release-beta.yml

name: Release (Beta)

# Beta channel is enabled for GitHub prereleases.
#
# Keep BETA_CHANNEL_ENABLED as an emergency brake: set the repository variable
# to `false` or unset it to skip beta jobs without editing the workflow.
on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      release_tag:
        description: "Existing prerelease tag to rebuild and publish, for example v0.1.0-beta.1"
        required: true
        type: string

# Only runs for prerelease tags — stable releases handled by release.yml

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always
  RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.event.release.tag_name }}

concurrency:
  group: release-beta-${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.event.release.tag_name }}
  cancel-in-progress: false

jobs:
  build:
    name: Build ${{ matrix.name }}
    if: vars.BETA_CHANNEL_ENABLED == 'true' && (github.event_name == 'workflow_dispatch' || github.event.release.prerelease)
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: aarch64-macos
            runner: macos-14
            target: aarch64-apple-darwin
            bottle_tag: arm64_sonoma
            archive: tar.gz
          - name: x86_64-linux
            runner: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            bottle_tag: x86_64_linux
            archive: tar.gz
          - name: aarch64-linux
            runner: ubuntu-22.04-arm
            target: aarch64-unknown-linux-gnu
            archive: tar.gz
          - name: x86_64-windows
            runner: windows-latest
            target: x86_64-pc-windows-msvc
            archive: zip

    steps:
      - name: Validate manual prerelease rebuild
        if: github.event_name == 'workflow_dispatch'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          test "$(gh release view "$RELEASE_TAG" --repo "${{ github.repository }}" --json isPrerelease --jq .isPrerelease)" = true

      - uses: actions/checkout@v4
        with:
          ref: ${{ env.RELEASE_TAG }}

      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: dashboard/package-lock.json

      - name: Build dashboard assets
        working-directory: dashboard
        run: |
          npm ci
          npm run build

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: ./.github/actions/setup-linux-mold

      - name: Use lld-link
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          where.exe lld-link
          lld-link --version
          "RUSTFLAGS=-C linker=lld-link.exe" >> $env:GITHUB_ENV

      - name: Cache Cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
          key: ${{ runner.os }}-${{ matrix.target }}-cargo-beta-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.target }}-cargo-beta-
            ${{ runner.os }}-${{ matrix.target }}-cargo-

      - name: Build release binary
        run: cargo build --release --target ${{ matrix.target }}

      - name: Get version
        id: version
        shell: bash
        run: |
          VERSION="${RELEASE_TAG#v}"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      # --- Binary archive (all platforms) ---

      - name: Package binary (unix)
        if: matrix.archive == 'tar.gz'
        run: |
          cd target/${{ matrix.target }}/release
          tar czf ../../../tracedecay-beta-${{ env.RELEASE_TAG }}-${{ matrix.name }}.tar.gz tracedecay
          cd ../../..

      - name: Package binary (windows)
        if: matrix.archive == 'zip'
        shell: pwsh
        run: |
          Compress-Archive -Path target/${{ matrix.target }}/release/tracedecay.exe -DestinationPath tracedecay-beta-${{ env.RELEASE_TAG }}-${{ matrix.name }}.zip

      - name: Upload binary archive
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: gh release upload "$RELEASE_TAG" tracedecay-beta-${{ env.RELEASE_TAG }}-${{ matrix.name }}.${{ matrix.archive }} --clobber

      # --- Homebrew bottle (only for platforms with bottle_tag) ---

      - name: Package Homebrew bottle
        if: matrix.bottle_tag
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          BOTTLE_TAG="${{ matrix.bottle_tag }}"
          mkdir -p tracedecay-beta/${VERSION}/bin
          cp target/${{ matrix.target }}/release/tracedecay tracedecay-beta/${VERSION}/bin/tracedecay
          chmod +x tracedecay-beta/${VERSION}/bin/tracedecay
          tar czf "tracedecay-beta-${VERSION}.${BOTTLE_TAG}.bottle.tar.gz" tracedecay-beta/

      - name: Upload bottle artifact
        if: matrix.bottle_tag
        uses: actions/upload-artifact@v4
        with:
          name: bottle-beta-${{ matrix.bottle_tag }}
          path: "tracedecay-beta-*.bottle.tar.gz"

  update-homebrew:
    name: Update Homebrew tap (beta)
    if: vars.BETA_CHANNEL_ENABLED == 'true' && needs.build.result == 'success'
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Get version
        id: version
        run: |
          VERSION="${RELEASE_TAG#v}"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Download bottle artifacts
        uses: actions/download-artifact@v4
        with:
          path: bottles
          merge-multiple: true

      - name: Upload bottles to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          for f in bottles/tracedecay-beta-*.bottle.tar.gz; do
            gh release upload "$RELEASE_TAG" "$f" --clobber
          done

      - name: Download source tarball
        run: |
          curl -sL "https://github.com/${{ github.repository }}/archive/refs/tags/${RELEASE_TAG}.tar.gz" -o "source.tar.gz"

