release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  build-cli:
    name: CLI ${{ matrix.name }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: windows-x86_64
            os: windows-latest
            artifact: ii-windows-x86_64.exe
            binary: target/release/ii.exe
          - name: linux-x86_64
            os: ubuntu-latest
            artifact: ii-linux-x86_64
            binary: target/x86_64-unknown-linux-musl/release/ii
          - name: macos-aarch64
            os: macos-14
            artifact: ii-macos-aarch64
            binary: target/release/ii

    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Install Linux musl toolchain
        if: runner.os == 'Linux'
        shell: bash
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools
          rustup target add x86_64-unknown-linux-musl
      - uses: Swatinem/rust-cache@v2
      - name: Test CLI
        run: cargo test -p ii --locked
      - name: Test installer
        if: runner.os == 'Linux'
        shell: bash
        run: bash tests/install.sh
      - name: Build Linux static CLI
        if: runner.os == 'Linux'
        shell: bash
        env:
          CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER: musl-gcc
          CC_x86_64_unknown_linux_musl: musl-gcc
        run: cargo build -p ii --release --locked --target x86_64-unknown-linux-musl
      - name: Verify Linux binary is static
        if: runner.os == 'Linux'
        shell: bash
        run: file "${{ matrix.binary }}" | grep -Eq 'statically linked|static-pie linked'
      - name: Build CLI
        if: runner.os != 'Linux'
        run: cargo build -p ii --release --locked
      - name: Install UPX 5.1.0 (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          Invoke-WebRequest https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-win64.zip -OutFile upx.zip
          Remove-Item -Recurse -Force upx-5.1.0-win64 -ErrorAction SilentlyContinue
          Expand-Archive -Path upx.zip -DestinationPath .
      - name: Install UPX 5.1.0 (Linux)
        if: runner.os == 'Linux'
        shell: bash
        run: |
          curl --fail --location --silent --show-error https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-amd64_linux.tar.xz -o upx.tar.xz
          tar -xJf upx.tar.xz
          printf 'UPX_BIN=%s\n' "$PWD/upx-5.1.0-amd64_linux/upx" >> "$GITHUB_ENV"
      - name: Install UPX 5.1.0 (macOS)
        if: runner.os == 'macOS'
        shell: bash
        run: |
          curl --fail --location --silent --show-error https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-src.tar.xz -o upx.tar.xz
          tar -xJf upx.tar.xz
          cmake -S upx-5.1.0-src -B upx-build -DCMAKE_BUILD_TYPE=Release
          cmake --build upx-build --parallel 2
          printf 'UPX_BIN=%s\n' "$PWD/upx-build/upx" >> "$GITHUB_ENV"
      - name: Compress and verify CLI
        shell: bash
        run: |
          set -eux
          binary='${{ matrix.binary }}'
          if [ "$RUNNER_OS" = Windows ]; then
            upx='./upx-5.1.0-win64/upx.exe'
          else
            upx="$UPX_BIN"
          fi
          upx_args=(--best --lzma)
          upx_test_args=()
          if [ "$RUNNER_OS" = macOS ]; then
            upx_args+=(--force-macos)
            upx_test_args+=(--force-macos)
          fi
          unpacked_bytes=$(wc -c < "$binary")
          "$upx" "${upx_args[@]}" "$binary"
          "$upx" -t "${upx_test_args[@]}" "$binary"
          packed_bytes=$(wc -c < "$binary")
          {
            echo "## CLI ${{ matrix.name }}"
            echo
            echo "Unpacked: $unpacked_bytes bytes"
            echo "UPX: $packed_bytes bytes"
          } >> "$GITHUB_STEP_SUMMARY"
      - name: Prepare artifact
        shell: bash
        run: cp "${{ matrix.binary }}" "${{ matrix.artifact }}"
      - uses: actions/upload-artifact@v4
        with:
          name: cli-${{ matrix.name }}
          path: ${{ matrix.artifact }}

  release:
    name: Publish GitHub Release
    needs: build-cli
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true
      - name: Create checksums
        shell: bash
        run: |
          set -euxo pipefail
          cd artifacts
          sha256sum ii-* > checksums.txt
      - name: Summarize release artifacts
        shell: bash
        run: |
          {
            echo '## Release artifacts'
            echo
            echo '| Artifact | Bytes |'
            echo '| --- | ---: |'
            for artifact in artifacts/*; do
              echo "| $(basename "$artifact") | $(stat -c '%s' "$artifact") |"
            done
          } >> "$GITHUB_STEP_SUMMARY"
      - name: Publish release
        uses: softprops/action-gh-release@v2
        with:
          files: artifacts/*
          generate_release_notes: true
      - name: Verify released installer
        shell: bash
        env:
          II_INSTALL_DIR: ${{ runner.temp }}/ii-bin
        run: |
          set -euxo pipefail
          bash ./install.sh
          test "$("${II_INSTALL_DIR}/ii" version)" = "${GITHUB_REF_NAME#v}"