release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: Version without leading v, such as 2026.5.15.0
        required: true
        type: string

permissions:
  contents: write

concurrency:
  group: changelog-append
  cancel-in-progress: false

jobs:
  release:
    runs-on: windows-latest
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          # Full history + all tags so the release-body step can diff
          # commits against the previous version tag for the changelog.
          fetch-depth: 0
          fetch-tags: true

      - name: Test release base selection
        shell: pwsh
        run: ./.github/scripts/Test-ResolveReleaseBaseTag.ps1

      - name: Test workflow scripts
        shell: pwsh
        run: |
          ./.github/scripts/Test-WorkflowSyntax.ps1
          ./.github/scripts/Test-UpdateChangelog.ps1
          ./.github/scripts/Test-GenerateReleaseNotes.ps1
          ./.github/scripts/Test-ReleaseVersionSequence.ps1
          ./.github/scripts/Test-NightlyPrereleasePlan.ps1

      - name: Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Rust cache
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            bridge/target
          key: ${{ runner.os }}-bridge-${{ hashFiles('bridge/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-bridge-

      - name: Pico build cache
        uses: actions/cache@v5
        with:
          path: |
            pico-bridge/build-_pico_sdk
            pico-bridge/build-pico2w
            pico-bridge/build-picow
          key: ${{ runner.os }}-pico-${{ hashFiles('pico-bridge/CMakeLists.txt', 'pico-bridge/pico_sdk_import.cmake', 'pico-bridge/scripts/build.ps1', 'pico-bridge/src/**') }}
          restore-keys: |
            ${{ runner.os }}-pico-

      - name: Install Pico toolchain
        shell: pwsh
        run: |
          choco install ninja -y --no-progress

          $version = "13.2.rel1"
          $archiveName = "arm-gnu-toolchain-$version-mingw-w64-i686-arm-none-eabi.zip"
          $url = "https://armkeil.blob.core.windows.net/developer/Files/downloads/gnu/$version/binrel/$archiveName"
          $installRoot = Join-Path $env:RUNNER_TEMP "arm-gnu-toolchain"
          $archive = Join-Path $env:RUNNER_TEMP $archiveName

          New-Item -ItemType Directory -Force -Path $installRoot | Out-Null
          for ($attempt = 1; $attempt -le 5; $attempt++) {
            try {
              Invoke-WebRequest -Uri $url -OutFile $archive -UseBasicParsing
              break
            } catch {
              if ($attempt -eq 5) { throw }
              Start-Sleep -Seconds (5 * $attempt)
            }
          }

          Expand-Archive -LiteralPath $archive -DestinationPath $installRoot -Force
          $gcc = Get-ChildItem -LiteralPath $installRoot -Filter arm-none-eabi-gcc.exe -Recurse |
            Select-Object -First 1
          if (-not $gcc) { throw "arm-none-eabi-gcc.exe was not found after extracting $archiveName" }

          $binDir = $gcc.Directory.FullName
          $env:PATH = "$binDir;$env:PATH"
          Add-Content -LiteralPath $env:GITHUB_PATH -Value $binDir -Encoding UTF8

          cmake --version
          ninja --version
          arm-none-eabi-gcc --version

      - name: Rust format
        run: cargo fmt --manifest-path bridge/Cargo.toml -- --check

      - name: Rust clippy
        run: cargo clippy --manifest-path bridge/Cargo.toml --all-targets --locked -- -D warnings

      - name: Rust tests
        run: cargo test --manifest-path bridge/Cargo.toml --locked

      - name: Resolve version
        id: version
        shell: pwsh
        run: |
          if ('${{ github.event_name }}' -eq 'workflow_dispatch') {
            $version = '${{ inputs.version }}'
            $tag = "v$version"
          } else {
            $tag = '${{ github.ref_name }}'
            $version = $tag.TrimStart('v')
          }
          if ($version -notmatch '^\d{4}\.\d+\.\d+\.\d+(-[A-Za-z0-9]{4})?$') {
            throw "Invalid version '$version'. Expected YYYY.M.D.N, YYYY.M.D.N-XXXX, or YYYY.M.D.N-beta."
          }
          $isBeta = $tag -like '*-beta*'
          "is_beta=$($isBeta.ToString().ToLower())" >> $env:GITHUB_OUTPUT
          "version=$version" >> $env:GITHUB_OUTPUT
          "tag=$tag" >> $env:GITHUB_OUTPUT

