publish-socketbin.yml

name: 📦 Publish CLIs

on:
  workflow_dispatch:
    inputs:
      force:
        description: 'Force rebuild (ignore cache)'
        type: boolean
        default: false
      version:
        description: 'Version to publish (semver format: 0.0.0-20250122.143052, auto-generated if omitted)'
        required: false
        type: string
      method:
        description: 'Build method to use'
        required: false
        type: choice
        options:
          - sea
          - smol
          - smol-sea
        default: sea
      build-linux:
        description: 'Build Linux binaries'
        required: false
        type: boolean
        default: true
      build-macos:
        description: 'Build macOS binaries'
        required: false
        type: boolean
        default: true
      build-windows:
        description: 'Build Windows binaries'
        required: false
        type: boolean
        default: true
      dry-run:
        description: 'Dry run (build but do not publish) - primes cache for CI e2e tests'
        required: false
        type: boolean
        default: false

permissions:
  contents: read

jobs:
  build-sea:
    permissions:
      contents: read
    name: Build ${{ matrix.platform }}-${{ matrix.arch }}
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux builds
          - runner: ubuntu-latest
            os: linux
            platform: linux
            arch: x64
          - runner: ubuntu-latest
            os: linux
            platform: linux
            arch: arm64

          # Linux musl builds
          - runner: ubuntu-latest
            os: linux
            platform: linux
            libc: musl
            arch: x64
          - runner: ubuntu-latest
            os: linux
            platform: linux
            libc: musl
            arch: arm64

          # macOS builds
          - runner: macos-latest
            os: darwin
            platform: darwin
            arch: x64
          - runner: macos-latest
            os: darwin
            platform: darwin
            arch: arm64

          # Windows builds
          - runner: windows-latest
            os: windows
            platform: win32
            arch: x64
          - runner: windows-latest
            os: windows
            platform: win32
            arch: arm64

    steps:
      - name: Check if platform is enabled
        id: check-platform
        shell: bash
        run: |
          SHOULD_RUN="false"
          if [ "${{ matrix.platform }}" = "linux" ]; then
            if [ "${{ inputs.build-linux }}" != "false" ]; then
              SHOULD_RUN="true"
            fi
          elif [ "${{ matrix.platform }}" = "darwin" ]; then
            if [ "${{ inputs.build-macos }}" != "false" ]; then
              SHOULD_RUN="true"
            fi
          elif [ "${{ matrix.platform }}" = "win32" ]; then
            if [ "${{ inputs.build-windows }}" != "false" ]; then
              SHOULD_RUN="true"
            fi
          fi
          echo "should-run=$SHOULD_RUN" >> $GITHUB_OUTPUT
          if [ "$SHOULD_RUN" = "true" ]; then
            echo "✓ Building ${{ matrix.platform }}-${{ matrix.arch }}"
          else
            echo "⊘ Skipping ${{ matrix.platform }}-${{ matrix.arch }} (disabled by inputs)"
          fi

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          autocrlf: false
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version-file: .node-version
          registry-url: 'https://registry.npmjs.org'
          cache: ''  # Disable automatic caching to prevent cache poisoning.

      - name: Setup pnpm
        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Setup ccache (Linux/macOS)
        if: matrix.os != 'windows'
        uses: hendrikmuhs/ccache-action@ed74d11c0b343532753ecead8a951bb09bb34bc9 # v1.2.14
        with:
          key: build-${{ matrix.platform }}-${{ matrix.arch }}
          max-size: 2G

      - name: Generate build-deps cache key for smol
        if: inputs.method == 'smol' || inputs.method == 'smol-sea'
        id: smol-deps-cache-key
        shell: bash
        run: |
          # Generate hash from bootstrap/socket packages (matches build-smol.yml).
          if [ "${{ matrix.os }}" = "windows" ]; then
            HASH=$(find packages/bootstrap packages/socket -type f \( -name "*.mts" -o -name "*.ts" -o -name "*.mjs" -o -name "*.js" -o -name "*.json" \) ! -path "*/node_modules/*" ! -path "*/dist/*" ! -path "*/build/*" | sort | xargs sha256sum | sha256sum | cut -d' ' -f1)
          else
            HASH=$(find packages/bootstrap packages/socket -type f \( -name "*.mts" -o -name "*.ts" -o -name "*.mjs" -o -name "*.js" -o -name "*.json" \) ! -path "*/node_modules/*" ! -path "*/dist/*" ! -path "*/build/*" | sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)
          fi
          echo "deps-hash=$HASH" >> $GITHUB_OUTPUT

