release.yml

name: Release

on:
  release:
    types: [created]

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    name: Build ${{ matrix.target }} (${{ matrix.cpu_version || 'native' }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # --- Linux x86_64 ---
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            archive: tar.gz
            cpu_version: x86-64-v2
            rustflags: "-C target-cpu=x86-64-v2"
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            archive: tar.gz
            cpu_version: x86-64-v3
            suffix: modern
            rustflags: "-C target-cpu=x86-64-v3"
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            archive: tar.gz
            cpu_version: x86-64-v4
            suffix: avx512
            rustflags: "-C target-cpu=x86-64-v4"

          # --- Linux ARM ---
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            archive: tar.gz

          # --- macOS x86_64 ---
          - target: x86_64-apple-darwin
            os: macos-latest
            archive: tar.gz
            macos_sign: true
            cpu_version: x86-64-v2
            rustflags: "-C target-cpu=x86-64-v2"
          - target: x86_64-apple-darwin
            os: macos-latest
            archive: tar.gz
            macos_sign: true
            cpu_version: x86-64-v3
            suffix: modern
            rustflags: "-C target-cpu=x86-64-v3"
          - target: x86_64-apple-darwin
            os: macos-latest
            archive: tar.gz
            macos_sign: true
            cpu_version: x86-64-v4
            suffix: avx512
            rustflags: "-C target-cpu=x86-64-v4"

          # --- macOS ARM ---
          - target: aarch64-apple-darwin
            os: macos-latest
            archive: tar.gz
            macos_sign: true

          # --- Windows x86_64 ---
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            archive: zip
            cpu_version: x86-64-v2
            rustflags: "-C target-cpu=x86-64-v2"
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            archive: zip
            cpu_version: x86-64-v3
            suffix: modern
            rustflags: "-C target-cpu=x86-64-v3"
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            archive: zip
            cpu_version: x86-64-v4
            suffix: avx512
            rustflags: "-C target-cpu=x86-64-v4"

          # --- Windows ARM ---
          - target: aarch64-pc-windows-msvc
            os: windows-latest
            archive: zip

    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install cross-compilation tools
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu
          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV

      - uses: Swatinem/rust-cache@v2
        with:
          # Scopes the cache by CPU version as well so v2, v3, and v4 don't thrash each other's cache
          key: ${{ matrix.target }}-${{ matrix.cpu_version || 'default' }}

      - name: Build
        env:
          RUSTFLAGS: ${{ matrix.rustflags || '' }}
          CARGO_PROFILE_RELEASE_OPT_LEVEL: "3"
          CARGO_PROFILE_RELEASE_LTO: "thin"
        run: cargo build --release --target ${{ matrix.target }}

      # --- macOS: import certificate and sign the binary ---

      - name: Import Apple Developer ID certificate
        if: matrix.macos_sign
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          # Write the .p12 to disk
          echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12
          
          # Create a temporary keychain so we don't touch the login keychain
          security create-keychain -p actions-keychain phpantom.keychain
          security set-keychain-settings -lut 21600 phpantom.keychain
          security unlock-keychain -p actions-keychain phpantom.keychain

          # Import the certificate + private key
          security import certificate.p12 \
            -k phpantom.keychain \
            -P "$APPLE_CERTIFICATE_PASSWORD" \
            -T /usr/bin/codesign
          security list-keychain -d user -s phpantom.keychain

          # Allow codesign to use the key without a UI prompt
          security set-key-partition-list \
            -S apple-tool:,apple: \
            -k actions-keychain \
            phpantom.keychain
          
          rm certificate.p12

      - name: Sign binary (macOS)
        if: matrix.macos_sign
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          codesign \
            --keychain phpantom.keychain \
            --sign "$APPLE_SIGNING_IDENTITY" \
            --options runtime \
            --timestamp \
            --force \
            target/${{ matrix.target }}/release/phpantom_lsp

      - name: Notarize binary (macOS)
        if: matrix.macos_sign
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          # Zip just for submission — notarytool requires an archive
          ditto -c -k --keepParent \
            target/${{ matrix.target }}/release/phpantom_lsp \
            phpantom_lsp-notarize.zip

          xcrun notarytool submit phpantom_lsp-notarize.zip \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_ID_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait

          rm phpantom_lsp-notarize.zip

      - name: Delete temporary keychain
        if: matrix.macos_sign && always()
        run: |
          security delete-keychain phpantom.keychain || true

      # --- Package ---

      - name: Package (unix)
        if: matrix.archive == 'tar.gz'
        run: |
          cd target/${{ matrix.target }}/release
          # Appends the cpu_version (e.g., -x86-64-v3) to the archive name if it exists
          SUFFIX="${{ matrix.suffix && format('-{0}', matrix.suffix) || '' }}"
          tar czf ../../../phpantom_lsp-${{ matrix.target }}${SUFFIX}.tar.gz phpantom_lsp
          cd ../../..

      - name: Package (windows)
        if: matrix.archive == 'zip'
        shell: pwsh
        run: |
          $suffix = "${{ matrix.suffix }}" ? "-${{ matrix.suffix }}" : ""
          Compress-Archive `
            -Path "target/${{ matrix.target }}/release/phpantom_lsp.exe" `
            -DestinationPath "phpantom_lsp-${{ matrix.target }}$suffix.zip"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: phpantom_lsp-${{ matrix.target }}-${{ matrix.suffix || '' }}
          path: phpantom_lsp-${{ matrix.target }}${{ matrix.suffix && format('-{0}', matrix.suffix) || '' }}.${{ matrix.archive }}

  release:
    name: Create Release
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Upload assets to release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          for file in artifacts/*; do
            gh release upload "${{ github.event.release.tag_name }}" "$file" --clobber
          done