publish.yml

name: publish

on:
  workflow_dispatch:

concurrency:
  group: publish-tetherto
  cancel-in-progress: false

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: lts/*

      - run: npm install -g bare-runtime bare-make
      - run: npm clean-install
      - run: bare-make generate --platform linux --arch x64 --debug
      - run: bare-make build
      - run: bare-make install
      - run: npm run lint
      - run: npm test

  prebuild:
    needs: test
    strategy:
      matrix:
        include:
          - os: ubuntu-22.04
            platform: linux
            arch: x64
          - os: ubuntu-22.04-arm
            platform: linux
            arch: arm64
          - os: ubuntu-24.04
            platform: android
            arch: x64
            flags: -D ANDROID_STL=c++_shared
          - os: ubuntu-24.04
            platform: android
            arch: ia32
            flags: -D ANDROID_STL=c++_shared
          - os: ubuntu-24.04
            platform: android
            arch: arm64
            flags: -D ANDROID_STL=c++_shared
          - os: ubuntu-24.04
            platform: android
            arch: arm
            flags: -D ANDROID_STL=c++_shared
          - os: macos-14
            platform: darwin
            arch: x64
          - os: macos-14
            platform: darwin
            arch: arm64
          - os: macos-14
            platform: ios
            arch: arm64
          - os: macos-14
            platform: ios
            arch: arm64
            tags: -simulator
            flags: --simulator
          - os: macos-14
            platform: ios
            arch: x64
            tags: -simulator
            flags: --simulator
          - os: windows-2022
            platform: win32
            arch: x64
          - os: windows-2022
            platform: win32
            arch: arm64
    runs-on: ${{ matrix.os }}
    name: ${{ matrix.platform }}-${{ matrix.arch }}${{ matrix.tags }}
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: lts/*
      - run: choco upgrade llvm
        if: ${{ matrix.platform == 'win32' }}
      - run: choco install nasm
        if: ${{ matrix.platform == 'win32' }}
      - run: npm install -g bare-runtime bare-make
      - run: npm install
      - run: bare-make generate --platform ${{ matrix.platform }} --arch ${{ matrix.arch }} ${{ matrix.flags }}
      - run: bare-make build
      - run: bare-make install
      - uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.platform }}-${{ matrix.arch }}${{ matrix.tags }}
          path: prebuilds/*

  aar:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '17'
      - uses: android-actions/setup-android@v4
      - run: bash build-android-lib.sh
      - uses: actions/upload-artifact@v7
        with:
          name: android-aar
          path: libs/android/bare-signer-android.aar

  approve-release:
    if: "${{ github.event.pull_request.merged == true && startsWith(github.event.pull_request.title, 'Release: ') }}"
    runs-on: ubuntu-latest
    needs: [prebuild, aar]
    environment: release
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Install dependencies
        run: npm clean-install

      - name: Download prebuild artifacts
        uses: actions/download-artifact@v8
        with:
          path: prebuilds
          # Leading `!` is minimatch's negation operator. Do NOT use the
          # extglob form `!(android-aar)` — without extglob enabled in
          # @actions/artifact's matcher it parses as literal
          # `!` + `(android-aar)`, which matches every artifact whose
          # name is not the literal parenthesised string, i.e. everything
          # including android-aar itself.
          pattern: '!android-aar'
          merge-multiple: true

      - name: Download Android AAR artifact
        uses: actions/download-artifact@v8
        with:
          name: android-aar
          path: libs/android

      - name: Verify tarball contents
        # Preflight: `npm pack --dry-run` lists every file that will end up in
        # the tarball. Fail early if any prebuild or the AAR is missing so the
        # publish job does not push an incomplete package.
        run: |
          set -euo pipefail
          pack_out=$(npm pack --dry-run 2>&1)
          echo "$pack_out"
          missing=0
          for plat in linux-x64 linux-arm64 \
                      android-arm android-arm64 android-ia32 android-x64 \
                      darwin-arm64 darwin-x64 \
                      ios-arm64 ios-arm64-simulator ios-x64-simulator \
                      win32-x64 win32-arm64; do
            if ! echo "$pack_out" | grep -qF "prebuilds/$plat/tetherto__wdk-signer-local.bare"; then
              echo "Missing prebuild: $plat"
              missing=$((missing + 1))
            fi
          done
          if ! echo "$pack_out" | grep -qF "libs/android/bare-signer-android.aar"; then
            echo "Missing Android AAR"
            missing=$((missing + 1))
          fi
          if [ "$missing" -gt 0 ]; then
            echo "Tarball verification failed: $missing missing entries"
            exit 1
          fi


      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: lts/*
          registry-url: 'https://registry.npmjs.org'
      - run: |
          VERSION=$(node -p "require('./package.json').version")
          npm version $VERSION --no-git-tag-version --allow-same-version
          git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git
          if ! git ls-remote --tags origin | grep -q "refs/tags/v$VERSION$"; then
            git tag "v$VERSION"
            git push origin "v$VERSION"
          fi
          npm publish --access public --provenance --tag latest --ignore-scripts
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}