release_github.yml

# Release workflow for celq binaries
# Credit: Inspired by https://github.com/01mf02/jaq/blob/main/.github/workflows/release.yml
# Also see: https://github.com/BurntSushi/ripgrep/blob/61733f6378b62fa2dc2e7f3eff2f2e7182069ca9/.github/workflows/release.yml


name: GitHub Release

on:
  workflow_dispatch:  # Manual trigger only
  push:
    tags:
      - "v[0-9]*"      # Trigger on version tags like v1.0.0

defaults:
  run:
    shell: bash

env:
  NAME: celq
  VERSION: ${{ github.ref_name }}

# Required for gh release upload and attestations
permissions:
  contents: write
  id-token: write
  attestations: write
  artifact-metadata: write

jobs:
  build:
    name: ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    environment: github_release
    strategy:
      fail-fast: false
      matrix:
        include:
          # macOS ARM64 (native)
          - { target: aarch64-apple-darwin, os: macos-15, pretty_target: macos-aarch64 }

          # macOS x86-64 (native)
          - { target: x86_64-apple-darwin, os: macos-15-intel, pretty_target: macos-x86_64 }
          
          # Windows x86-64 (native)
          - { target: x86_64-pc-windows-msvc, os: windows-2025, pretty_target: windows-x86_64 }
          
          # Linux x86-64 (native - musl static binary)
          - { target: x86_64-unknown-linux-musl, os: ubuntu-24.04, pretty_target: linux-x86_64-musl }

          # Linux ARM64 (native - musl static binary)
          - { target: aarch64-unknown-linux-musl, os: ubuntu-24.04-arm, pretty_target: linux-aarch64-musl }

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install musl tools (for musl targets)
        if: contains(matrix.target, 'musl')
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools

      - name: Build
        run: cargo build --locked --release --target ${{ matrix.target }}

      - name: Create release archive
        id: archive
        run: |
          EXE_suffix="" 
          case ${{ matrix.target }} in 
            *-pc-windows-*) EXE_suffix=".exe" ;; 
          esac
          
          BIN_PATH="target/${{ matrix.target }}/release/${NAME}${EXE_suffix}"
          BIN_NAME="${NAME}${EXE_suffix}"
          
          # Determine archive format based on platform
          case ${{ matrix.target }} in
            *-pc-windows-*)
              # Windows: create .zip archive with pretty name
              ARCHIVE_NAME="${NAME}-${{ matrix.pretty_target }}.zip"
              7z a "${ARCHIVE_NAME}" "./${BIN_PATH}"
              7z rn "${ARCHIVE_NAME}" "target/${{ matrix.target }}/release/${BIN_NAME}" "${BIN_NAME}"
              ;;
            *)
              # Linux/macOS: create .tar.gz archive with pretty name
              ARCHIVE_NAME="${NAME}-${{ matrix.pretty_target }}.tar.gz"
              tar czf "${ARCHIVE_NAME}" -C "target/${{ matrix.target }}/release" "${BIN_NAME}"
              ;;
          esac
          
          echo "ARCHIVE_NAME=${ARCHIVE_NAME}" >> $GITHUB_OUTPUT

      - name: Generate attestation for release archive
        uses: actions/attest-build-provenance@v3
        with:
          subject-path: ${{ steps.archive.outputs.ARCHIVE_NAME }}

      - name: Upload release archive
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload ${VERSION} ${{ steps.archive.outputs.ARCHIVE_NAME }}

  build-zig:
    name: ${{ matrix.target }}${{ matrix.zigtargetsuffix }}
    runs-on: ${{ matrix.os }}
    environment: github_release
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux x86-64 (zigbuild - glibc 2.28)
          - { target: x86_64-unknown-linux-gnu, os: ubuntu-24.04, zigtargetsuffix: .2.28, pretty_target: linux-x86_64-gnu }
          
          # Linux ARM64 (zigbuild - glibc 2.28)
          - { target: aarch64-unknown-linux-gnu, os: ubuntu-24.04-arm, zigtargetsuffix: .2.28, pretty_target: linux-aarch64-gnu }

          # FreeBSD x86-64 (zigbuild)
          - { target: x86_64-unknown-freebsd, os: ubuntu-24.04, zigtargetsuffix: "", pretty_target: freebsd-x86_64 }

          # FreeBSD ARM64 (zigbuild)
          - { target: aarch64-unknown-freebsd, os: ubuntu-24.04-arm, zigtargetsuffix: "", pretty_target: freebsd-aarch64 }

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        if: matrix.target != 'aarch64-unknown-freebsd'
        with:
          targets: ${{ matrix.target }}
      
      - name: Install Rust toolchain (FreeBSD aarch64 special case)
        uses: dtolnay/rust-toolchain@1.93
        if: matrix.target == 'aarch64-unknown-freebsd'
        with:
          components: rust-src

      - name: Install Zig
        uses: mlugg/setup-zig@v2
        with:
          version: 0.15.2

      - name: Install cargo-zigbuild
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-zigbuild@0.21.6

