release.yml

name: release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  id-token: write

env:
  HOMEBREW_TAP_REPO: uchebnick/homebrew-tap

jobs:
  build:
    name: build-release-assets
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-14
            goos: darwin
            goarch: arm64
            asset_name: unch_Darwin_arm64.tar.gz
            archive_type: tar.gz
          - runner: macos-14
            goos: darwin
            goarch: amd64
            asset_name: unch_Darwin_x86_64.tar.gz
            archive_type: tar.gz
            cc: "clang -arch x86_64"
          - runner: ubuntu-latest
            goos: linux
            goarch: amd64
            asset_name: unch_Linux_x86_64.tar.gz
            archive_type: tar.gz
          - runner: ubuntu-24.04-arm
            goos: linux
            goarch: arm64
            asset_name: unch_Linux_arm64.tar.gz
            archive_type: tar.gz
          - runner: windows-latest
            goos: windows
            goarch: amd64
            asset_name: unch_Windows_x86_64.zip
            archive_type: zip
            msystem: UCRT64
            msys_pkg: mingw-w64-ucrt-x86_64-gcc
            cc: gcc
          - runner: windows-11-arm
            goos: windows
            goarch: arm64
            asset_name: unch_Windows_arm64.zip
            archive_type: zip
            msystem: CLANGARM64
            msys_pkg: mingw-w64-clang-aarch64-clang
            cc: clang
    runs-on: ${{ matrix.runner }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Setup MSYS2 toolchain
        if: runner.os == 'Windows'
        uses: msys2/setup-msys2@v2
        with:
          msystem: ${{ matrix.msystem }}
          path-type: inherit
          update: true
          install: ${{ matrix.msys_pkg }}

      - name: Build Unix archive
        if: runner.os != 'Windows'
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CC: ${{ matrix.cc || '' }}
          BUILD_VERSION: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          mkdir -p dist/build
          if [ -n "${CC}" ]; then
            export CC
          fi
          CGO_ENABLED=1 go build -trimpath \
            -ldflags "-X github.com/uchebnick/unch/internal/cli.buildVersion=${BUILD_VERSION}" \
            -o dist/build/unch ./cmd/unch
          tar -C dist/build -czf "dist/${{ matrix.asset_name }}" unch

      - name: Build Windows archive
        if: runner.os == 'Windows'
        shell: msys2 {0}
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          BUILD_VERSION: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          mkdir -p dist/build
          export CGO_ENABLED=1
          export CC="${{ matrix.cc }}"
          go build -trimpath \
            -ldflags "-X github.com/uchebnick/unch/internal/cli.buildVersion=${BUILD_VERSION}" \
            -o dist/build/unch.exe ./cmd/unch

      - name: Archive Windows asset
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          Compress-Archive -Path "dist/build/unch.exe" -DestinationPath "dist/${{ matrix.asset_name }}" -Force

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: release-assets-${{ matrix.goos }}-${{ matrix.goarch }}
          path: dist/${{ matrix.asset_name }}
          if-no-files-found: error

  go-install-tag-smoke:
    name: go-install-tag-smoke
    needs: build
    runs-on: ubuntu-latest

    steps:
      - name: Verify tagged go install path in official Go container
        shell: bash
        env:
          GITHUB_REF_NAME: ${{ github.ref_name }}
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: |
          set -euo pipefail
          docker run --rm \
            -e GITHUB_REF_NAME \
            -e GITHUB_REPOSITORY \
            golang:1.25-bookworm sh -c '
              set -eu
              export GOPROXY=direct
              go install -buildvcs=false "github.com/${GITHUB_REPOSITORY}/cmd/unch@${GITHUB_REF_NAME}"
              command -v unch
              unch --version >/dev/null
              unch --help >/dev/null
            '

  index-tag-smoke:
    name: index-tag-smoke
    needs: build
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download Linux artifact
        uses: actions/download-artifact@v8
        with:
          name: release-assets-linux-amd64
          path: dist

      - name: Build local search index from release binary
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p dist/extract
          tar -C dist/extract -xzf dist/unch_Linux_x86_64.tar.gz
          dist/extract/unch --version >/dev/null
          dist/extract/unch index --root . --state-dir "${RUNNER_TEMP}/unch-index-smoke"

  release:
    name: publish-release
    needs:
      - build
      - go-install-tag-smoke
      - index-tag-smoke
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: release-assets-*
          path: dist
          merge-multiple: true

      - name: Generate checksums
        run: |
          sha256sum dist/* > dist/checksums.txt

      - name: Prepare release notes
        run: |
          mkdir -p dist
          notes_file=".github/releases/${GITHUB_REF_NAME}.md"
          if [ -f "$notes_file" ]; then
            cp "$notes_file" dist/release-notes.md
          else
            {
              echo "# ${GITHUB_REF_NAME}"
              echo
              echo "Release published automatically from tag ${GITHUB_REF_NAME}."
            } > dist/release-notes.md
          fi

