release_apps.yml

name: Release Apps

permissions: {}

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - npm/oxfmt/package.json
      - npm/oxlint/package.json

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    name: Check version
    runs-on: ubuntu-slim
    outputs:
      version_changed: ${{ steps.oxfmt.outputs.version_changed && steps.oxlint.outputs.version_changed }}
      oxfmt_version: ${{ steps.oxfmt.outputs.version }}
      oxlint_version: ${{ steps.oxlint.outputs.version }}
    steps:
      - uses: taiki-e/checkout-action@3ab630d442e198ebb0ca30872832406ca01c46eb # v1.4.0
      - uses: ./.github/actions/check-version
        id: oxfmt
        with:
          file-name: npm/oxfmt/package.json
          file-url: https://unpkg.com/oxfmt@latest/package.json

      - uses: ./.github/actions/check-version
        id: oxlint
        with:
          file-name: npm/oxlint/package.json
          file-url: https://unpkg.com/oxlint@latest/package.json

  build-oxlint:
    needs: check
    if: needs.check.outputs.version_changed == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            build: pnpm run build-napi-release --target x86_64-pc-windows-msvc

          - os: windows-latest
            target: aarch64-pc-windows-msvc
            build: pnpm run build-napi-release --target aarch64-pc-windows-msvc

          - os: windows-latest
            target: i686-pc-windows-msvc
            build: pnpm run build-napi-release --target i686-pc-windows-msvc

          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            build: pnpm run build-napi-release --target x86_64-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            build: pnpm run build-napi-release --target aarch64-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: armv7-unknown-linux-gnueabihf
            build: pnpm run build-napi-release --target armv7-unknown-linux-gnueabihf --use-napi-cross

          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            build: pnpm run build-napi-release --target x86_64-unknown-linux-musl -x

          - os: ubuntu-latest
            target: aarch64-unknown-linux-musl
            build: pnpm run build-napi-release --target aarch64-unknown-linux-musl -x

          - os: ubuntu-latest
            target: armv7-unknown-linux-musleabihf
            build: pnpm run build-napi-release --target armv7-unknown-linux-musleabihf -x

          - os: macos-latest
            target: x86_64-apple-darwin
            build: pnpm run build-napi-release --target x86_64-apple-darwin

          - os: macos-latest
            target: aarch64-apple-darwin
            build: pnpm run build-napi-release --target aarch64-apple-darwin

          - os: ubuntu-latest
            target: aarch64-linux-android
            build: pnpm run build-napi-release --target aarch64-linux-android

          - os: ubuntu-latest
            target: armv7-linux-androideabi
            build: pnpm run build-napi-release --target armv7-linux-androideabi

          - os: ubuntu-latest
            target: aarch64-unknown-linux-ohos
            build: pnpm run build-napi-release --target aarch64-unknown-linux-ohos

          - os: ubuntu-latest
            target: powerpc64le-unknown-linux-gnu
            build: pnpm run build-napi-release --target powerpc64le-unknown-linux-gnu --use-napi-cross

    name: Build Oxlint ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    env:
      TARGET_CC: clang # for mimalloc
    defaults:
      run:
        shell: bash
    steps:
      - uses: taiki-e/checkout-action@3ab630d442e198ebb0ca30872832406ca01c46eb # v1.4.0

      - name: Install cross
        uses: taiki-e/install-action@650c5ca14212efbbf3e580844b04bdccf68dac31 # v2.67.18
        with:
          tool: cross # cross installs the latest rust toolchain

      # No Rust cache is provided, to avoid cache poisoning attack.

      - name: Add Rust Target
        run: rustup target add ${{ matrix.target }}

      - uses: oxc-project/setup-node@8958a8e040102244b619c4a94fccb657a44b1c21 # v1.0.6

      # For cargo-zigbuild in musl builds.
      - uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
        if: ${{ contains(matrix.target, 'musl') }}
        with:
          version: 0.13.0

      - name: Setup OpenHarmony SDK
        if: ${{ contains(matrix.target, 'ohos') }}
        uses: Boshen/setup-ohos-sdk@edb865a89a712f1f15dbad932dfa9cfce849d95c # v1.0.0

