{ runner.os }}-cargo-index-gui-${{ hashFiles('**/Cargo.lock') }}

    - name: Cache cargo build
      uses: actions/cache@v4
      with:
        path: target
        key: ${{ runner.os }}-cargo-build-gui-${{ hashFiles('**/Cargo.lock') }}

    - name: Build GUI binary
      run: cargo build --release --features gui --verbose

    - name: Upload artifact
      uses: actions/upload-artifact@v4
      with:
        name: ${{ matrix.asset_name }}
        path: target/release/${{ matrix.artifact_name }}

  # Build the WebAssembly package (tslime-wasm) and pack it as a release asset.
  # Downstream sites (e.g. the personal site) fetch `tslime-wasm.tar.gz` from the
  # latest release and extract the wasm-pack `pkg/` to embed the in-browser sim.
  wasm-build:
    name: WASM Build
    needs: hygiene
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Install Rust toolchain (wasm target)
      uses: dtolnay/rust-toolchain@stable
      with:
        targets: wasm32-unknown-unknown

    - name: Install wasm-pack
      uses: jetli/wasm-pack-action@v0.4.0
      with:
        version: latest

    - name: Build WASM package
      working-directory: tslime-wasm
      run: wasm-pack build --target web --out-dir pkg

    - name: Pack pkg as tarball
      run: |
        mkdir -p dist
        # Files sit at the tarball root so consumers extract straight into their
        # lib dir: `tar -xzf tslime-wasm.tar.gz -C <dest>/`.
        tar -czf dist/tslime-wasm.tar.gz -C tslime-wasm/pkg .

    - name: Upload artifact
      uses: actions/upload-artifact@v4
      with:
        name: tslime-wasm.tar.gz
        path: dist/tslime-wasm.tar.gz

  # Publish a GitHub Release with the CLI binaries attached and notes pulled
  # from the matching CHANGELOG section. Tag pushes only (skipped for manual
  # workflow_dispatch runs, which have no tag to release).
  release:
    name: Publish GitHub Release
    needs: [build, wasm-build]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Download Linux binary
      uses: actions/download-artifact@v4
      with:
        name: tslime-linux-x86_64
        path: dist

    - name: Download Windows binary
      uses: actions/download-artifact@v4
      with:
        name: tslime-windows-x86_64.exe
        path: dist

    - name: Download WASM tarball
      uses: actions/download-artifact@v4
      with:
        name: tslime-wasm.tar.gz
        path: dist

    - name: Extract release notes from CHANGELOG
      shell: bash
      run: |
        version="${GITHUB_REF_NAME#v}"
        awk -v v="$version" '
          $0 ~ ("^## \\[" v "\\]") { found=1; next }
          found && /^## \[/ { exit }
          found { print }
        ' CHANGELOG.md > RELEASE_NOTES.md
        if [ ! -s RELEASE_NOTES.md ]; then
          printf 'tslime %s\n' "$GITHUB_REF_NAME" > RELEASE_NOTES.md
        fi

    - name: Create GitHub Release
      env:
        GH_TOKEN: ${{ github.token }}
      shell: bash
      run: |
        gh release create "$GITHUB_REF_NAME" \
          --repo "$GITHUB_REPOSITORY" \
          --title "tslime $GITHUB_REF_NAME" \
          --notes-file RELEASE_NOTES.md \
          dist/tslime-linux-x86_64 \
          dist/tslime-windows-x86_64.exe \
          dist/tslime-wasm.tar.gz

  # Publish the crate to crates.io so `cargo install tslime` and the Homebrew
  # source build stay in lockstep with the tagged release. Tag pushes only.
  # Runs after build so a broken compile never reaches the registry; the publish
  # is irreversible (a version cannot be overwritten), so this is the last gate.
  # Requires the CARGO_REGISTRY_TOKEN secret (a crates.io publish-update token).
  publish-crate:
    name: Publish to crates.io
    needs: build
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Install Rust toolchain
      uses: dtolnay/rust-toolchain@stable

    - name: Verify tag matches Cargo.toml version
      shell: bash
      run: |
        tag_version="${GITHUB_REF_NAME#v}"
        cargo_version="$(cargo metadata --no-deps --format-version 1 \
          | python3 -c 'import sys,json; print(json.load(sys.stdin)["packages"][0]["version"])')"
        if [ "$tag_version" != "$cargo_version" ]; then
          echo "Tag $GITHUB_REF_NAME does not match Cargo.toml version $cargo_version"
          exit 1
        fi
        echo "Tag and Cargo.toml agree on $cargo_version"

    - name: Publish
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: cargo publish

  # Publish a container image to GHCR so users can `docker run --rm -it
  # ghcr.io/<owner>/tslime` without installing anything. Self-contained build
  # (the Dockerfile compiles the static musl binary onto a scratch image). Tag
  # pushes only. linux/amd64; arm64 is a follow-up.
  docker:
    name: Publish Docker image
    needs: hygiene
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Log in to GitHub Container Registry
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Build and push image
      uses: docker/build-push-action@v6
      with:
        context: .
        platforms: linux/amd64
        push: true
        tags: |
          ghcr.io/${{ github.repository }}:latest
          ghcr.io/${{ github.repository }}:${{ github.ref_name }}