      - name: Compute SHA256 hashes
        id: hashes
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          SOURCE_SHA=$(sha256sum source.tar.gz | awk '{print $1}')
          echo "source_sha=${SOURCE_SHA}" >> "$GITHUB_OUTPUT"

          for f in bottles/tracedecay-beta-*.bottle.tar.gz; do
            tag=$(basename "$f" | sed "s/tracedecay-beta-${VERSION}\.\(.*\)\.bottle\.tar\.gz/\1/")
            sha=$(sha256sum "$f" | awk '{print $1}')
            echo "${tag}_sha=${sha}" >> "$GITHUB_OUTPUT"
          done

      # NOTE: the Homebrew tap (ScriptedAlchemy/homebrew-tap) is an external
      # repo — any previous beta formula there must be removed
      # separately; this step only writes Formula/tracedecay-beta.rb.
      - name: Update formula
        env:
          TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          SOURCE_SHA="${{ steps.hashes.outputs.source_sha }}"
          ARM64_SONOMA_SHA="${{ steps.hashes.outputs.arm64_sonoma_sha }}"
          X86_64_LINUX_SHA="${{ steps.hashes.outputs.x86_64_linux_sha }}"

          git clone "https://x-access-token:${TAP_GITHUB_TOKEN}@github.com/ScriptedAlchemy/homebrew-tap.git" tap

          cat > tap/Formula/tracedecay-beta.rb << EOF
          class TracedecayBeta < Formula
            desc "Code intelligence tool (beta channel)"
            homepage "https://github.com/ScriptedAlchemy/tracedecay"
            url "https://github.com/ScriptedAlchemy/tracedecay/archive/refs/tags/v${VERSION}.tar.gz"
            sha256 "${SOURCE_SHA}"
            license "MIT"

            bottle do
              root_url "https://github.com/ScriptedAlchemy/tracedecay/releases/download/v${VERSION}"
              sha256 cellar: :any_skip_relocation, arm64_sonoma: "${ARM64_SONOMA_SHA}"
              sha256 cellar: :any_skip_relocation, x86_64_linux: "${X86_64_LINUX_SHA}"
            end

            depends_on "rust" => :build

            conflicts_with "tracedecay", because: "both install a 'tracedecay' binary"

            def install
              system "cargo", "install", *std_cargo_args
            end

            test do
              system "#{bin}/tracedecay", "--help"
            end
          end
          EOF

          cd tap
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Formula/tracedecay-beta.rb
          git diff --cached --quiet || git commit -m "tracedecay-beta ${VERSION}"
          git push

  update-scoop:
    name: Update Scoop bucket (beta)
    if: vars.BETA_CHANNEL_ENABLED == 'true' && needs.build.result == 'success'
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Get release info
        id: release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${RELEASE_TAG#v}"
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "tag=${RELEASE_TAG}" >> "$GITHUB_OUTPUT"

          gh release download "${RELEASE_TAG}" \
            --repo "${{ github.repository }}" \
            --pattern "tracedecay-beta-${RELEASE_TAG}-x86_64-windows.zip" \
            --dir .
          SHA256=$(sha256sum "tracedecay-beta-${RELEASE_TAG}-x86_64-windows.zip" | cut -d' ' -f1)
          echo "sha256_win64=${SHA256}" >> "$GITHUB_OUTPUT"

      # NOTE: the Scoop bucket (ScriptedAlchemy/scoop-bucket) is an external
      # repo — any previous beta bucket manifest there must be removed
      # separately; this step only writes bucket/tracedecay-beta.json.
      - name: Update Scoop manifest
        env:
          SCOOP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
        run: |
          VERSION="${{ steps.release.outputs.version }}"
          TAG="${{ steps.release.outputs.tag }}"
          SHA256="${{ steps.release.outputs.sha256_win64 }}"

          cat > tracedecay-beta.json << EOF
          {
            "version": "${VERSION}",
            "description": "Code intelligence tool (beta channel)",
            "homepage": "https://github.com/ScriptedAlchemy/tracedecay",
            "license": "MIT",
            "architecture": {
              "64bit": {
                "url": "https://github.com/ScriptedAlchemy/tracedecay/releases/download/${TAG}/tracedecay-beta-${TAG}-x86_64-windows.zip",
                "hash": "${SHA256}"
              }
            },
            "bin": "tracedecay.exe",
            "checkver": {
              "github": "https://github.com/ScriptedAlchemy/tracedecay",
              "regex": "v([\\d.]+-beta[\\d.]*)"
            },
            "autoupdate": {
              "architecture": {
                "64bit": {
                  "url": "https://github.com/ScriptedAlchemy/tracedecay/releases/download/v\$version/tracedecay-beta-v\$version-x86_64-windows.zip"
                }
              }
            }
          }
          EOF

          git clone "https://x-access-token:${SCOOP_GITHUB_TOKEN}@github.com/ScriptedAlchemy/scoop-bucket.git" scoop-repo
          cd scoop-repo
          mkdir -p bucket
          cp ../tracedecay-beta.json bucket/tracedecay-beta.json
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add bucket/tracedecay-beta.json
          git diff --cached --quiet || git commit -m "tracedecay-beta ${VERSION}"
          git push