      - name: Create GitHub release
        uses: softprops/action-gh-release@v2
        with:
          name: unch ${{ github.ref_name }}
          body_path: dist/release-notes.md
          files: |
            dist/*.tar.gz
            dist/*.zip
            dist/checksums.txt

  publish-npm:
    name: publish-npm
    needs: release
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Publish npm package
        working-directory: npm/unch
        run: |
          set -euo pipefail

          version="${GITHUB_REF_NAME#v}"
          package_name="$(node -p 'require("./package.json").name')"

          npm version "${version}" --no-git-tag-version
          npm test
          npm pack --dry-run

          if npm view "${package_name}@${version}" version >/dev/null 2>&1; then
            echo "${package_name}@${version} is already published; skipping"
            exit 0
          fi

          npm publish --access public

  notify-release:
    name: notify-release
    needs:
      - release
      - publish-npm
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Render release announcement
        run: |
          set -euo pipefail
          mkdir -p dist
          python3 scripts/render_release_announcement.py \
            --tag "${GITHUB_REF_NAME}" \
            --url "https://github.com/${GITHUB_REPOSITORY}/releases/tag/${GITHUB_REF_NAME}" \
            --notes-file ".github/releases/${GITHUB_REF_NAME}.md" \
            > dist/release-announcement.txt

      - name: Upload release announcement
        uses: actions/upload-artifact@v7
        with:
          name: release-announcement
          path: dist/release-announcement.txt
          if-no-files-found: error

      - name: Send Telegram release notification
        env:
          TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
          TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
        run: |
          set -euo pipefail
          if [ -z "${TELEGRAM_BOT_TOKEN:-}" ] || [ -z "${TELEGRAM_CHAT_ID:-}" ]; then
            echo "Telegram secrets are not set; skipping notification"
            exit 0
          fi
          telegram_api="https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}"
          response_file="$(mktemp)"
          status="$(curl --silent --show-error \
            --output "${response_file}" \
            --write-out "%{http_code}" \
            -X POST "${telegram_api}/getChat" \
            --data-urlencode "chat_id=${TELEGRAM_CHAT_ID}")"
          if [ "${status}" != "200" ]; then
            cat "${response_file}" >&2
            rm -f "${response_file}"
            echo "Telegram chat lookup failed for the configured chat target" >&2
            exit 1
          fi
          rm -f "${response_file}"

          response_file="$(mktemp)"
          status="$(curl --silent --show-error \
            --output "${response_file}" \
            --write-out "%{http_code}" \
            -X POST "${telegram_api}/sendMessage" \
            --data-urlencode "chat_id=${TELEGRAM_CHAT_ID}" \
            --data-urlencode "text@dist/release-announcement.txt" \
            --data-urlencode "disable_web_page_preview=true")"
          if [ "${status}" != "200" ]; then
            cat "${response_file}" >&2
            rm -f "${response_file}"
            exit 1
          fi
          cat "${response_file}"
          rm -f "${response_file}"

  publish-homebrew:
    name: publish-homebrew
    needs: release
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: release-assets-*
          path: dist
          merge-multiple: true

      - name: Generate checksums
        run: |
          sha256sum dist/* > dist/checksums.txt

      - name: Update Homebrew tap
        env:
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
        run: |
          set -euo pipefail

          if [ -z "${HOMEBREW_TAP_GITHUB_TOKEN:-}" ]; then
            echo "HOMEBREW_TAP_GITHUB_TOKEN is not set; skipping Homebrew publish"
            exit 0
          fi

          version="${GITHUB_REF_NAME#v}"
          arm64_sha="$(awk '/unch_Darwin_arm64.tar.gz$/ {print $1}' dist/checksums.txt)"
          amd64_sha="$(awk '/unch_Darwin_x86_64.tar.gz$/ {print $1}' dist/checksums.txt)"

          if [ -z "$arm64_sha" ] || [ -z "$amd64_sha" ]; then
            echo "missing release checksums" >&2
            exit 1
          fi

          tap_dir="$(mktemp -d)"
          trap 'rm -rf "$tap_dir"' EXIT

          git clone "https://x-access-token:${HOMEBREW_TAP_GITHUB_TOKEN}@github.com/${HOMEBREW_TAP_REPO}.git" "$tap_dir"
          mkdir -p "$tap_dir/Formula"

          ./scripts/render_homebrew_formula.sh "$version" "$arm64_sha" "$amd64_sha" > "$tap_dir/Formula/unch.rb"

          cd "$tap_dir"
          if git diff --quiet -- Formula/unch.rb; then
            echo "homebrew formula is already up to date"
            exit 0
          fi

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add Formula/unch.rb
          git commit -m "chore: update unch to v${version}"
          git push origin HEAD:main