      - name: Build with Zig
        if: matrix.target != 'aarch64-unknown-freebsd'
        run: cargo zigbuild --locked --release --target ${{ matrix.target }}${{ matrix.zigtargetsuffix }}
      
      - name: Build with Zig (FreeBSD aarch64 special case)
        if: matrix.target == 'aarch64-unknown-freebsd'
        run: |
          RUSTC_BOOTSTRAP=1 RUSTFLAGS="-Z unstable-options -C panic=immediate-abort" cargo zigbuild \
          --target aarch64-unknown-freebsd \
          --release \
          -Z build-std=std,panic_abort

      - name: Create release archive
        id: archive
        run: |
          BIN_PATH="target/${{ matrix.target }}/release/${NAME}"
          BIN_NAME="${NAME}"
          
          # Archive name uses pretty target name
          ARCHIVE_NAME="${NAME}-${{ matrix.pretty_target }}.tar.gz"
          tar czf "${ARCHIVE_NAME}" -C "target/${{ matrix.target }}/release" "${BIN_NAME}"
          
          echo "ARCHIVE_NAME=${ARCHIVE_NAME}" >> $GITHUB_OUTPUT

      - name: Generate attestation for release archive
        uses: actions/attest-build-provenance@v3
        with:
          subject-path: ${{ steps.archive.outputs.ARCHIVE_NAME }}

      - name: Upload release archive
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload ${VERSION} ${{ steps.archive.outputs.ARCHIVE_NAME }}

  update-install-script:
    name: Update install script on GitHub Pages
    runs-on: ubuntu-latest
    needs: [build, build-zig]
    environment: github_release
    steps:
      - name: Checkout celq repository
        uses: actions/checkout@v4
        with:
          path: celq-repo

      - name: Checkout get-celq.github.io repository
        uses: actions/checkout@v4
        with:
          repository: get-celq/get-celq.github.io
          token: ${{ secrets.PAGES_DEPLOY_TOKEN }}
          path: pages-repo

      - name: Generate install script with checksums
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          cd celq-repo
          VERSION="${{ github.ref_name }}"
          
          # Run the generation script
          bash .github/scripts/generate-install-script.sh "$VERSION"
          
          # Generate versioned install script (e.g., v0.1.1/install.sh or v0.2.0-beta.1/install.sh)
          mkdir -p "../pages-repo/${VERSION}"
          cp install.sh "../pages-repo/${VERSION}/install.sh"
          
          # Only update root install.sh if this is NOT a pre-release
          # Pre-releases have a hyphen (e.g., v0.2.0-beta.1, v1.0.0-rc.1)
          if [[ ! "$VERSION" =~ -[a-zA-Z] ]]; then
            echo "Stable release detected, updating root install.sh"
            cp install.sh ../pages-repo/install.sh
          else
            echo "Pre-release detected, skipping root install.sh update"
          fi

      - name: Generate attestation for install script
        uses: actions/attest-build-provenance@v3
        with:
          subject-path: celq-repo/install.sh

      - name: Upload install.sh to GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          cd celq-repo
          gh release upload ${{ github.ref_name }} install.sh --clobber

      - name: Commit and push changes to Pages repo
        run: |
          cd pages-repo
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          
          VERSION="${{ github.ref_name }}"
          
          # Add versioned install script
          git add "${VERSION}/install.sh"
          
          # Only add root install.sh if it was updated (stable release)
          if [[ ! "$VERSION" =~ -[a-zA-Z] ]]; then
            git add install.sh
            git commit -m "Update install script to $VERSION (stable release)" || echo "No changes to commit"
          else
            git commit -m "Add install script for $VERSION (pre-release)" || echo "No changes to commit"
          fi
          
          git push

  generate-checksums:
    name: Generate SHA256 checksums
    runs-on: ubuntu-latest
    needs: [build, build-zig, update-install-script]
    environment: github_release
    steps:
      - name: Download all release assets
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          VERSION="${{ github.ref_name }}"
          
          # Create temp directory for downloads
          mkdir -p /tmp/release-assets
          cd /tmp/release-assets
          
          # Download all archives and install.sh for this release
          gh release download "${VERSION}" \
            --repo ${{ github.repository }} \
            --pattern "celq-*.tar.gz" \
            --pattern "celq-*.zip" \
            --pattern "install.sh"
          
          # List downloaded files
          echo "Downloaded files:"
          ls -lh

      - name: Generate checksums file
        run: |
          cd /tmp/release-assets
          
          # Generate SHA256 checksums for all downloaded files
          # Sort output alphabetically by filename
          sha256sum celq-* install.sh | sort -k2 > SHA256SUMS
          
          echo "Generated checksums:"
          cat SHA256SUMS

      - name: Generate attestation for checksums file
        uses: actions/attest-build-provenance@v3
        with:
          subject-path: /tmp/release-assets/SHA256SUMS

      - name: Upload checksums file to release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          cd /tmp/release-assets
          gh release upload ${{ github.ref_name }} SHA256SUMS \
            --repo ${{ github.repository }} \
            --clobber

  update-homebrew-formula:
    name: Update Homebrew formula
    runs-on: ubuntu-latest
    needs: [build, build-zig]
    environment: github_release
    steps:
      - name: Checkout celq repository (for template)
        uses: actions/checkout@v4
        with:
          path: celq-repo

