release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      release_tag:
        description: "Existing release tag to build and publish (for example v0.1.7)"
        required: true
        type: string

permissions:
  contents: write

concurrency:
  group: release-${{ github.workflow }}-${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref_name }}
  cancel-in-progress: false

jobs:
  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref_name }}

    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.0
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref }}
          persist-credentials: false

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Cache cargo artifacts
        uses: Swatinem/rust-cache@v2

      - name: Verify release build
        run: |
          cargo fmt --check
          cargo clippy --all-targets --all-features -- -D warnings
          cargo test --workspace --all-targets --locked

  build:
    needs: verify
    env:
      RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref_name }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            archive_ext: tar.gz
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            archive_ext: tar.gz
          - os: macos-15-intel
            target: x86_64-apple-darwin
            archive_ext: tar.gz
          - os: macos-14
            target: aarch64-apple-darwin
            archive_ext: tar.gz
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            archive_ext: zip

    runs-on: ${{ matrix.os }}
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.0
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref }}
          persist-credentials: false

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install Linux ARM64 linker
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu

      - name: Cache cargo artifacts
        uses: Swatinem/rust-cache@v2

      - name: Build release binary
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: ${{ matrix.target == 'aarch64-unknown-linux-gnu' && 'aarch64-linux-gnu-gcc' || '' }}
        run: cargo build --locked --release --target ${{ matrix.target }}

      - name: Package release archive (unix)
        if: runner.os != 'Windows'
        env:
          TARGET: ${{ matrix.target }}
          TAG: ${{ env.RELEASE_TAG }}
        run: |
          mkdir -p dist
          cp "target/$TARGET/release/kagi" dist/kagi
          tar -C dist -czf "kagi-$TAG-$TARGET.tar.gz" kagi
          cp "target/$TARGET/release/kagi" "kagi-$TAG-$TARGET"

      - name: Package release archive (windows)
        if: runner.os == 'Windows'
        shell: pwsh
        env:
          TARGET: ${{ matrix.target }}
          TAG: ${{ env.RELEASE_TAG }}
        run: |
          New-Item -ItemType Directory -Path dist -Force | Out-Null
          Copy-Item "target/$env:TARGET/release/kagi.exe" "dist/kagi.exe"
          Compress-Archive -Path "dist/kagi.exe" -DestinationPath "kagi-$env:TAG-$env:TARGET.zip" -Force
          Copy-Item "target/$env:TARGET/release/kagi.exe" "kagi-$env:TAG-$env:TARGET.exe"

      - name: Upload packaged assets (unix)
        if: runner.os != 'Windows'
        uses: actions/upload-artifact@v7.0.1
        with:
          name: release-${{ matrix.target }}
          path: |
            kagi-${{ env.RELEASE_TAG }}-${{ matrix.target }}.${{ matrix.archive_ext }}
            kagi-${{ env.RELEASE_TAG }}-${{ matrix.target }}

      - name: Upload packaged assets (windows)
        if: runner.os == 'Windows'
        uses: actions/upload-artifact@v7.0.1
        with:
          name: release-${{ matrix.target }}
          path: |
            kagi-${{ env.RELEASE_TAG }}-${{ matrix.target }}.${{ matrix.archive_ext }}
            kagi-${{ env.RELEASE_TAG }}-${{ matrix.target }}.exe

  release:
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref_name }}

    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.0
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref }}
          persist-credentials: false

      - name: Download packaged archives
        uses: actions/download-artifact@v8.0.1
        with:
          pattern: release-*
          merge-multiple: true
          path: dist

      - name: Generate checksums
        working-directory: dist
        run: |
          sha256sum * > "kagi-${RELEASE_TAG}-checksums.txt"

      - name: Generate release notes
        env:
          VERSION: ${{ env.RELEASE_TAG }}
        run: |
          set -euo pipefail

          VERSION="${VERSION#v}"
          awk -v version="$VERSION" '
            $0 == "## [" version "]" { in_section=1; print; next }
            in_section && /^## \[/ { exit }
            in_section { print }
          ' CHANGELOG.md > dist/release-notes.md

          if [ ! -s dist/release-notes.md ]; then
            echo "Failed to extract release notes for ${VERSION} from CHANGELOG.md" >&2
            exit 1
          fi

          python3 - <<'PY'
          import json
          from pathlib import Path

          notes = Path("dist/release-notes.md").read_text(encoding="utf-8")
          Path("dist/release-notes.json").write_text(
              json.dumps({"body": notes}),
              encoding="utf-8",
          )
          PY

