release.yml

name: Release

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"

permissions:
  contents: write

jobs:
  # Reuse the exact same matrix that build.yml uses on every push.
  build:
    uses: ./.github/workflows/build.yml

  release:
    name: Publish release
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Download built binaries
        uses: actions/download-artifact@v4
        with:
          path: dist
          # Only our binaries — the CUDA toolkit action uploads its own log artifact.
          pattern: decryptd-*
          merge-multiple: true

      - name: Create / update release with binaries
        uses: softprops/action-gh-release@v2
        with:
          files: dist/decryptd-*
          generate_release_notes: true
          fail_on_unmatched_files: true

  # Build the signed rsupd update package from this run's triple-named binary
  # artifacts and upload it to the dist host, so deployed workers auto-update to
  # this release. Needs the RSUPD_IDENTITY secret (base64 of the signing
  # identity); the channel is pinned to `master` to match what the binaries
  # embed as their default consumer channel.
  publish:
    name: Sign & publish update
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: read
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install rsupd CLI
        run: cargo install rsupd --locked --features _cli
      - name: Build signed package from CI binaries, sign, and upload
        env:
          GH_TOKEN: ${{ github.token }}
          RSUPD_IDENTITY: ${{ secrets.RSUPD_IDENTITY }}
        run: rsupd publish --ci --run ${{ github.run_id }} --channel master --yes