      - name: Check if pre-release
        id: check_prerelease
        run: |
          VERSION="${{ github.ref_name }}"
          
          # Check if this is a pre-release (contains hyphen followed by alpha/beta/rc/etc)
          if [[ "$VERSION" =~ -[a-zA-Z] ]]; then
            echo "Pre-release detected: $VERSION"
            echo "Skipping Homebrew formula update (Homebrew doesn't support pre-releases in main formula)"
            echo "is_prerelease=true" >> $GITHUB_OUTPUT
          else
            echo "Stable release detected: $VERSION"
            echo "is_prerelease=false" >> $GITHUB_OUTPUT
          fi

      - name: Checkout homebrew-tap repository
        if: steps.check_prerelease.outputs.is_prerelease == 'false'
        uses: actions/checkout@v4
        with:
          repository: get-celq/homebrew-tap
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: homebrew-tap

      - name: Update Homebrew formula
        env:
          GH_TOKEN: ${{ github.token }}
        if: steps.check_prerelease.outputs.is_prerelease == 'false'
        run: |
          chmod +x celq-repo/.github/scripts/update-homebrew-formula.sh
          celq-repo/.github/scripts/update-homebrew-formula.sh \
            "${{ github.ref_name }}" \
            "${{ github.repository }}" \
            "celq-repo/brew/celq.rb" \
            "homebrew-tap/Formula/celq.rb"

      - name: Commit and push Homebrew formula
        if: steps.check_prerelease.outputs.is_prerelease == 'false'
        run: |
          cd homebrew-tap
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          
          git add Formula/celq.rb
          git commit -m "Update celq to ${{ github.ref_name }}" || echo "No changes to commit"
          git push
          
          echo "✅ Homebrew formula updated to ${{ github.ref_name }}"

  update-scoop-manifest:
    name: Update Scoop manifest
    runs-on: ubuntu-latest
    needs: [build, build-zig]
    environment: github_release
    steps:
      - name: Checkout celq repository (for template)
        uses: actions/checkout@v4
        with:
          path: celq-repo

      - name: Check if pre-release
        id: check_prerelease
        run: |
          VERSION="${{ github.ref_name }}"
          
          # Check if this is a pre-release (contains hyphen followed by alpha/beta/rc/etc)
          if [[ "$VERSION" =~ -[a-zA-Z] ]]; then
            echo "Pre-release detected: $VERSION"
            echo "Skipping Scoop manifest update (Scoop doesn't support pre-releases)"
            echo "is_prerelease=true" >> $GITHUB_OUTPUT
          else
            echo "Stable release detected: $VERSION"
            echo "is_prerelease=false" >> $GITHUB_OUTPUT
          fi

      - name: Checkout scoop-bucket repository
        if: steps.check_prerelease.outputs.is_prerelease == 'false'
        uses: actions/checkout@v4
        with:
          repository: get-celq/scoop-bucket
          token: ${{ secrets.SCOOP_BUCKET_TOKEN }}
          path: scoop-bucket

      - name: Download Windows binary and calculate SHA256
        if: steps.check_prerelease.outputs.is_prerelease == 'false'
        run: |
          VERSION="${{ github.ref_name }}"
          
          # Download the Windows binary zip (using pretty name)
          ZIP_URL="https://github.com/${{ github.repository }}/releases/download/${VERSION}/celq-windows-x86_64.zip"
          
          echo "Downloading Windows binary from: $ZIP_URL"
          curl -sL "$ZIP_URL" -o "/tmp/celq-windows-x86_64.zip"
          
          # Calculate SHA256
          SHA256=$(sha256sum "/tmp/celq-windows-x86_64.zip" | awk '{print $1}')
          echo "Calculated SHA256: $SHA256"
          
          # Export for next step
          echo "CELQ_SHA256=$SHA256" >> $GITHUB_ENV

      - name: Generate Scoop manifest using celq
        if: steps.check_prerelease.outputs.is_prerelease == 'false'
        run: |
          cd celq-repo
          
          VERSION="${{ github.ref_name }}"
          VERSION_WITHOUT_V="${VERSION#v}"  # Remove 'v' prefix
          
          echo "Generating Scoop manifest for version: $VERSION_WITHOUT_V"
          
          npx -y celq@0.2.0 \
            -n \
            -p \
            -S \
            --from-file "scoop/celq.json.cel" \
            --arg="celq_version:string=${VERSION_WITHOUT_V}" \
            --arg="celq_sha256:string=${CELQ_SHA256}" \
            > "../scoop-bucket/bucket/celq.json"
          
          echo "Scoop manifest generated successfully"

      - name: Commit and push Scoop manifest
        if: steps.check_prerelease.outputs.is_prerelease == 'false'
        run: |
          cd scoop-bucket
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          
          git add bucket/celq.json
          git commit -m "Update celq to ${{ github.ref_name }}" || echo "No changes to commit"
          git push
          
          echo "✅ Scoop manifest updated to ${{ github.ref_name }}"