publish.yml

name: Publish

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  LINUX_GLIBC_VERSION: "2.17"

jobs:
  build-napi:
    name: Build NAPI - ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            target: x86_64-apple-darwin
            platform: darwin-x64
          - os: macos-latest
            target: aarch64-apple-darwin
            platform: darwin-arm64
          - os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            platform: linux-x64-gnu
          - os: ubuntu-22.04
            target: x86_64-unknown-linux-musl
            platform: linux-x64-musl
          - os: blacksmith-32vcpu-ubuntu-2404
            target: aarch64-unknown-linux-gnu
            platform: linux-arm64-gnu
          - os: blacksmith-32vcpu-ubuntu-2404
            target: aarch64-unknown-linux-musl
            platform: linux-arm64-musl
          - os: windows-2025
            target: x86_64-pc-windows-msvc
            platform: win32-x64-msvc

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1.15.0
        with:
          node-version-file: ".node-version"
          cache: true
          run-install: true

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          targets: ${{ matrix.target }}

      - name: Mount sticky cache
        if: startsWith(matrix.os, 'blacksmith-')
        uses: ./.github/actions/mount-sticky-cache
        with:
          key-prefix: ${{ github.repository }}-publish-${{ github.job }}-${{ matrix.target }}
          cargo: "true"
          target: target

      - name: Install zig (Linux)
        if: contains(matrix.target, 'unknown-linux')
        run: |
          curl --retry 5 --retry-delay 5 --retry-all-errors -fsSL https://ziglang.org/download/0.13.0/zig-linux-x86_64-0.13.0.tar.xz -o zig.tar.xz
          tar -xf zig.tar.xz
          echo "$PWD/zig-linux-x86_64-0.13.0" >> "$GITHUB_PATH"

      - name: Install cargo-zigbuild (Linux)
        if: contains(matrix.target, 'unknown-linux')
        run: cargo install cargo-zigbuild

      - name: Build NAPI (Linux)
        if: contains(matrix.target, 'unknown-linux')
        working-directory: crates/ox_content_napi
        shell: bash
        run: |
          set -euo pipefail

          build_target="${{ matrix.target }}"
          if [[ "${{ matrix.target }}" == *-unknown-linux-gnu ]]; then
            build_target="${build_target}.${LINUX_GLIBC_VERSION}"
          else
            export RUSTFLAGS="${RUSTFLAGS:-} -C target-feature=-crt-static"
          fi

          cargo zigbuild --release --target "$build_target"

          src="../../target/${{ matrix.target }}/release/libox_content_napi.so"
          if [[ ! -f "$src" ]]; then
            src="../../target/${build_target}/release/libox_content_napi.so"
          fi
          cp "$src" "ox-content.${{ matrix.platform }}.node"

      - name: Verify Linux native dependencies
        if: contains(matrix.target, 'unknown-linux')
        shell: bash
        run: |
          set -euo pipefail

          node_file="crates/ox_content_napi/ox-content.${{ matrix.platform }}.node"

          if [[ "${{ matrix.target }}" == *-unknown-linux-gnu ]]; then
            max_glibc="$(
              readelf --version-info "$node_file" |
                sed -n 's/.*Name: GLIBC_\([0-9.]*\).*/\1/p' |
                sort -V |
                tail -1
            )"
            echo "max GLIBC version: ${max_glibc:-none}"
            if [[ -n "$max_glibc" ]] &&
              [[ "$(printf '%s\n' "$LINUX_GLIBC_VERSION" "$max_glibc" | sort -V | tail -1)" != "$LINUX_GLIBC_VERSION" ]]; then
              echo "::error::${node_file} requires GLIBC_${max_glibc}, expected <= GLIBC_${LINUX_GLIBC_VERSION}"
              exit 1
            fi
          else
            if readelf --version-info "$node_file" | grep -q 'GLIBC_'; then
              echo "::error::${node_file} unexpectedly references GLIBC symbols"
              exit 1
            fi
          fi

      - name: Build NAPI
        if: ${{ !contains(matrix.target, 'unknown-linux') }}
        working-directory: crates/ox_content_napi
        run: vp exec -- napi build --release --target ${{ matrix.target }}

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: napi-${{ matrix.target }}
          path: crates/ox_content_napi/*.node
          if-no-files-found: error

  publish-napi:
    name: Publish @ox-content/napi
    runs-on: ubuntu-latest
    needs: build-napi
    # The npm environment is part of the trusted publisher identity: each
    # package's publisher on npmjs.com names this repository, the workflow file,
    # and this environment. Renaming any of them stops publishing until the
    # publisher entry is updated to match.
    environment: npm
    permissions:
      contents: read
      # Mints the OIDC token npm exchanges for a short-lived publish
      # credential. This is the only credential in play — there is no
      # long-lived npm token in the repository's secrets.
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1.15.0
        with:
          node-version-file: ".node-version"
          cache: true
          run-install: true

