release.yml

name: release

# Build native `insta` binaries with Bun and publish them to a GitHub Release.
# Trigger by pushing a tag (v*), or manually via workflow_dispatch with a version.
on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release, without the leading v (e.g. 0.1.0)'
        required: true

permissions:
  contents: write # create releases + upload assets

jobs:
  build:
    runs-on: ubuntu-latest # Bun cross-compiles every target from one runner
    strategy:
      fail-fast: false
      matrix:
        include:
          - { target: bun-darwin-arm64, name: insta-darwin-arm64 }
          - { target: bun-darwin-x64, name: insta-darwin-x64 }
          - { target: bun-linux-arm64, name: insta-linux-arm64 }
          - { target: bun-linux-x64, name: insta-linux-x64 }
          - { target: bun-windows-x64, name: insta-windows-x64.exe }
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
      - name: Resolve version
        id: v
        run: |
          if [ -n "${{ github.event.inputs.version }}" ]; then
            echo "version=${{ github.event.inputs.version }}" >> "$GITHUB_OUTPUT"
          else
            echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
          fi
      - name: Build ${{ matrix.name }}
        run: |
          bun install --frozen-lockfile
          bun build ./src/index.ts --compile --minify \
            --target=${{ matrix.target }} \
            --define "process.env.INSTA_CLI_VERSION=\"${{ steps.v.outputs.version }}\"" \
            --outfile "${{ matrix.name }}"
      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.name }}
          path: ${{ matrix.name }}
          if-no-files-found: error

  release:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          path: dist-bin
          merge-multiple: true # flatten all per-target artifacts into one dir
      - name: Checksums + compress
        run: |
          cd dist-bin
          # Checksum the RAW binaries first — install.sh verifies the DECOMPRESSED artifact
          # (what actually runs), so SHA256SUMS lists raw-binary hashes.
          sha256sum insta-* > SHA256SUMS
          # gzip the unix binaries (~60MB → ~20MB download). Leave the Windows .exe raw
          # (manual download). install.sh fetches <asset>.gz and gunzips.
          for f in insta-darwin-* insta-linux-*; do gzip -f "$f"; done
          ls -lh
          cat SHA256SUMS
      - name: Resolve tag
        id: t
        run: |
          if [ -n "${{ github.event.inputs.version }}" ]; then
            echo "tag=v${{ github.event.inputs.version }}" >> "$GITHUB_OUTPUT"
          else
            echo "tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
          fi
      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          TAG="${{ steps.t.outputs.tag }}"
          # Create the release if it doesn't exist (dispatch also creates the tag), else just upload.
          if ! gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            gh release create "$TAG" \
              --repo "$GITHUB_REPOSITORY" \
              --target "$GITHUB_SHA" \
              --title "insta $TAG" \
              --generate-notes
          fi
          gh release upload "$TAG" --repo "$GITHUB_REPOSITORY" --clobber \
            dist-bin/insta-* dist-bin/SHA256SUMS install.sh

  # npm half of the release: publishes `insta` to the registry with a GRANULAR AUTOMATION token
  # (repo secret NPM_TOKEN — bypasses the interactive 2FA/OTP that blocks CI). Gated on the
  # binaries building, tag pushes only. --provenance attests the build (public repo + OIDC).
  publish-npm:
    needs: release
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # npm --provenance attestation
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org
      # OIDC trusted publishing: npm trusts this workflow's identity directly (configured on
      # npmjs.com → package `insta` → Trusted Publisher: InsForge/insta-cli, release.yml).
      # No token secret. Needs npm ≥ 11.5 for the OIDC exchange; Node 22 bundles an older one.
      - run: npm install -g npm@latest
      - run: npm ci
      - name: Publish to npm (OIDC)
        run: npm publish --provenance --access public