release.yml

name: Release

# Builds self-contained binaries for every platform and publishes
# them to a GitHub Release. Trigger by pushing a version tag:
#
#   git tag v1.0.0 && git push origin v1.0.0
#
# Asset naming (consumed by install.sh / install.ps1):
#   quantoscript-<version>-<target>.tar.gz   (macOS / Linux)
#   quantoscript-<version>-<target>.zip      (Windows)

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            target: x86_64-apple-darwin
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: windows-latest
            target: x86_64-pc-windows-gnu

    steps:
      - uses: actions/checkout@v4

      # ── Dependencies ─────────────────────────────────────────────
      - name: Install OpenSSL (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libssl-dev

      - name: Install OpenSSL (macOS)
        if: runner.os == 'macOS'
        run: brew install openssl@3

      - name: Setup MSYS2 (Windows)
        if: runner.os == 'Windows'
        uses: msys2/setup-msys2@v2
        with:
          msystem: MINGW64
          update: true
          install: >-
            mingw-w64-x86_64-gcc
            mingw-w64-x86_64-openssl
            mingw-w64-x86_64-pkgconf
            make

      # ── Build (statically linked) ───────────────────────────────
      - name: Build (macOS)
        if: runner.os == 'macOS'
        run: make STATIC_SSL=1 OPENSSL_DIR="$(brew --prefix openssl@3)"

      - name: Build (Linux)
        if: runner.os == 'Linux'
        run: make SSL_LIBS="-l:libssl.a -l:libcrypto.a"

      - name: Build (Windows)
        if: runner.os == 'Windows'
        shell: msys2 {0}
        run: make SSL_LIBS="/mingw64/lib/libssl.a /mingw64/lib/libcrypto.a"

      # ── Verify ───────────────────────────────────────────────────
      - name: Verify binary (Linux / macOS)
        if: runner.os != 'Windows'
        run: ./build/qs version

      - name: Verify binary (Windows)
        if: runner.os == 'Windows'
        shell: msys2 {0}
        run: ./build/qs.exe version

      - name: Check binary dependencies (Linux)
        if: runner.os == 'Linux'
        run: |
          echo "=== Dynamic library dependencies ==="
          ldd build/qs
          echo ""
          echo "=== Checking for libssl/libcrypto ==="
          if ldd build/qs | grep -qi 'ssl\|crypto'; then
            echo "WARNING: binary dynamically links OpenSSL"
            exit 1
          else
            echo "OK: binary is self-contained (no OpenSSL dynamic deps)"
          fi

      - name: Check binary dependencies (macOS)
        if: runner.os == 'macOS'
        run: |
          echo "=== Dynamic library dependencies ==="
          otool -L build/qs
          echo ""
          echo "=== Checking for OpenSSL dylib ==="
          if otool -L build/qs | grep -qi 'openssl\|libssl\|libcrypto'; then
            echo "WARNING: binary dynamically links OpenSSL"
            exit 1
          else
            echo "OK: binary is self-contained (no OpenSSL dynamic deps)"
          fi

      - name: Check binary dependencies (Windows)
        if: runner.os == 'Windows'
        shell: msys2 {0}
        run: |
          echo "=== Dynamic library dependencies ==="
          objdump -p build/qs.exe | grep "DLL Name" || true
          echo ""
          echo "=== Checking for OpenSSL DLLs ==="
          if objdump -p build/qs.exe | grep -qi 'ssl\|crypto'; then
            echo "WARNING: binary dynamically links OpenSSL"
            exit 1
          else
            echo "OK: binary is self-contained (no OpenSSL dynamic deps)"
          fi

      # ── Package ──────────────────────────────────────────────────
      - name: Create release archive
        shell: bash
        run: |
          set -eu

          VERSION="${GITHUB_REF_NAME#v}"
          PKG="quantoscript-${VERSION}-${{ matrix.target }}"

          # Assemble package tree
          mkdir -p "dist/$PKG/bin"
          if [ "${{ runner.os }}" = "Windows" ]; then
            cp build/qs.exe "dist/$PKG/bin/qs.exe"
          else
            cp build/qs     "dist/$PKG/bin/qs"
          fi
          cp -R stdlib   "dist/$PKG/stdlib"
          cp -R examples "dist/$PKG/examples"
          cp LICENSE README.md "dist/$PKG/"

          # Create archive
          cd dist
          if [ "${{ runner.os }}" = "Windows" ]; then
            7z a "${PKG}.zip" "$PKG" >/dev/null
          else
            tar czf "${PKG}.tar.gz" "$PKG"
          fi

          # Generate SHA256 checksum
          if [ "${{ runner.os }}" = "Windows" ]; then
            ASSET="${PKG}.zip"
          else
            ASSET="${PKG}.tar.gz"
          fi
          if command -v sha256sum >/dev/null 2>&1; then
            sha256sum "$ASSET" > "${ASSET}.sha256"
          else
            shasum -a 256 "$ASSET" > "${ASSET}.sha256"
          fi
          echo "=== Packaged ==="
          ls -la

      # ── Upload artifacts ─────────────────────────────────────────
      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.target }}
          path: |
            dist/*.tar.gz
            dist/*.zip
            dist/*.sha256
          if-no-files-found: error

  release:
    name: Publish release
    needs: build
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: List release assets
        run: |
          echo "=== All release assets ==="
          ls -la dist/
          echo ""
          echo "=== SHA256 checksums ==="
          for f in dist/*.sha256; do
            echo "--- $f ---"
            cat "$f"
          done

      - name: Fail if nothing built
        run: |
          if ! ls dist/*.tar.gz dist/*.zip >/dev/null 2>&1; then
            echo "No binaries were produced by any platform leg." >&2
            exit 1
          fi

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: |
            dist/*.tar.gz
            dist/*.zip
            dist/*.sha256