      - name: Restore build-deps cache for smol
        if: inputs.method == 'smol' || inputs.method == 'smol-sea'
        id: smol-deps-cache
        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: |
            packages/bootstrap/dist/
            packages/socket/dist/
          key: build-deps-smol-${{ steps.smol-deps-cache-key.outputs.deps-hash }}
          restore-keys: build-deps-smol-

      - name: Build bootstrap package for smol
        if: (inputs.method == 'smol' || inputs.method == 'smol-sea') && steps.smol-deps-cache.outputs.cache-hit != 'true'
        run: pnpm --filter @socketsecurity/bootstrap run build

      - name: Build socket package bootstrap for smol
        if: (inputs.method == 'smol' || inputs.method == 'smol-sea') && steps.smol-deps-cache.outputs.cache-hit != 'true'
        run: pnpm --filter socket run build

      - name: Generate smol build cache key
        if: inputs.method == 'smol' || inputs.method == 'smol-sea'
        id: smol-cache-key
        shell: bash
        run: |
          # Generate hash from patches and build scripts (matches build-smol.yml).
          if [ "${{ matrix.os }}" = "windows" ]; then
            PATCHES_HASH=$(find patches packages/node-smol-builder/patches packages/node-smol-builder/additions scripts -type f \( -name "*.patch" -o -name "*.mjs" -o -name "*.h" -o -name "*.c" -o -name "*.cc" \) | sort | xargs sha256sum | sha256sum | cut -d' ' -f1)
            COMBINED_HASH=$(echo "$PATCHES_HASH-${STEPS_SMOL_DEPS_CACHE_KEY_OUTPUTS_DEPS_HASH}" | sha256sum | cut -d' ' -f1)
          else
            PATCHES_HASH=$(find patches packages/node-smol-builder/patches packages/node-smol-builder/additions scripts -type f \( -name "*.patch" -o -name "*.mjs" -o -name "*.h" -o -name "*.c" -o -name "*.cc" \) | sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)
            COMBINED_HASH=$(echo "$PATCHES_HASH-${STEPS_SMOL_DEPS_CACHE_KEY_OUTPUTS_DEPS_HASH}" | shasum -a 256 | cut -d' ' -f1)
          fi
          echo "hash=$COMBINED_HASH" >> $GITHUB_OUTPUT
        env:
          STEPS_SMOL_DEPS_CACHE_KEY_OUTPUTS_DEPS_HASH: ${{ steps.smol-deps-cache-key.outputs.deps-hash }}

      - name: Restore smol binary cache
        if: inputs.method == 'smol' || inputs.method == 'smol-sea'
        id: smol-cache
        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: packages/node-smol-builder/dist/socket-smol-${{ matrix.platform }}-${{ matrix.arch }}${{ matrix.os == 'windows' && '.exe' || '' }}
          key: node-smol-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.smol-cache-key.outputs.hash }}
          restore-keys: node-smol-${{ matrix.platform }}-${{ matrix.arch }}-

      - name: Build smol Node.js binary
        id: build-smol
        if: (inputs.method == 'smol' || inputs.method == 'smol-sea') && steps.smol-cache.outputs.cache-hit != 'true'
        continue-on-error: true
        shell: bash
        run: |
          echo "Building smol Node.js binary..."
          pnpm --filter @socketsecurity/node-smol-builder run build -- \
            --platform=${{ matrix.platform }} \
            --arch=${{ matrix.arch }}

      - name: Build smol binary (fallback with clean rebuild)
        if: (inputs.method == 'smol' || inputs.method == 'smol-sea') && steps.smol-cache.outputs.cache-hit != 'true' && steps.build-smol.outcome == 'failure'
        shell: bash
        run: |
          echo "Initial smol build failed, attempting clean rebuild..."
          pnpm --filter @socketsecurity/node-smol-builder run build -- \
            --platform=${{ matrix.platform }} \
            --arch=${{ matrix.arch }} \
            --clean