      - name: Setup npm registry
        run: npm config set registry https://registry.npmjs.org

      # Trusted publishing needs 11.5.1 at minimum; the runner's bundled npm
      # trails that. No auth token is configured: npm detects the Actions OIDC
      # token and exchanges it for a publish credential itself, and it also
      # generates provenance automatically on that path.
      - name: Install npm with trusted publishing support
        run: npm install -g npm@^11.5.1

      - name: Download all artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: napi-*
          path: crates/ox_content_napi/artifacts

      # napi-cli 3.8 rejects managed paths that escape the boundary it discovers
      # from its cwd, so point --cwd at the workspace root and keep every path
      # relative to it. `binding-packages` then resolves inside the pnpm
      # workspace instead of escaping the crate directory.
      - name: Create npm sub-package directories
        working-directory: crates/ox_content_napi
        run: >-
          vp exec -- napi create-npm-dirs --cwd ../..
          --package-json-path crates/ox_content_napi/package.json
          --npm-dir binding-packages

      - name: Move artifacts to sub-packages
        working-directory: crates/ox_content_napi
        run: |
          declare -A target_map=(
            ["x86_64-apple-darwin"]="darwin-x64"
            ["aarch64-apple-darwin"]="darwin-arm64"
            ["x86_64-unknown-linux-gnu"]="linux-x64-gnu"
            ["x86_64-unknown-linux-musl"]="linux-x64-musl"
            ["aarch64-unknown-linux-gnu"]="linux-arm64-gnu"
            ["aarch64-unknown-linux-musl"]="linux-arm64-musl"
            ["x86_64-pc-windows-msvc"]="win32-x64-msvc"
          )
          for dir in artifacts/napi-*; do
            target="${dir##*/napi-}"
            platform="${target_map[$target]}"
            if [ -n "$platform" ]; then
              for f in "$dir"/*.node; do
                cp "$f" "../../binding-packages/${platform}/ox-content.${platform}.node"
              done
            fi
          done
          echo "=== Verify binding packages ==="
          for pkg in ../../binding-packages/*/; do
            ls -la "$pkg"*.node 2>/dev/null || echo "WARNING: No .node file in $pkg"
          done

      - name: Determine npm tag
        id: npm-tag
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          if [[ "$VERSION" == *"-"* ]]; then
            PRE_ID="${VERSION#*-}"
            TAG="${PRE_ID%%.*}"
          else
            TAG="latest"
          fi

          if [[ ! "$TAG" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then
            echo "::error::Invalid npm dist-tag: $TAG"
            exit 1
          fi

          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "NPM_TAG=$TAG" >> "$GITHUB_ENV"

      - name: Update optionalDependencies
        working-directory: crates/ox_content_napi
        run: >-
          vp exec -- napi pre-publish -t npm --cwd ../..
          --package-json-path crates/ox_content_napi/package.json
          --npm-dir binding-packages --no-gh-release --skip-optional-publish

      - name: Publish binding sub-packages
        run: |
          publish_if_needed() {
            local pkg_name pkg_version
            pkg_name=$(node -p "require('./package.json').name")
            pkg_version=$(node -p "require('./package.json').version")

            if npm view "${pkg_name}@${pkg_version}" version >/dev/null 2>&1; then
              echo "Skipping ${pkg_name}@${pkg_version} (already published)"
              return 0
            fi

            npm publish --provenance --access public --tag "$NPM_TAG"
          }

          for pkg in binding-packages/*/; do
            if [ -f "$pkg/package.json" ]; then
              echo "Publishing $(basename $pkg)..."
              (cd "$pkg" && publish_if_needed)
            fi
          done