      - name: Build oxlint for node.js
        working-directory: apps/oxlint
        run: ${{ matrix.build }}

      - name: Build Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
        run: cross build --release -p oxlint --features allocator --target=${{ matrix.target }}

      - name: Upload NAPI artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          if-no-files-found: error
          name: oxlint-bindings-${{ matrix.target }}
          path: |
            apps/oxlint/src-js/*.node
            apps/oxlint/src-js/*.wasm

      # The binaries are zipped to fix permission loss https://github.com/actions/upload-artifact#permission-loss
      - name: Archive Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
        uses: ./.github/actions/archive-binary
        with:
          source_path: target/${{ matrix.target }}/release/oxlint${{ runner.os == 'Windows' && '.exe' || '' }}
          binary_name: oxlint-${{ matrix.target }}${{ runner.os == 'Windows' && '.exe' || '' }}
          archive_name: rust-oxlint-${{ matrix.target }}

      # For github release
      - name: Upload Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          if-no-files-found: error
          name: rust-oxlint-${{ matrix.target }}
          path: |
            rust-oxlint-**.zip
            rust-oxlint-**.tar.gz

  build-oxlint-freebsd:
    needs: check
    if: needs.check.outputs.version_changed == 'true'
    name: Build Oxlint FreeBSD
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@3ab630d442e198ebb0ca30872832406ca01c46eb # v1.4.0
      - name: Build
        id: build
        uses: cross-platform-actions/action@492b0c80085400348c599edace11141a4ee73524 # v0.32.0
        env:
          DEBUG: napi:*
          RUSTUP_IO_THREADS: 1
        with:
          operating_system: freebsd
          version: "14.2"
          memory: 8G
          cpu_count: 3
          environment_variables: "DEBUG RUSTUP_IO_THREADS"
          shell: bash
          run: |
            sudo pkg install -y -f curl libnghttp2 node22 npm cmake
            curl https://sh.rustup.rs -sSf --output rustup.sh
            sh rustup.sh -y --profile minimal --default-toolchain stable
            source "$HOME/.cargo/env"
            echo "~~~~ rustc --version ~~~~"
            rustc --version
            echo "~~~~ node -v ~~~~"
            node -v
            pwd
            ls -lah
            whoami
            env
            export COREPACK_INTEGRITY_KEYS=0
            sudo corepack enable
            pnpm install --ignore-scripts # postinstall: The current platform (freebsd) and architecture (x64) is not supported.
            cd apps/oxlint
            pnpm run build-napi-release --target x86_64-unknown-freebsd
            cd ../..
            cargo build --release -p oxlint --features allocator --target=x86_64-unknown-freebsd
            rm -rf node_modules
            rm -rf target/x86_64-unknown-freebsd/release/build
            rm -rf target/x86_64-unknown-freebsd/release/deps
            rm -rf target/x86_64-unknown-freebsd/release/incremental

      - name: Upload NAPI artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          if-no-files-found: error
          name: oxlint-bindings-x86_64-unknown-freebsd
          path: apps/oxlint/src-js/*.node

      - name: Archive Rust binary
        uses: ./.github/actions/archive-binary
        with:
          source_path: target/x86_64-unknown-freebsd/release/oxlint
          binary_name: oxlint-x86_64-unknown-freebsd
          archive_name: rust-oxlint-x86_64-unknown-freebsd

      - name: Upload Rust binary
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          if-no-files-found: error
          name: rust-oxlint-x86_64-unknown-freebsd
          path: |
            rust-oxlint-**.zip
            rust-oxlint-**.tar.gz

  publish-oxlint:
    name: Publish Oxlint
    needs: [check, build-oxlint, build-oxlint-freebsd]
    runs-on: ubuntu-slim
    permissions:
      id-token: write # for `pnpm publish --provenance`
    env:
      package_path: npm/oxlint
      npm_dir: npm/oxlint-release
      PUBLISH_FLAGS: "--provenance --access public --no-git-checks"
    steps:
      - uses: taiki-e/checkout-action@3ab630d442e198ebb0ca30872832406ca01c46eb # v1.4.0

      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: artifacts
          pattern: oxlint-bindings-*

