release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release-gate:
    name: Validate release ref
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Validate signed main release tag
        env:
          REF_NAME: ${{ github.ref_name }}
        run: bash scripts/validate-release-ref.sh "${REF_NAME}"

  build:
    name: Build ${{ matrix.os }} ${{ matrix.target }}
    runs-on: ${{ matrix.runner }}
    needs: release-gate
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-latest
            os: linux
            target: amd64
            rust_target: x86_64-unknown-linux-gnu
          - runner: ubuntu-24.04-arm
            os: linux
            target: arm64
            rust_target: aarch64-unknown-linux-gnu
          - runner: macos-15-intel
            os: darwin
            target: amd64
            rust_target: x86_64-apple-darwin
          - runner: macos-latest
            os: darwin
            target: arm64
            rust_target: aarch64-apple-darwin
          - runner: windows-latest
            os: windows
            target: amd64
            rust_target: x86_64-pc-windows-msvc
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Rust
        shell: bash
        run: |
          rustup toolchain install 1.85.0 --profile minimal
          rustup default 1.85.0
          rustup target add "${{ matrix.rust_target }}"

      - name: Build binaries
        shell: bash
        env:
          REF_NAME: ${{ github.ref_name }}
          RUST_TARGET: ${{ matrix.rust_target }}
        run: |
          set -euo pipefail
          version="${REF_NAME#v}"
          NIGHTWARD_VERSION="${version}" cargo build --release --bins --target "${RUST_TARGET}"

      - name: Package Unix archive
        if: ${{ matrix.os != 'windows' }}
        shell: bash
        env:
          REF_NAME: ${{ github.ref_name }}
          OS_NAME: ${{ matrix.os }}
          ARCH_NAME: ${{ matrix.target }}
          RUST_TARGET: ${{ matrix.rust_target }}
        run: |
          set -euo pipefail
          version="${REF_NAME#v}"
          name="nightward_${version}_${OS_NAME}_${ARCH_NAME}"
          build_dir="target/${RUST_TARGET}/release"
          mkdir -p "dist/${name}"
          cp "${build_dir}/nightward" "${build_dir}/nw" "dist/${name}/"
          chmod 0755 "dist/${name}/nightward" "dist/${name}/nw"
          (cd "dist/${name}" && tar -czf "../${name}.tar.gz" nightward nw)
          cat > "dist/${name}.sbom.json" <<JSON
          {
            "schema_version": 1,
            "generator": "nightward release workflow",
            "version": "${version}",
            "target": "${OS_NAME}-${ARCH_NAME}",
            "artifacts": ["${name}.tar.gz"]
          }
          JSON

      - name: Package Windows archive
        if: ${{ matrix.os == 'windows' }}
        shell: pwsh
        env:
          REF_NAME: ${{ github.ref_name }}
          OS_NAME: ${{ matrix.os }}
          ARCH_NAME: ${{ matrix.target }}
          RUST_TARGET: ${{ matrix.rust_target }}
        run: |
          $version = $env:REF_NAME.TrimStart("v")
          $name = "nightward_${version}_${env:OS_NAME}_${env:ARCH_NAME}"
          $buildDir = "target/$env:RUST_TARGET/release"
          New-Item -ItemType Directory -Force -Path "dist/$name"
          Copy-Item "$buildDir/nightward.exe" "dist/$name/nightward.exe"
          Copy-Item "$buildDir/nw.exe" "dist/$name/nw.exe"
          Compress-Archive -Path "dist/$name/*" -DestinationPath "dist/$name.zip" -Force
          @"
          {
            "schema_version": 1,
            "generator": "nightward release workflow",
            "version": "$version",
            "target": "${env:OS_NAME}-${env:ARCH_NAME}",
            "artifacts": ["$name.zip"]
          }
          "@ | Set-Content -NoNewline "dist/$name.sbom.json"

      - name: Upload archive
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-${{ matrix.os }}-${{ matrix.target }}
          path: |
            dist/nightward_*.tar.gz
            dist/nightward_*.zip
            dist/nightward_*.sbom.json
          if-no-files-found: error

  publish:
    name: Publish GitHub Release
    runs-on: ubuntu-latest
    needs: build
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Download archives
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: dist
          pattern: release-*
          merge-multiple: true

      - name: Generate checksums
        run: |
          set -euo pipefail
          cd dist
          shasum -a 256 nightward_* > checksums.txt

      - name: Validate signed main release tag
        env:
          REF_NAME: ${{ github.ref_name }}
        run: bash scripts/validate-release-ref.sh "${REF_NAME}"

      - name: Install Cosign
        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1

      - name: Sign checksums
        env:
          COSIGN_EXPERIMENTAL: "true"
        run: cosign sign-blob --yes --bundle dist/checksums.txt.sigstore.json --output-signature dist/checksums.txt.sig dist/checksums.txt

      - name: Publish release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          gh release create "${REF_NAME}" dist/* \
            --verify-tag \
            --generate-notes \
            --title "${REF_NAME}"

  release-verify:
    name: Release verification
    runs-on: ubuntu-latest
    needs: publish
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install Cosign
        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1

      - name: Verify published GitHub release artifacts
        env:
          GH_TOKEN: ${{ github.token }}
          REF_NAME: ${{ github.ref_name }}
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: bash scripts/verify-release-archive.sh "${REF_NAME}"

  npm:
    name: NPM package
    runs-on: ubuntu-latest
    needs: release-verify
    if: ${{ vars.NPM_PUBLISH == 'true' }}
    environment: npm-publish
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          cache: npm
          cache-dependency-path: packages/npm/package-lock.json

      - name: Prepare npm package version
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          version="${REF_NAME#v}"
          cd packages/npm
          npm ci --ignore-scripts --no-audit
          npm version --no-git-tag-version "${version}"
          cd ../..
          node scripts/stamp-mcp-registry-version.mjs "${version}"
          cd packages/npm
          npm test
          npm audit --audit-level=moderate
          npm pack --dry-run

      - name: Publish npm package
        run: npm publish --access public --provenance
        working-directory: packages/npm