      - name: Generate build-deps cache key
        if: inputs.method == 'sea' || inputs.method == 'smol-sea'
        id: deps-cache-key
        shell: bash
        run: |
          # Include pnpm-lock.yaml to detect dependency changes (matches build-sea.yml).
          if [ "${{ matrix.os }}" = "windows" ]; then
            HASH=$(find packages/bootstrap packages/socket -type f \( -name "*.mts" -o -name "*.ts" -o -name "*.mjs" -o -name "*.js" -o -name "*.json" \) ! -path "*/node_modules/*" ! -path "*/dist/*" ! -path "*/build/*" | sort | xargs sha256sum | sha256sum | cut -d' ' -f1)
            LOCK_HASH=$(sha256sum pnpm-lock.yaml | cut -d' ' -f1)
          else
            HASH=$(find packages/bootstrap packages/socket -type f \( -name "*.mts" -o -name "*.ts" -o -name "*.mjs" -o -name "*.js" -o -name "*.json" \) ! -path "*/node_modules/*" ! -path "*/dist/*" ! -path "*/build/*" | sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)
            LOCK_HASH=$(shasum -a 256 pnpm-lock.yaml | cut -d' ' -f1)
          fi
          COMBINED_HASH=$(echo "$HASH-$LOCK_HASH" | sha256sum | cut -d' ' -f1 || echo "$HASH-$LOCK_HASH" | shasum -a 256 | cut -d' ' -f1)
          echo "deps-hash=$COMBINED_HASH" >> $GITHUB_OUTPUT

      - name: Restore build-deps cache
        if: inputs.method == 'sea' || inputs.method == 'smol-sea'
        id: deps-cache
        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: |
            packages/bootstrap/dist/
            packages/socket/dist/
          key: build-deps-sea-${{ steps.deps-cache-key.outputs.deps-hash }}
          restore-keys: build-deps-sea-

      - name: Build bootstrap package
        if: (inputs.method == 'sea' || inputs.method == 'smol-sea') && steps.deps-cache.outputs.cache-hit != 'true'
        run: pnpm --filter @socketsecurity/bootstrap run build

      - name: Build socket package bootstrap
        if: (inputs.method == 'sea' || inputs.method == 'smol-sea') && steps.deps-cache.outputs.cache-hit != 'true'
        run: pnpm --filter socket run build

      - name: Generate SEA build cache key
        if: inputs.method == 'sea' || inputs.method == 'smol-sea'
        id: sea-cache-key
        shell: bash
        run: |
          if [ "${{ matrix.os }}" = "windows" ]; then
            SEA_HASH=$(find packages/node-sea-builder packages/cli/src -type f \( -name "*.mts" -o -name "*.ts" -o -name "*.mjs" -o -name "*.js" \) | sort | xargs sha256sum | sha256sum | cut -d' ' -f1)
          else
            SEA_HASH=$(find packages/node-sea-builder packages/cli/src -type f \( -name "*.mts" -o -name "*.ts" -o -name "*.mjs" -o -name "*.js" \) | sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)
          fi
          # Include bootstrap/socket/cli dependencies in cache key (matches build-sea.yml).
          COMBINED_HASH=$(echo "$SEA_HASH-${STEPS_DEPS_CACHE_KEY_OUTPUTS_DEPS_HASH}" | sha256sum | cut -d' ' -f1 || echo "$SEA_HASH-${STEPS_DEPS_CACHE_KEY_OUTPUTS_DEPS_HASH}" | shasum -a 256 | cut -d' ' -f1)
          echo "hash=$COMBINED_HASH" >> $GITHUB_OUTPUT
        env:
          STEPS_DEPS_CACHE_KEY_OUTPUTS_DEPS_HASH: ${{ steps.deps-cache-key.outputs.deps-hash }}

      - name: Restore SEA binary cache
        if: inputs.method == 'sea' || inputs.method == 'smol-sea'
        id: sea-cache
        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: packages/node-sea-builder/dist/sea/
          key: node-sea-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.sea-cache-key.outputs.hash }}
          restore-keys: node-sea-${{ matrix.platform }}-${{ matrix.arch }}-

      - name: Build CLI (required for SEA)
        if: (inputs.method == 'sea' || inputs.method == 'smol-sea') && steps.sea-cache.outputs.cache-hit != 'true'
        shell: bash
        run: pnpm --filter @socketsecurity/cli run build

      - name: Build SEA binary
        id: build-sea
        if: (inputs.method == 'sea' || inputs.method == 'smol-sea') && steps.sea-cache.outputs.cache-hit != 'true'
        shell: bash
        run: |
          echo "Building SEA binary..."