      - name: Publish @ox-content/napi
        working-directory: crates/ox_content_napi
        run: |
          PKG_NAME=$(node -p "require('./package.json').name")
          PKG_VERSION=$(node -p "require('./package.json').version")
          if npm view "${PKG_NAME}@${PKG_VERSION}" version >/dev/null 2>&1; then
            echo "Skipping ${PKG_NAME}@${PKG_VERSION} (already published)"
            exit 0
          fi
          npm publish --provenance --access public --tag "$NPM_TAG"

  publish-packages:
    name: Publish npm packages
    runs-on: ubuntu-latest
    needs: publish-napi
    # The npm environment is part of the trusted publisher identity: each
    # package's publisher on npmjs.com names this repository, the workflow file,
    # and this environment. Renaming any of them stops publishing until the
    # publisher entry is updated to match.
    environment: npm
    permissions:
      contents: read
      # Mints the OIDC token npm exchanges for a short-lived publish
      # credential. This is the only credential in play — there is no
      # long-lived npm token in the repository's secrets.
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1.15.0
        with:
          node-version-file: ".node-version"
          cache: true
          run-install: true

      - name: Setup npm registry
        run: npm config set registry https://registry.npmjs.org

      # Trusted publishing needs 11.5.1 at minimum; the runner's bundled npm
      # trails that. No auth token is configured: npm detects the Actions OIDC
      # token and exchanges it for a publish credential itself, and it also
      # generates provenance automatically on that path.
      - name: Install npm with trusted publishing support
        run: npm install -g npm@^11.5.1

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          targets: wasm32-unknown-unknown

      - name: Build NAPI (for local use)
        run: vp run build:napi

      - name: Install wasm-pack
        run: cargo install wasm-pack --locked

      - name: Build packages
        run: vp run build:npm

      - name: Build WASM package
        run: vp run build:wasm

      - name: Determine npm tag
        id: npm-tag
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          if [[ "$VERSION" == *"-"* ]]; then
            PRE_ID="${VERSION#*-}"
            TAG="${PRE_ID%%.*}"
          else
            TAG="latest"
          fi

          if [[ ! "$TAG" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then
            echo "::error::Invalid npm dist-tag: $TAG"
            exit 1
          fi

          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "NPM_TAG=$TAG" >> "$GITHUB_ENV"

      - name: Publish @ox-content/islands
        working-directory: npm/ox-content-islands
        run: |
          PKG_NAME=$(node -p "require('./package.json').name")
          PKG_VERSION=$(node -p "require('./package.json').version")
          if npm view "${PKG_NAME}@${PKG_VERSION}" version >/dev/null 2>&1; then
            echo "Skipping ${PKG_NAME}@${PKG_VERSION} (already published)"
            exit 0
          fi
          TARBALL=$(vp exec -- pnpm pack --pack-destination /tmp | tail -1)
          npm publish "$TARBALL" --provenance --access public --tag "$NPM_TAG"

      - name: Publish @ox-content/vite-plugin
        working-directory: npm/vite-plugin-ox-content
        run: |
          PKG_NAME=$(node -p "require('./package.json').name")
          PKG_VERSION=$(node -p "require('./package.json').version")
          if npm view "${PKG_NAME}@${PKG_VERSION}" version >/dev/null 2>&1; then
            echo "Skipping ${PKG_NAME}@${PKG_VERSION} (already published)"
            exit 0
          fi
          TARBALL=$(vp exec -- pnpm pack --pack-destination /tmp | tail -1)
          npm publish "$TARBALL" --provenance --access public --tag "$NPM_TAG"

      - name: Publish @ox-content/unplugin
        working-directory: npm/unplugin-ox-content
        run: |
          PKG_NAME=$(node -p "require('./package.json').name")
          PKG_VERSION=$(node -p "require('./package.json').version")
          if npm view "${PKG_NAME}@${PKG_VERSION}" version >/dev/null 2>&1; then
            echo "Skipping ${PKG_NAME}@${PKG_VERSION} (already published)"
            exit 0
          fi
          TARBALL=$(vp exec -- pnpm pack --pack-destination /tmp | tail -1)
          npm publish "$TARBALL" --provenance --access public --tag "$NPM_TAG"

      - name: Publish @ox-content/vite-plugin-vue
        working-directory: npm/vite-plugin-ox-content-vue
        run: |
          PKG_NAME=$(node -p "require('./package.json').name")
          PKG_VERSION=$(node -p "require('./package.json').version")
          if npm view "${PKG_NAME}@${PKG_VERSION}" version >/dev/null 2>&1; then
            echo "Skipping ${PKG_NAME}@${PKG_VERSION} (already published)"
            exit 0
          fi
          TARBALL=$(vp exec -- pnpm pack --pack-destination /tmp | tail -1)
          npm publish "$TARBALL" --provenance --access public --tag "$NPM_TAG"