      - uses: oxc-project/setup-node@8958a8e040102244b619c4a94fccb657a44b1c21 # v1.0.6

      - name: Generate oxlint JS build
        working-directory: apps/oxlint
        run: pnpm run build-js

      - run: mkdir -p ${npm_dir}

      - run: pnpm napi create-npm-dirs --package-json-path ${package_path}/package.json --npm-dir ${npm_dir}

      - run: pnpm napi artifacts --package-json-path ${package_path}/package.json --build-output-dir apps/oxlint/src-js --npm-dir ${npm_dir}

      - name: Copy dist files to npm package
        run: cp -r apps/oxlint/dist npm/oxlint/dist

      - name: Copy dist files to @oxlint/plugins npm package
        run: |
          cp apps/oxlint/dist-pkg-plugins/* npm/oxlint-plugins/

      - run: npm install -g npm@latest # For trusted publishing support

      - name: Check Publish
        run: node .github/scripts/check-npm-packages.js "${npm_dir}/*" "${package_path}"

      - name: Trusted Publish
        run: |
          # Trusted publishing is configured, publish token is not required.
          # Publish sub-packages and adds `optionalDependencies` to main package.
          pnpm napi pre-publish --no-gh-release -t npm --package-json-path ${package_path}/package.json --npm-dir ${npm_dir}
          pnpm publish ${package_path}/ ${PUBLISH_FLAGS}

  build-oxfmt:
    needs: check
    if: needs.check.outputs.version_changed == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            build: pnpm run build-napi-release --target x86_64-pc-windows-msvc

          - os: windows-latest
            target: aarch64-pc-windows-msvc
            build: pnpm run build-napi-release --target aarch64-pc-windows-msvc

          - os: windows-latest
            target: i686-pc-windows-msvc
            build: pnpm run build-napi-release --target i686-pc-windows-msvc

          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            build: pnpm run build-napi-release --target x86_64-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            build: pnpm run build-napi-release --target aarch64-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: armv7-unknown-linux-gnueabihf
            build: pnpm run build-napi-release --target armv7-unknown-linux-gnueabihf --use-napi-cross

          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            build: pnpm run build-napi-release --target x86_64-unknown-linux-musl -x

          - os: ubuntu-latest
            target: aarch64-unknown-linux-musl
            build: pnpm run build-napi-release --target aarch64-unknown-linux-musl -x

          - os: ubuntu-latest
            target: armv7-unknown-linux-musleabihf
            build: pnpm run build-napi-release --target armv7-unknown-linux-musleabihf -x

          - os: macos-latest
            target: x86_64-apple-darwin
            build: pnpm run build-napi-release --target x86_64-apple-darwin

          - os: macos-latest
            target: aarch64-apple-darwin
            build: pnpm run build-napi-release --target aarch64-apple-darwin

          - os: ubuntu-latest
            target: aarch64-linux-android
            build: pnpm run build-napi-release --target aarch64-linux-android

          - os: ubuntu-latest
            target: armv7-linux-androideabi
            build: pnpm run build-napi-release --target armv7-linux-androideabi

          - os: ubuntu-latest
            target: aarch64-unknown-linux-ohos
            build: pnpm run build-napi-release --target aarch64-unknown-linux-ohos

          - os: ubuntu-latest
            target: powerpc64le-unknown-linux-gnu
            build: pnpm run build-napi-release --target powerpc64le-unknown-linux-gnu --use-napi-cross

    name: Build Oxfmt ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    env:
      TARGET_CC: clang # for mimalloc
    defaults:
      run:
        shell: bash
    steps:
      - uses: taiki-e/checkout-action@3ab630d442e198ebb0ca30872832406ca01c46eb # v1.4.0

      - name: Install cross
        uses: taiki-e/install-action@650c5ca14212efbbf3e580844b04bdccf68dac31 # v2.67.18
        with:
          tool: cross # cross installs the latest rust toolchain

      # No Rust cache is provided, to avoid cache poisoning attack.

      - name: Add Rust Target
        run: rustup target add ${{ matrix.target }}

      - uses: oxc-project/setup-node@8958a8e040102244b619c4a94fccb657a44b1c21 # v1.0.6

      # For cargo-zigbuild in musl builds.
      - uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
        if: ${{ contains(matrix.target, 'musl') }}
        with:
          version: 0.13.0