      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            RELEASE_ID="$(gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${RELEASE_TAG}" --jq '.id')"
            gh api "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" --method PATCH --input dist/release-notes.json
            gh release upload "$RELEASE_TAG" dist/* --clobber
          else
            gh release create "$RELEASE_TAG" dist/* --notes-file dist/release-notes.md --title "$RELEASE_TAG" --verify-tag
          fi

      - name: Trigger Mintlify docs deployment
        id: trigger_mintlify_docs
        continue-on-error: true
        env:
          MINTLIFY_DEPLOY_COOKIE: ${{ secrets.MINTLIFY_DEPLOY_COOKIE }}
        run: |
          set -euo pipefail

          if [ -z "${MINTLIFY_DEPLOY_COOKIE:-}" ]; then
            echo "MINTLIFY_DEPLOY_COOKIE is not configured; skipping Mintlify deployment trigger."
            echo "status=skipped" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          curl -fsS -X POST \
            -H "accept: */*" \
            -H "content-type: application/json" \
            -H "origin: https://app.mintlify.com" \
            -H "referer: https://app.mintlify.com/kagi-cli/kagi-cli" \
            -H "cookie: ${MINTLIFY_DEPLOY_COOKIE}" \
            https://app.mintlify.com/api/deployment/update/kagi-cli
          echo "status=triggered" >> "$GITHUB_OUTPUT"

      - name: Sync Homebrew tap and Scoop bucket
        id: sync_package_indexes
        continue-on-error: true
        env:
          REPO_SYNC_TOKEN: ${{ secrets.REPO_SYNC_TOKEN }}
        run: |
          set -euo pipefail

          if [ -z "${REPO_SYNC_TOKEN:-}" ]; then
            echo "REPO_SYNC_TOKEN is not configured; skipping Homebrew/Scoop sync."
            echo "status=skipped" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          SYNC_TOKEN="$(printf '%s' "$REPO_SYNC_TOKEN" | tr -d '\r\n')"
          export SYNC_TOKEN

          VERSION="${RELEASE_TAG#v}"
          CHECKSUM_FILE="dist/kagi-${RELEASE_TAG}-checksums.txt"
          BASE_URL="https://github.com/Microck/kagi-cli/releases/download/${RELEASE_TAG}"

          checksum_for() {
            local asset="$1"
            grep "  ${asset}$" "$CHECKSUM_FILE" | awk '{print $1}'
          }

          MACOS_ARM_SHA="$(checksum_for "kagi-${RELEASE_TAG}-aarch64-apple-darwin.tar.gz")"
          MACOS_INTEL_SHA="$(checksum_for "kagi-${RELEASE_TAG}-x86_64-apple-darwin.tar.gz")"
          LINUX_ARM_SHA="$(checksum_for "kagi-${RELEASE_TAG}-aarch64-unknown-linux-gnu.tar.gz")"
          LINUX_INTEL_SHA="$(checksum_for "kagi-${RELEASE_TAG}-x86_64-unknown-linux-gnu.tar.gz")"
          WINDOWS_INTEL_SHA="$(checksum_for "kagi-${RELEASE_TAG}-x86_64-pc-windows-msvc.zip")"

          TAP_DIR="$(mktemp -d)"
          BUCKET_DIR="$(mktemp -d)"
          ASKPASS_SCRIPT="$(mktemp)"

          cat > "$ASKPASS_SCRIPT" <<'EOF'
          #!/usr/bin/env bash
          case "$1" in
            *Username*) printf '%s\n' "x-access-token" ;;
            *Password*) printf '%s\n' "$SYNC_TOKEN" ;;
          esac
          EOF

          chmod 700 "$ASKPASS_SCRIPT"
          export GIT_ASKPASS="$ASKPASS_SCRIPT"
          export GIT_TERMINAL_PROMPT=0

          clone_with_token() {
            local repo="$1"
            local dir="$2"
            git clone "https://github.com/${repo}.git" "$dir"
          }

          push_with_token() {
            local dir="$1"
            git -C "$dir" push origin main
          }

          clone_with_token "Microck/homebrew-kagi" "$TAP_DIR"
          clone_with_token "Microck/scoop-kagi" "$BUCKET_DIR"

          mkdir -p "$TAP_DIR/Formula"
          cat > "$TAP_DIR/Formula/kagi.rb" <<EOF
          class Kagi < Formula
            desc "Agent-native Rust CLI for Kagi subscribers with JSON-first output"
            homepage "https://github.com/Microck/kagi-cli"
            version "${VERSION}"
            license "MIT"

            on_macos do
              if Hardware::CPU.arm?
                url "${BASE_URL}/kagi-${RELEASE_TAG}-aarch64-apple-darwin.tar.gz"
                sha256 "${MACOS_ARM_SHA}"
              end