      - name: Validate release version sequence
        shell: pwsh
        run: ./.github/scripts/Assert-ReleaseVersionSequence.ps1 -Tag '${{ steps.version.outputs.tag }}'

      - name: Promote changelog
        id: changelog
        shell: pwsh
        env:
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: |
          $tag = '${{ steps.version.outputs.tag }}'
          $prevTag = & ./.github/scripts/Resolve-ReleaseBaseTag.ps1 -Tag $tag
          if ($LASTEXITCODE -eq 0 -and $prevTag) {
              Write-Host "Preloading changelog entries from $prevTag..$tag before promotion."
              ./.github/scripts/Update-Changelog.ps1 -Mode Append -Range "$prevTag..$tag"
          } else {
              Write-Host "No previous release tag found before $tag; promoting the existing Unreleased section."
          }

          ./.github/scripts/Update-Changelog.ps1 -Mode Promote -Version $tag
          New-Item -ItemType Directory -Force -Path .changelog-stash | Out-Null
          Copy-Item CHANGELOG.md .changelog-stash/CHANGELOG.md -Force

          $notes = ./.github/scripts/Update-Changelog.ps1 -Mode Notes -ForVersion -Version $tag
          $notesPath = Join-Path $env:RUNNER_TEMP "changelog-notes.md"
          Set-Content -LiteralPath $notesPath -Value $notes -Encoding UTF8
          "notes_path=$notesPath" >> $env:GITHUB_OUTPUT

      - name: Build release zip
        shell: pwsh
        run: |
          Remove-Item -LiteralPath pico-bridge/build-pico2w,pico-bridge/build-picow -Recurse -Force -ErrorAction SilentlyContinue
          ./build.ps1 -Version '${{ steps.version.outputs.version }}' -Package

      - name: Locate artifacts
        id: artifact
        shell: pwsh
        run: |
          $zip = Get-ChildItem dist/ParsecCouchLink-v*.zip | Select-Object -First 1
          if (-not $zip) { throw "No release zip found in dist/." }
          $manifest = Get-ChildItem dist/ParsecCouchLink-v*.manifest.tsv | Select-Object -First 1
          if (-not $manifest) { throw "No release manifest found in dist/." }
          $sha = (Get-FileHash -LiteralPath $zip.FullName -Algorithm SHA256).Hash.ToUpperInvariant()
          $manifestSha = (Get-FileHash -LiteralPath $manifest.FullName -Algorithm SHA256).Hash.ToUpperInvariant()
          $integrityName = $zip.Name -replace '\.zip$', '.integrity.tsv'
          $integrity = Join-Path $zip.DirectoryName $integrityName
          $rows = @(
            "path`tbytes`tsha256",
            "$($zip.Name)`t$($zip.Length)`t$sha",
            "$($manifest.Name)`t$($manifest.Length)`t$manifestSha"
          )
          [System.IO.File]::WriteAllLines($integrity, [string[]]$rows, [System.Text.UTF8Encoding]::new($false))
          "zip=$($zip.FullName)" >> $env:GITHUB_OUTPUT
          "zip_name=$($zip.Name)" >> $env:GITHUB_OUTPUT
          "zip_size=$($zip.Length)" >> $env:GITHUB_OUTPUT
          "manifest=$($manifest.FullName)" >> $env:GITHUB_OUTPUT
          "integrity=$integrity" >> $env:GITHUB_OUTPUT
          "integrity_name=$integrityName" >> $env:GITHUB_OUTPUT
          "sha256=$sha" >> $env:GITHUB_OUTPUT

      - name: Upload workflow artifact
        uses: actions/upload-artifact@v7
        with:
          name: ParsecCouchLink-release
          path: |
            ${{ steps.artifact.outputs.zip }}
            ${{ steps.artifact.outputs.integrity }}
            ${{ steps.artifact.outputs.manifest }}