      - name: Setup OpenHarmony SDK
        if: ${{ contains(matrix.target, 'ohos') }}
        uses: Boshen/setup-ohos-sdk@edb865a89a712f1f15dbad932dfa9cfce849d95c # v1.0.0

      - name: Build oxfmt for node.js
        working-directory: apps/oxfmt
        run: ${{ matrix.build }}

      - name: Build Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
        run: cross build --release -p oxfmt --no-default-features --features allocator --target=${{ matrix.target }}

      - name: Upload NAPI artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          if-no-files-found: error
          name: oxfmt-bindings-${{ matrix.target }}
          path: |
            apps/oxfmt/src-js/*.node
            apps/oxfmt/src-js/*.wasm

      # The binaries are zipped to fix permission loss https://github.com/actions/upload-artifact#permission-loss
      - name: Archive Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
        uses: ./.github/actions/archive-binary
        with:
          source_path: target/${{ matrix.target }}/release/oxfmt${{ runner.os == 'Windows' && '.exe' || '' }}
          binary_name: oxfmt-${{ matrix.target }}${{ runner.os == 'Windows' && '.exe' || '' }}
          archive_name: rust-oxfmt-${{ matrix.target }}

      # For github release
      - name: Upload Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          if-no-files-found: error
          name: rust-oxfmt-${{ matrix.target }}
          path: |
            rust-oxfmt-**.zip
            rust-oxfmt-**.tar.gz

  build-oxfmt-freebsd:
    needs: check
    if: needs.check.outputs.version_changed == 'true'
    name: Build Oxfmt FreeBSD
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@3ab630d442e198ebb0ca30872832406ca01c46eb # v1.4.0
      - name: Build
        id: build
        uses: cross-platform-actions/action@492b0c80085400348c599edace11141a4ee73524 # v0.32.0
        env:
          DEBUG: napi:*
          RUSTUP_IO_THREADS: 1
        with:
          operating_system: freebsd
          version: "14.2"
          memory: 8G
          cpu_count: 3
          environment_variables: "DEBUG RUSTUP_IO_THREADS"
          shell: bash
          run: |
            sudo pkg install -y -f curl libnghttp2 node22 npm cmake
            curl https://sh.rustup.rs -sSf --output rustup.sh
            sh rustup.sh -y --profile minimal --default-toolchain stable
            source "$HOME/.cargo/env"
            echo "~~~~ rustc --version ~~~~"
            rustc --version
            echo "~~~~ node -v ~~~~"
            node -v
            pwd
            ls -lah
            whoami
            env
            export COREPACK_INTEGRITY_KEYS=0
            sudo corepack enable
            pnpm install --ignore-scripts # postinstall: The current platform (freebsd) and architecture (x64) is not supported.
            cd apps/oxfmt
            pnpm run build-napi-release --target x86_64-unknown-freebsd
            cd ../..
            cargo build --release -p oxfmt --no-default-features --features allocator --target=x86_64-unknown-freebsd
            rm -rf node_modules
            rm -rf target/x86_64-unknown-freebsd/release/build
            rm -rf target/x86_64-unknown-freebsd/release/deps
            rm -rf target/x86_64-unknown-freebsd/release/incremental

      - name: Upload NAPI artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          if-no-files-found: error
          name: oxfmt-bindings-x86_64-unknown-freebsd
          path: apps/oxfmt/src-js/*.node

      - name: Archive Rust binary
        uses: ./.github/actions/archive-binary
        with:
          source_path: target/x86_64-unknown-freebsd/release/oxfmt
          binary_name: oxfmt-x86_64-unknown-freebsd
          archive_name: rust-oxfmt-x86_64-unknown-freebsd

      - name: Upload Rust binary
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          if-no-files-found: error
          name: rust-oxfmt-x86_64-unknown-freebsd
          path: |
            rust-oxfmt-**.zip
            rust-oxfmt-**.tar.gz

  publish-oxfmt:
    name: Publish Oxfmt
    needs: [check, build-oxfmt, build-oxfmt-freebsd]
    runs-on: ubuntu-slim
    permissions:
      id-token: write # for `pnpm publish --provenance`
    env:
      package_path: npm/oxfmt
      npm_dir: npm/oxfmt-release
      PUBLISH_FLAGS: "--provenance --access public --no-git-checks"
    steps:
      - uses: taiki-e/checkout-action@3ab630d442e198ebb0ca30872832406ca01c46eb # v1.4.0

