ecrou/.github/workflows/release.yml

name: release

on:
  push:
    tags: ['v*']

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}

jobs:
  gate:
    runs-on: ubuntu-latest
    outputs:
      release: ${{ steps.check.outputs.release }}
    steps:
      # The tag filter accepts v1.2.3-rc1 too; only plain vX[.Y.Z] tags
      # are releases, everything else makes this job a no-op so the
      # publish job reports "skipped" instead of failing.
      - id: check
        run: |
          if [[ "$GITHUB_REF_NAME" =~ ^v[0-9]+(\.[0-9]+)*$ ]]; then
            echo "release=true" >> "$GITHUB_OUTPUT"
          else
            echo "release=false" >> "$GITHUB_OUTPUT"
          fi

  build-snap:
    needs: gate
    if: needs.gate.outputs.release == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            artifact: snap-amd64
          # GitHub's free arm64 runners build the arm64 snap natively:
          # libkrun compiles there, and the libkrunfw part picks the
          # arm64 pool .deb through CRAFT_ARCH_BUILD_FOR. riscv64 is a
          # declared platform but has no hosted runner: build and
          # publish that snap by hand (snapcraft remote-build).
          - os: ubuntu-24.04-arm
            artifact: snap-arm64
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      - name: Stamp the tag version into the manifests
        run: |
          v="${GITHUB_REF_NAME#v}"
          sed -i "s/^version = \".*\"/version = \"$v\"/" Cargo.toml
          # The snap adopts this version from Cargo.toml at pull time.
          grep -H '^version' Cargo.toml

      - uses: snapcore/action-build@v1
        id: build

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: ${{ steps.build.outputs.snap }}

  # The macos distribution is a signed tarball, not a store release:
  # brew taps install from it, and the entitlement signature rides in
  # the artifact.
  build-macos:
    needs: gate
    if: needs.gate.outputs.release == 'true'
    runs-on: macos-26
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Stamp the tag version into the manifests
        run: |
          v="${GITHUB_REF_NAME#v}"
          sed -i '' "s/^version = \".*\"/version = \"$v\"/" Cargo.toml
          grep -H '^version' Cargo.toml

      - name: Build the CLI
        run: cargo build --release -p ecrou-cli

      - name: Sign the binary with the hypervisor entitlement
        run: codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou

      - name: Package
        run: |
          v="${GITHUB_REF_NAME#v}"
          tar -czf "ecrou-v$v-darwin-arm64.tar.gz" -C target/release ecrou
          shasum -a 256 "ecrou-v$v-darwin-arm64.tar.gz" > "ecrou-v$v-darwin-arm64.tar.gz.sha256"
          mkdir dist && mv ecrou-v$v-darwin-* dist/

      - uses: actions/upload-artifact@v4
        with:
          name: ecrou-darwin-arm64
          path: dist/*

  publish-snap:
    needs: build-snap
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: snap-*
          path: snaps

      - name: Resolve the snap paths
        id: paths
        run: |
          echo "amd64=$(ls snaps/snap-amd64/*.snap)" >> "$GITHUB_OUTPUT"
          echo "arm64=$(ls snaps/snap-arm64/*.snap)" >> "$GITHUB_OUTPUT"

      # Requires the SNAP_STORE_LOGIN secret: the output of
      #   snapcraft export-login --snaps ecrou --channels stable -
      - uses: snapcore/action-publish@v1
        env:
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
        with:
          snap: ${{ steps.paths.outputs.amd64 }}
          release: stable

      - uses: snapcore/action-publish@v1
        env:
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
        with:
          snap: ${{ steps.paths.outputs.arm64 }}
          release: stable