          LIBC_FLAG=""
          if [ "${{ matrix.libc }}" = "musl" ]; then
            LIBC_FLAG="--libc=musl"
          fi

          pnpm --filter @socketbin/node-sea-builder run build -- \
            --platform=${{ matrix.platform }} \
            --arch=${{ matrix.arch }} \
            ${LIBC_FLAG}

      - name: Copy binary to dist/sea for prepublish script
        shell: bash
        run: |
          mkdir -p dist/sea

          # Determine musl suffix
          MUSL_SUFFIX=""
          if [ "${{ matrix.libc }}" = "musl" ]; then
            MUSL_SUFFIX="-musl"
          fi

          # Determine source binary name (from build-sea.yml naming).
          if [ "${{ matrix.platform }}" = "win32" ]; then
            SOURCE_BINARY="packages/node-sea-builder/dist/sea/socket-win-${{ matrix.arch }}.exe"
            TARGET_BINARY="dist/sea/socket-${{ matrix.platform }}-${{ matrix.arch }}.exe"
          elif [ "${{ matrix.platform }}" = "darwin" ]; then
            SOURCE_BINARY="packages/node-sea-builder/dist/sea/socket-macos-${{ matrix.arch }}"
            TARGET_BINARY="dist/sea/socket-${{ matrix.platform }}-${{ matrix.arch }}"
          else
            SOURCE_BINARY="packages/node-sea-builder/dist/sea/socket-${{ matrix.platform }}-${{ matrix.arch }}${MUSL_SUFFIX}"
            TARGET_BINARY="dist/sea/socket-${{ matrix.platform }}-${{ matrix.arch }}${MUSL_SUFFIX}"
          fi

          cp "$SOURCE_BINARY" "$TARGET_BINARY"
          echo "Copied $SOURCE_BINARY -> $TARGET_BINARY"

      - name: Verify binary
        shell: bash
        run: |
          ls -la dist/sea/socket-*
          file dist/sea/socket-* || true

      - name: Upload binary artifact
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: binary-${{ matrix.platform }}-${{ matrix.arch }}
          path: dist/sea/socket-*
          retention-days: 1

  publish-packages:
    name: Publish to npm
    needs: build-sea
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write  # For provenance

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          autocrlf: false
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version-file: .node-version
          registry-url: 'https://registry.npmjs.org'
          cache: ''  # Disable automatic caching to prevent cache poisoning.

      - name: Setup pnpm
        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0

      - name: Install latest npm
        run: npm install -g npm@latest

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Determine version
        id: version
        run: |
          VERSION="${INPUTS_VERSION}"
          if [ -z "$VERSION" ]; then
            # Read base version from socketbin package and extract X.Y.Z using semver
            PKG_VERSION=$(jq -r '.version' packages/socketbin-cli-linux-x64/package.json)
            BASE_VERSION=$(node -e "const semver = require('semver'); const v = semver.parse('$PKG_VERSION'); console.log(v ? \`\${v.major}.\${v.minor}.\${v.patch}\` : '0.0.0');")
            # Auto-generate version in semver format: X.Y.Z-YYYYMMDD.HHmmss
            VERSION="${BASE_VERSION}-$(date -u +'%Y%m%d.%H%M%S')"
            echo "Generated version: $VERSION"
          else
            # Remove 'v' prefix if present
            VERSION="${VERSION#v}"
            echo "Using provided version: $VERSION"
          fi
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
        env:
          INPUTS_VERSION: ${{ inputs.version }}

      - name: Check version consistency
        run: |
          echo "🔍 Checking version consistency for v${STEPS_VERSION_OUTPUTS_VERSION}..."
          node scripts/check-version-consistency.mjs ${STEPS_VERSION_OUTPUTS_VERSION}
        env:
          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}

      - name: Download all binaries
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          path: dist/sea
          pattern: binary-*
          merge-multiple: true

      - name: Verify downloaded binaries
        run: |
          echo "Downloaded binaries:"
          ls -la dist/sea/

      - name: Prepare and validate Linux x64
        run: |
          node scripts/prepublish-socketbin.mjs \
            --platform=linux --arch=x64 \
            --version=${STEPS_VERSION_OUTPUTS_VERSION} \
            --method=${{ inputs.method }}
        env:
          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}