      - name: Publish @ox-content/vite-plugin-react
        working-directory: npm/vite-plugin-ox-content-react
        run: |
          PKG_NAME=$(node -p "require('./package.json').name")
          PKG_VERSION=$(node -p "require('./package.json').version")
          if npm view "${PKG_NAME}@${PKG_VERSION}" version >/dev/null 2>&1; then
            echo "Skipping ${PKG_NAME}@${PKG_VERSION} (already published)"
            exit 0
          fi
          TARBALL=$(vp exec -- pnpm pack --pack-destination /tmp | tail -1)
          npm publish "$TARBALL" --provenance --access public --tag "$NPM_TAG"

      - name: Publish @ox-content/vite-plugin-solid
        working-directory: npm/vite-plugin-ox-content-solid
        run: |
          PKG_NAME=$(node -p "require('./package.json').name")
          PKG_VERSION=$(node -p "require('./package.json').version")
          if npm view "${PKG_NAME}@${PKG_VERSION}" version >/dev/null 2>&1; then
            echo "Skipping ${PKG_NAME}@${PKG_VERSION} (already published)"
            exit 0
          fi
          TARBALL=$(vp exec -- pnpm pack --pack-destination /tmp | tail -1)
          npm publish "$TARBALL" --provenance --access public --tag "$NPM_TAG"

      - name: Publish @ox-content/vite-plugin-svelte
        working-directory: npm/vite-plugin-ox-content-svelte
        run: |
          PKG_NAME=$(node -p "require('./package.json').name")
          PKG_VERSION=$(node -p "require('./package.json').version")
          if npm view "${PKG_NAME}@${PKG_VERSION}" version >/dev/null 2>&1; then
            echo "Skipping ${PKG_NAME}@${PKG_VERSION} (already published)"
            exit 0
          fi
          TARBALL=$(vp exec -- pnpm pack --pack-destination /tmp | tail -1)
          npm publish "$TARBALL" --provenance --access public --tag "$NPM_TAG"

      - name: Publish @ox-content/wasm
        working-directory: crates/ox_content_wasm/pkg
        run: |
          PKG_NAME=$(node -p "require('./package.json').name")
          PKG_VERSION=$(node -p "require('./package.json').version")
          if npm view "${PKG_NAME}@${PKG_VERSION}" version >/dev/null 2>&1; then
            echo "Skipping ${PKG_NAME}@${PKG_VERSION} (already published)"
            exit 0
          fi
          npm publish --provenance --access public --tag "$NPM_TAG"

  publish-crates:
    name: Publish to crates.io
    runs-on: blacksmith-32vcpu-ubuntu-2404
    environment: crates.io
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Authenticate with crates.io
        id: crates-io-auth
        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5

      - name: Publish crates (in dependency order)
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}
        run: |
          VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)

          crate_exists() {
            local crate="$1"
            curl -fsSL -A "ox-content-release" "https://crates.io/api/v1/crates/${crate}/${VERSION}" >/dev/null
          }

          publish_crate() {
            local crate="$1"
            shift

            if crate_exists "$crate"; then
              echo "Skipping ${crate}@${VERSION} (already published)"
              return 0
            fi

            if cargo publish -p "$crate" --allow-dirty "$@"; then
              return 0
            fi

            if crate_exists "$crate"; then
              echo "Skipping ${crate}@${VERSION} (published despite non-zero cargo publish exit)"
              return 0
            fi

            echo "::error::Failed to publish ${crate}@${VERSION}"
            return 1
          }

          # Publish in dependency order with delays for crates.io index update
          publish_crate ox_content_allocator
          sleep 30
          publish_crate ox_content_ast
          sleep 30
          publish_crate ox_content_profiler
          sleep 30
          publish_crate ox_content_parser --config 'patch.crates-io.ox_content_renderer.path="crates/ox_content_renderer"'
          sleep 30
          publish_crate ox_content_mdast
          sleep 30
          publish_crate ox_content_renderer
          sleep 30
          publish_crate ox_content_incremental
          sleep 30
          publish_crate ox_content_og_image
          sleep 30
          publish_crate ox_content_transform
          sleep 30
          publish_crate ox_content_search
          sleep 30
          publish_crate ox_content_ssg
          sleep 30
          publish_crate ox_content_docs
          sleep 30
          publish_crate ox_content_vite

  create-release:
    name: Create GitHub Release
    runs-on: blacksmith-32vcpu-ubuntu-2404
    needs: [publish-packages, publish-crates]
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Create Release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REF_NAME: ${{ github.ref_name }}
        run: |
          if gh release view "$GH_REF_NAME" >/dev/null 2>&1; then
            echo "Release $GH_REF_NAME already exists; skipping."
            exit 0
          fi
          gh release create "$GH_REF_NAME" --generate-notes