              if Hardware::CPU.intel?
                url "${BASE_URL}/kagi-${RELEASE_TAG}-x86_64-apple-darwin.tar.gz"
                sha256 "${MACOS_INTEL_SHA}"
              end
            end

            on_linux do
              if Hardware::CPU.arm?
                url "${BASE_URL}/kagi-${RELEASE_TAG}-aarch64-unknown-linux-gnu.tar.gz"
                sha256 "${LINUX_ARM_SHA}"
              end

              if Hardware::CPU.intel?
                url "${BASE_URL}/kagi-${RELEASE_TAG}-x86_64-unknown-linux-gnu.tar.gz"
                sha256 "${LINUX_INTEL_SHA}"
              end
            end

            def install
              bin.install "kagi"
            end

            test do
              assert_match "Usage: kagi [OPTIONS] [COMMAND]", shell_output("#{bin}/kagi --help")
            end
          end
          EOF

          mkdir -p "$BUCKET_DIR/bucket"
          cat > "$BUCKET_DIR/bucket/kagi.json" <<EOF
          {
            "version": "${VERSION}",
            "description": "Agent-native Rust CLI for Kagi subscribers with JSON-first output.",
            "homepage": "https://github.com/Microck/kagi-cli",
            "license": "MIT",
            "architecture": {
              "64bit": {
                "url": "${BASE_URL}/kagi-${RELEASE_TAG}-x86_64-pc-windows-msvc.zip",
                "hash": "${WINDOWS_INTEL_SHA}"
              }
            },
            "bin": "kagi.exe",
            "checkver": {
              "github": "https://github.com/Microck/kagi-cli"
            },
            "autoupdate": {
              "architecture": {
                "64bit": {
                  "url": "https://github.com/Microck/kagi-cli/releases/download/v\$version/kagi-v\$version-x86_64-pc-windows-msvc.zip"
                }
              }
            }
          }
          EOF

          git -C "$TAP_DIR" config user.name "Microck"
          git -C "$TAP_DIR" config user.email "contact@micr.dev"
          if ! git -C "$TAP_DIR" diff --quiet; then
            git -C "$TAP_DIR" add Formula/kagi.rb
            git -C "$TAP_DIR" commit -m "chore: update kagi formula for ${RELEASE_TAG}"
            push_with_token "$TAP_DIR"
          fi

          git -C "$BUCKET_DIR" config user.name "Microck"
          git -C "$BUCKET_DIR" config user.email "contact@micr.dev"
          if ! git -C "$BUCKET_DIR" diff --quiet; then
            git -C "$BUCKET_DIR" add bucket/kagi.json
            git -C "$BUCKET_DIR" commit -m "chore: update kagi manifest for ${RELEASE_TAG}"
            push_with_token "$BUCKET_DIR"
          fi
          echo "status=synced" >> "$GITHUB_OUTPUT"

      - name: Sync AUR package
        id: sync_aur_package
        continue-on-error: true
        env:
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
        run: |
          set -euo pipefail

          if [ -z "${AUR_SSH_PRIVATE_KEY:-}" ]; then
            echo "AUR_SSH_PRIVATE_KEY is not configured; skipping AUR sync."
            echo "status=skipped" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # GitHub-generated tag archives can resolve to different bytes across
          # clients, which breaks AUR validity checks. Pin the VCS source to the
          # release commit instead.
          VERSION="${RELEASE_TAG#v}"
          SOURCE_COMMIT="$(git ls-remote https://github.com/Microck/kagi-cli.git "refs/tags/v${VERSION}^{}" | awk '{print $1}')"
          if [ -z "$SOURCE_COMMIT" ]; then
            SOURCE_COMMIT="$(git ls-remote https://github.com/Microck/kagi-cli.git "refs/tags/v${VERSION}" | awk '{print $1}')"
          fi

          if [ -z "$SOURCE_COMMIT" ]; then
            echo "Could not resolve release commit for v${VERSION}" >&2
            exit 1
          fi

          AUR_DIR="$(mktemp -d)"
          SSH_DIR="$(mktemp -d)"
          chmod 700 "$SSH_DIR"
          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > "$SSH_DIR/aur"
          chmod 600 "$SSH_DIR/aur"
          ssh-keyscan aur.archlinux.org > "$SSH_DIR/known_hosts"
          export GIT_SSH_COMMAND="ssh -i $SSH_DIR/aur -o IdentitiesOnly=yes -o UserKnownHostsFile=$SSH_DIR/known_hosts"

          git clone "ssh://aur@aur.archlinux.org/kagi-cli.git" "$AUR_DIR"

          cat > "$AUR_DIR/PKGBUILD" <<'EOF'
          # Maintainer: Microck <contact@micr.dev>

          pkgname=kagi-cli
          pkgver=__VERSION__
          pkgrel=1
          pkgdesc="Agent-native CLI for Kagi subscribers with JSON-first search output"
          arch=('x86_64' 'aarch64')
          url="https://github.com/Microck/kagi-cli"
          license=('MIT')
          depends=('gcc-libs')
          makedepends=('cargo' 'git')
          provides=('kagi')
          conflicts=('kagi')
          source=("$pkgname-$pkgver::git+$url.git#commit=__SOURCE_COMMIT__")
          sha256sums=('SKIP')