      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: artifacts
          pattern: oxfmt-bindings-*

      - uses: oxc-project/setup-node@8958a8e040102244b619c4a94fccb657a44b1c21 # v1.0.6

      - name: Generate oxfmt JS build
        working-directory: apps/oxfmt
        run: pnpm run build-js

      - run: mkdir -p ${npm_dir}

      - run: pnpm napi create-npm-dirs --package-json-path ${package_path}/package.json --npm-dir ${npm_dir}

      - run: pnpm napi artifacts --package-json-path ${package_path}/package.json --build-output-dir apps/oxfmt/src-js --npm-dir ${npm_dir}

      - name: Copy dist files to npm package
        run: cp -r apps/oxfmt/dist npm/oxfmt/dist

      - run: npm install -g npm@latest # For trusted publishing support

      - name: Check Publish
        run: node .github/scripts/check-npm-packages.js "${npm_dir}/*" "${package_path}"

      - name: Trusted Publish
        run: |
          # Trusted publishing is configured, publish token is not required.
          # Publish sub-packages and adds `optionalDependencies` to main package.
          pnpm napi pre-publish --no-gh-release -t npm --package-json-path ${package_path}/package.json --npm-dir ${npm_dir}
          pnpm publish ${package_path}/ ${PUBLISH_FLAGS}

  github-release:
    name: GitHub Release
    needs:
      [
        check,
        build-oxlint,
        build-oxlint-freebsd,
        build-oxfmt,
        build-oxfmt-freebsd,
        publish-oxlint,
        publish-oxfmt,
      ]
    permissions:
      contents: write # for softprops/action-gh-release@v1.3.1
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          token: ${{ secrets.OXC_BOT_PAT }}
          fetch-depth: 0 # for changelog
          persist-credentials: true

      - uses: oxc-project/setup-rust@c8224157c0bf235aabc633e8cd50d344f087a7de # v1.0.12
        with:
          restore-cache: false
          tools: cargo-release-oxc

      - name: Generate changelog
        id: run
        run: |
          mkdir -p target
          cargo release-oxc changelog --release oxfmt --release oxlint
          {
            echo "## Table of Contents"
            echo ""
            echo "- [Oxlint v${NEEDS_CHECK_OUTPUTS_OXLINT_VERSION}](#oxlint-v${NEEDS_CHECK_OUTPUTS_OXLINT_VERSION})"
            echo "- [Oxfmt v${NEEDS_CHECK_OUTPUTS_OXFMT_VERSION}](#oxfmt-v${NEEDS_CHECK_OUTPUTS_OXFMT_VERSION})"
            echo ""
            echo "## Oxlint v${NEEDS_CHECK_OUTPUTS_OXLINT_VERSION}"
            cat ./target/OXLINT_CHANGELOG
            echo ""
            echo ""
            echo "## Oxfmt v${NEEDS_CHECK_OUTPUTS_OXFMT_VERSION}"
            cat ./target/OXFMT_CHANGELOG
          } > ./target/RELEASE_BODY.md
        env:
          NEEDS_CHECK_OUTPUTS_OXLINT_VERSION: ${{ needs.check.outputs.oxlint_version }}
          NEEDS_CHECK_OUTPUTS_OXFMT_VERSION: ${{ needs.check.outputs.oxfmt_version }}

      - name: tag oxlint and oxfmt
        env:
          NEEDS_CHECK_OUTPUTS_OXFMT_VERSION: ${{ needs.check.outputs.oxfmt_version }}
          NEEDS_CHECK_OUTPUTS_OXLINT_VERSION: ${{ needs.check.outputs.oxlint_version }}
        run: |
          git tag oxfmt_v${NEEDS_CHECK_OUTPUTS_OXFMT_VERSION} ${{ github.sha }}
          git tag oxlint_v${NEEDS_CHECK_OUTPUTS_OXLINT_VERSION} ${{ github.sha }}
          git push origin oxlint_v${NEEDS_CHECK_OUTPUTS_OXLINT_VERSION} oxfmt_v${NEEDS_CHECK_OUTPUTS_OXFMT_VERSION}