      - name: Publish GitHub release
        id: publish
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ steps.version.outputs.tag }}
          ZIP_PATH: ${{ steps.artifact.outputs.zip }}
          ZIP_NAME: ${{ steps.artifact.outputs.zip_name }}
          ZIP_SIZE: ${{ steps.artifact.outputs.zip_size }}
          ZIP_SHA256: ${{ steps.artifact.outputs.sha256 }}
          INTEGRITY_PATH: ${{ steps.artifact.outputs.integrity }}
          INTEGRITY_NAME: ${{ steps.artifact.outputs.integrity_name }}
          MANIFEST_PATH: ${{ steps.artifact.outputs.manifest }}
        shell: pwsh
        run: |
          $notesOutput = & ./.github/scripts/Generate-ReleaseNotes.ps1 `
            -Tag $env:TAG_NAME `
            -Repo $env:GITHUB_REPOSITORY `
            -ZipPath $env:ZIP_PATH `
            -ZipName $env:ZIP_NAME `
            -ZipSize ([long]$env:ZIP_SIZE) `
            -ZipSha256 $env:ZIP_SHA256 `
            -Manifest $env:MANIFEST_PATH
          if ($LASTEXITCODE -ne 0) { throw "Generate-ReleaseNotes.ps1 failed (exit $LASTEXITCODE)" }
          if (-not $notesOutput) { throw "Generate-ReleaseNotes.ps1 returned empty output." }
          $notes = ($notesOutput -join [System.Environment]::NewLine) + [System.Environment]::NewLine
          $notesPath = Join-Path $env:RUNNER_TEMP "release-notes.md"
          [System.IO.File]::WriteAllText($notesPath, $notes, (New-Object System.Text.UTF8Encoding($false)))
          "notes_path=$notesPath" >> $env:GITHUB_OUTPUT

          # Draft-first: create as draft, upload all assets, only then
          # promote to a published release. If any step between create
          # and promote fails, the release stays as a draft and the
          # workflow's failure is visible -- preferable to publishing a
          # release that's missing assets.
          $extra = @('--draft')
          if ('${{ steps.version.outputs.is_beta }}' -eq 'true') { $extra += @('--prerelease','--latest=false') }
          gh release create $env:TAG_NAME $env:ZIP_PATH $env:INTEGRITY_PATH $env:MANIFEST_PATH --title $env:TAG_NAME --notes-file $notesPath @extra
          if ($LASTEXITCODE -ne 0) { throw "gh release create failed (exit $LASTEXITCODE)" }

          # Verify the assets actually attached (gh release create
          # can succeed with the metadata but fail mid-upload on the
          # asset stage; the release is then live as a draft with
          # missing files). View the release as JSON and check.
          $json = gh release view $env:TAG_NAME --json assets,isDraft
          if ($LASTEXITCODE -ne 0) { throw "gh release view failed (exit $LASTEXITCODE)" }
          $info = $json | ConvertFrom-Json
          $expected = @($env:ZIP_NAME, $env:INTEGRITY_NAME, [System.IO.Path]::GetFileName($env:MANIFEST_PATH))
          foreach ($e in $expected) {
              if (-not ($info.assets.name -contains $e)) {
                  throw "Asset '$e' did not attach to draft release $env:TAG_NAME -- leaving as draft for manual inspection."
              }
          }
          Write-Host "Draft release $env:TAG_NAME has all expected assets, promoting to published."
          gh release edit $env:TAG_NAME --draft=false
          if ($LASTEXITCODE -ne 0) { throw "gh release edit --draft=false failed (exit $LASTEXITCODE)" }

      - name: Verify published release body
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ steps.version.outputs.tag }}
          INPUT_NOTES_PATH: ${{ steps.publish.outputs.notes_path }}
        shell: pwsh
        run: |
          $expected = (Get-Content -LiteralPath $env:INPUT_NOTES_PATH -Raw -Encoding UTF8) -replace "`r`n","`n"
          $expected = $expected.TrimEnd("`n")

          function Get-StringSha256 {
              param([string]$Text)
              $bytes = [System.Text.Encoding]::UTF8.GetBytes($Text)
              $sha = [System.Security.Cryptography.SHA256]::Create()
              try { return [BitConverter]::ToString($sha.ComputeHash($bytes)).Replace('-', '') }
              finally { $sha.Dispose() }
          }