      - name: Publish Linux x64
        if: ${{ !inputs.dry-run }}
        run: |
          cd packages/socketbin-cli-linux-x64
          npm publish --provenance --access public --tag latest --tag latest

      - name: Prepare and publish Linux ARM64
        if: ${{ !inputs.dry-run }}
        run: |
          node scripts/prepublish-socketbin.mjs \
            --platform=linux --arch=arm64 \
            --version=${STEPS_VERSION_OUTPUTS_VERSION} \
            --method=${{ inputs.method }}

          cd packages/socketbin-cli-linux-arm64
          npm publish --provenance --access public --tag latest --tag latest
        env:
          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}

      - name: Prepare and publish Linux musl x64
        if: ${{ !inputs.dry-run }}
        run: |
          node scripts/prepublish-socketbin.mjs \
            --platform=linux --arch=x64 --libc=musl \
            --version=${STEPS_VERSION_OUTPUTS_VERSION} \
            --method=${{ inputs.method }}

          cd packages/socketbin-cli-linux-x64-musl
          npm publish --provenance --access public --tag latest --tag latest
        env:
          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}

      - name: Prepare and publish Linux musl ARM64
        if: ${{ !inputs.dry-run }}
        run: |
          node scripts/prepublish-socketbin.mjs \
            --platform=linux --arch=arm64 --libc=musl \
            --version=${STEPS_VERSION_OUTPUTS_VERSION} \
            --method=${{ inputs.method }}

          cd packages/socketbin-cli-linux-arm64-musl
          npm publish --provenance --access public --tag latest
        env:
          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}

      - name: Prepare and publish macOS x64
        if: ${{ !inputs.dry-run }}
        run: |
          node scripts/prepublish-socketbin.mjs \
            --platform=darwin --arch=x64 \
            --version=${STEPS_VERSION_OUTPUTS_VERSION} \
            --method=${{ inputs.method }}

          cd packages/socketbin-cli-darwin-x64
          npm publish --provenance --access public --tag latest
        env:
          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}

      - name: Prepare and publish macOS ARM64
        if: ${{ !inputs.dry-run }}
        run: |
          node scripts/prepublish-socketbin.mjs \
            --platform=darwin --arch=arm64 \
            --version=${STEPS_VERSION_OUTPUTS_VERSION} \
            --method=${{ inputs.method }}

          cd packages/socketbin-cli-darwin-arm64
          npm publish --provenance --access public --tag latest
        env:
          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}

      - name: Prepare and publish Windows x64
        if: ${{ !inputs.dry-run }}
        run: |
          node scripts/prepublish-socketbin.mjs \
            --platform=win32 --arch=x64 \
            --version=${STEPS_VERSION_OUTPUTS_VERSION} \
            --method=${{ inputs.method }}

          cd packages/socketbin-cli-win32-x64
          npm publish --provenance --access public --tag latest
        env:
          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}

      - name: Prepare and publish Windows ARM64
        if: ${{ !inputs.dry-run }}
        run: |
          node scripts/prepublish-socketbin.mjs \
            --platform=win32 --arch=arm64 \
            --version=${STEPS_VERSION_OUTPUTS_VERSION} \
            --method=${{ inputs.method }}

          cd packages/socketbin-cli-win32-arm64
          npm publish --provenance --access public --tag latest
        env:
          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}

      - name: Prime npm cache for CI (dry-run)
        if: ${{ inputs.dry-run }}
        run: |
          echo "🔄 Priming npm cache for CI e2e tests..."

          # Prime cache for @coana-tech/cli
          if [ -n "$INLINED_SOCKET_CLI_COANA_VERSION" ]; then
            echo "Priming @coana-tech/cli@~$INLINED_SOCKET_CLI_COANA_VERSION..."
            npx --yes @coana-tech/cli@~$INLINED_SOCKET_CLI_COANA_VERSION --help || true
          fi

          echo "✓ Cache priming complete"

      - name: Dry run summary
        if: ${{ inputs.dry-run }}
        run: |
          echo "🚫 Dry run mode - packages were NOT published"
          echo ""
          echo "Generated packages:"
          find packages/binaries -name package.json -exec echo {} \; -exec jq -r '.name + "@" + .version' {} \;
          echo ""
          echo "💾 Cache primed for CI e2e tests"