      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: ./release-artifacts
          pattern: rust-*
          merge-multiple: true

      - name: Remove rust- prefix from filenames
        run: |
          cd release-artifacts
          for file in rust-*; do
            mv "$file" "${file#rust-}"
          done
          ls

      - name: Create GitHub Release
        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
        id: release
        with:
          body_path: ./target/RELEASE_BODY.md
          draft: true # Must set to true for Enable release immutability https://github.com/softprops/action-gh-release/issues/653
          name: oxlint v${{ needs.check.outputs.oxlint_version }} & oxfmt v${{ needs.check.outputs.oxfmt_version }}
          tag_name: apps_v${{ needs.check.outputs.oxlint_version }}
          target_commitish: ${{ github.sha }}
          fail_on_unmatched_files: true
          files: ./release-artifacts/*

      - name: Turn off draft on github release
        env:
          OXLINT_VERSION: ${{ needs.check.outputs.oxlint_version }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release edit apps_v${OXLINT_VERSION} --draft=false

      - uses: tsickert/discord-webhook@b217a69502f52803de774ded2b1ab7c282e99645 # v7.0.0
        with:
          webhook-url: ${{ secrets.DISCORD_OXC_RELEASES_CHANNEL }}
          embed-title: oxlint v${{ needs.check.outputs.oxlint_version }} & oxfmt v${{ needs.check.outputs.oxfmt_version }}
          embed-description: A new release is available! Check the changelog for details.
          embed-url: https://github.com/${{ github.repository }}/releases/tag/apps_v${{ needs.check.outputs.oxlint_version }}

      - name: wait 3 minutes for smoke test
        run: sleep 180s

  smoke:
    needs: [check, github-release]
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
          - os: ubuntu-latest
          - os: ubuntu-latest
            container: node:24-alpine # musl
          - os: macos-latest
    name: Smoke Test ${{ matrix.os }} ${{ matrix.container }}
    runs-on: ${{ matrix.os }}
    container: ${{ matrix.container }}
    steps:
      - name: Test
        # These commands should be run on these defaults:
        # - windows: pwsh
        # - ubuntu: bash
        # - alpine: sh
        # - macos: bash
        run: | # zizmor: ignore[template-injection]
          echo "" > test.js
          ldd --version || true
          npx oxfmt@${{ needs.check.outputs.oxfmt_version }} ./test.js
          npx oxlint@${{ needs.check.outputs.oxlint_version }} ./test.js

  bump:
    needs: [check, smoke]
    name: Bump oxlint dependents
    runs-on: ubuntu-slim
    steps:
      - uses: taiki-e/checkout-action@3ab630d442e198ebb0ca30872832406ca01c46eb # v1.4.0

      - name: Bump oxc-project/eslint-plugin-oxlint
        uses: benc-uk/workflow-dispatch@e2e5e9a103e331dad343f381a29e654aea3cf8fc # v1.2.4
        with:
          repo: oxc-project/eslint-plugin-oxlint
          workflow: bump_oxlint.yml
          token: ${{ secrets.OXC_BOT_PAT }}
          ref: main
          inputs: '{ "version": "${{ needs.check.outputs.oxlint_version }}" }'

      - name: Bump oxc-project/oxlint-migrate
        uses: benc-uk/workflow-dispatch@e2e5e9a103e331dad343f381a29e654aea3cf8fc # v1.2.4
        with:
          repo: oxc-project/oxlint-migrate
          workflow: bump_oxlint.yml
          token: ${{ secrets.OXC_BOT_PAT }}
          ref: main
          inputs: '{ "version": "${{ needs.check.outputs.oxlint_version }}" }'

      - name: Bump oxc-project/mirrors-oxlint
        uses: benc-uk/workflow-dispatch@e2e5e9a103e331dad343f381a29e654aea3cf8fc # v1.2.4
        with:
          repo: oxc-project/mirrors-oxlint
          workflow: main.yml
          token: ${{ secrets.OXC_BOT_PAT }}
          ref: main