          _set_arch_lto_compatible_cflags() {
            # Arch makepkg can add -flto through CFLAGS. ring's C/assembly static objects
            # need fat LTO objects so the final Rust binary can link under those flags.
            CFLAGS+=" -ffat-lto-objects"
            export CFLAGS
          }

          prepare() {
            cd "$pkgname-$pkgver"
            cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
          }

          build() {
            cd "$pkgname-$pkgver"
            _set_arch_lto_compatible_cflags
            cargo build --frozen --release

            # Generate shell completions
            ./target/release/kagi --generate-completion bash > completions.bash
            ./target/release/kagi --generate-completion zsh > completions.zsh
            ./target/release/kagi --generate-completion fish > completions.fish
          }

          check() {
            cd "$pkgname-$pkgver"
            _set_arch_lto_compatible_cflags
            cargo test --frozen --release
          }

          package() {
            cd "$pkgname-$pkgver"

            # Binary
            install -Dm755 target/release/kagi "$pkgdir/usr/bin/kagi"

            # License
            install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"

            # Completions
            install -Dm644 completions.bash "$pkgdir/usr/share/bash-completion/completions/kagi"
            install -Dm644 completions.zsh "$pkgdir/usr/share/zsh/site-functions/_kagi"
            install -Dm644 completions.fish "$pkgdir/usr/share/fish/vendor_completions.d/kagi.fish"
          }
          EOF

          sed -i \
            -e "s/__VERSION__/${VERSION}/g" \
            -e "s/__SOURCE_COMMIT__/${SOURCE_COMMIT}/g" \
            "$AUR_DIR/PKGBUILD"

          cat > "$AUR_DIR/.SRCINFO" <<EOF
          pkgbase = kagi-cli
          	pkgdesc = Agent-native CLI for Kagi subscribers with JSON-first search output
          	pkgver = ${VERSION}
          	pkgrel = 1
          	url = https://github.com/Microck/kagi-cli
          	arch = x86_64
          	arch = aarch64
          	license = MIT
          	makedepends = cargo
          	makedepends = git
          	depends = gcc-libs
          	provides = kagi
          	conflicts = kagi
          	source = kagi-cli-${VERSION}::git+https://github.com/Microck/kagi-cli.git#commit=${SOURCE_COMMIT}
          	sha256sums = SKIP

          pkgname = kagi-cli
          EOF

          git -C "$AUR_DIR" config user.name "Microck"
          git -C "$AUR_DIR" config user.email "contact@micr.dev"
          if ! git -C "$AUR_DIR" diff --quiet; then
            git -C "$AUR_DIR" add PKGBUILD .SRCINFO
            git -C "$AUR_DIR" commit -m "chore: update kagi-cli for ${RELEASE_TAG}"
            git -C "$AUR_DIR" push origin master
          fi
          echo "status=synced" >> "$GITHUB_OUTPUT"

      - name: Report package index sync warning
        if: steps.sync_package_indexes.outcome == 'failure' || steps.sync_package_indexes.outputs.status == 'skipped'
        run: |
          echo "::warning title=Package index sync incomplete::GitHub release assets were published, but Homebrew/Scoop sync did not complete. Configure REPO_SYNC_TOKEN or update the package indexes manually."

      - name: Report AUR package sync warning
        if: steps.sync_aur_package.outcome == 'failure' || steps.sync_aur_package.outputs.status == 'skipped'
        run: |
          echo "::warning title=AUR package sync incomplete::GitHub release assets were published, but the AUR package was not updated. Configure AUR_SSH_PRIVATE_KEY or update the AUR package manually."

      - name: Report Mintlify deployment warning
        if: steps.trigger_mintlify_docs.outcome == 'failure' || steps.trigger_mintlify_docs.outputs.status == 'skipped'
        run: |
          echo "::warning title=Mintlify deployment incomplete::GitHub release assets were published, but docs deployment was not confirmed. Configure or rotate MINTLIFY_DEPLOY_COOKIE, or trigger the deployment from the Mintlify dashboard."