          function Test-PublishedBodyMatches {
              param([string]$Tag, [string]$Expected, [int]$MaxAttempts = 6)
              $expectedSha = Get-StringSha256 -Text $Expected
              $delay = 2
              $lastActual = ''
              for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
                  $raw = & gh release view $Tag --json body
                  if ($LASTEXITCODE -ne 0) { throw "gh release view $Tag failed: $raw" }
                  $actual = [string](($raw | ConvertFrom-Json).body)
                  $actual = ($actual -replace "`r`n","`n").TrimEnd("`n")
                  $lastActual = $actual
                  $actualSha = Get-StringSha256 -Text $actual
                  if ($actualSha -eq $expectedSha) {
                      Write-Host "Release body matches on attempt $attempt."
                      return @{ Match = $true; Actual = $actual; AttemptCount = $attempt }
                  }
                  Write-Host "Attempt $attempt mismatch: actual_len=$($actual.Length) expected_len=$($Expected.Length)."
                  if ($attempt -lt $MaxAttempts) {
                      Start-Sleep -Seconds $delay
                      $delay = $delay * 2
                  }
              }
              return @{ Match = $false; Actual = $lastActual; AttemptCount = $MaxAttempts }
          }

          $result = Test-PublishedBodyMatches -Tag $env:TAG_NAME -Expected $expected
          if ($result.Match) { return }

          Write-Host "::warning::Body still differs after $($result.AttemptCount) attempts. Re-applying release notes."
          gh release edit $env:TAG_NAME --notes-file $env:INPUT_NOTES_PATH
          if ($LASTEXITCODE -ne 0) { throw "gh release edit failed during body correction" }

          $recheck = Test-PublishedBodyMatches -Tag $env:TAG_NAME -Expected $expected
          if ($recheck.Match) { return }

          $actualText = [string]$recheck.Actual
          $staleReadThreshold = [Math]::Min(256, [Math]::Floor($expected.Length / 2))
          if ($actualText.Length -lt $staleReadThreshold) {
              Write-Host "::warning::Release body still reads short after correction; continuing after successful edit."
              return
          }
          throw "Release body still differs after correction."

      - name: Commit changelog promotion
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          TAG_NAME: ${{ steps.version.outputs.tag }}
        run: |
          set -euo pipefail

          git fetch origin main
          expected_oid=$(git rev-parse origin/main)

          if cmp -s .changelog-stash/CHANGELOG.md <(git show origin/main:CHANGELOG.md); then
            echo "CHANGELOG.md already matches origin/main."
            exit 0
          fi

          changelog_b64=$(base64 -w 0 .changelog-stash/CHANGELOG.md)
          headline="docs(changelog): promote ${TAG_NAME} [skip changelog]"
          body="Updated by .github/workflows/release.yml after publishing ${TAG_NAME}."

          payload=$(jq -n \
            --arg repo "$GITHUB_REPOSITORY" \
            --arg branch "main" \
            --arg headline "$headline" \
            --arg body "$body" \
            --arg oid "$expected_oid" \
            --arg changelog "$changelog_b64" \
            '{
              query: "mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { oid url } } }",
              variables: {
                input: {
                  branch: { repositoryNameWithOwner: $repo, branchName: $branch },
                  message: { headline: $headline, body: $body },
                  fileChanges: {
                    additions: [
                      { path: "CHANGELOG.md", contents: $changelog }
                    ]
                  },
                  expectedHeadOid: $oid
                }
              }
            }')

          response=$(printf '%s' "$payload" | gh api graphql --input -)
          echo "$response" | jq .
          if echo "$response" | jq -e '.errors // empty' >/dev/null; then
            echo "::error::createCommitOnBranch returned GraphQL errors"
            exit 1
          fi

          new_oid=$(echo "$response" | jq -r '.data.createCommitOnBranch.commit.oid')
          if [[ -z "$new_oid" || "$new_oid" == "null" ]]; then
            echo "::error::createCommitOnBranch did not return a commit oid"
            exit 1
          fi
          echo "Committed changelog promotion: $new_oid"