release.yml

name: release

# Builds per-arch tarballs on tag push and uploads them to the
# GitHub Release. The install.sh one-liner reads from these assets
# via the GitHub API.
#
# Trigger:
#   - push of a tag matching `v*` (the release flow)
#   - manual workflow_dispatch (dry-run; uploads to a draft release
#     so we can inspect the artefact before cutting a real tag)
#
# Architecture strategy (since v1.0.8):
#   All builds run on macos-14 (arm64). The Swift helper is built
#   universal2 (single binary with both arm64 + x86_64 slices) and
#   shipped in both per-arch release tarballs. The PyInstaller-frozen
#   Python binary IS arch-specific, so we build it twice — once
#   natively on the arm64 host, once under Rosetta 2 (`arch -x86_64`)
#   for the Intel slice. Avoids the macos-13 runner queue, which
#   was starving so badly that the Intel tarball was effectively
#   never landing.

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: "Version override for workflow_dispatch runs (e.g. v0.10.0-rc1)"
        required: false
        default: ""

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write

jobs:
  build:
    # Both arches build from this single arm64 runner.
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v4

      - name: Resolve version
        id: ver
        run: |
          if [ "${{ github.event_name }}" = "push" ]; then
            VERSION="${GITHUB_REF_NAME}"
          else
            VERSION="${{ inputs.version }}"
            if [ -z "$VERSION" ]; then VERSION="v0.0.0-dispatch"; fi
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "num_version=${VERSION#v}" >> "$GITHUB_OUTPUT"

      - name: Ensure Rosetta 2 is installed
        # GitHub macos-14 runners normally have Rosetta installed,
        # but `softwareupdate --install-rosetta --agree-to-license`
        # is the official idempotent way to be sure. The flag is a
        # no-op if Rosetta is already there.
        run: softwareupdate --install-rosetta --agree-to-license || true

      - name: Install uv
        uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      # ---- Swift helper: build once, universal2, used by both
      # tarballs. The helper bundle is signed ad-hoc which produces
      # a stable cdhash across both arches — same cdhash means the
      # TCC grants the user accumulates carry across arm64 / x86_64
      # installs of the same release.
      - name: Build Swift helper (universal2)
        env:
          DITING_HELPER_UNIVERSAL: "1"
        run: ( cd helper && ./build.sh )

      # ---- arm64 build (native) -----------------------------------
      - name: Set up Python 3.11 (arm64 native)
        run: uv python install 3.11

      - name: Sync release deps (arm64)
        run: uv sync --group release --python 3.11

      - name: Package arm64 tarball
        run: |
          uv run --python 3.11 \
            bash scripts/package_release.sh "${{ steps.ver.outputs.num_version }}"

      - name: Stash arm64 tarball + sha256
        run: |
          mkdir -p stash
          mv dist/diting-${{ steps.ver.outputs.num_version }}-darwin-arm64.tar.gz        stash/
          mv dist/diting-${{ steps.ver.outputs.num_version }}-darwin-arm64.tar.gz.sha256 stash/

      # ---- x86_64 build (Rosetta) ---------------------------------
      # PyInstaller takes the arch of the currently-running Python.
      # uv can install an x86_64 Python build on an arm64 host via
      # the --python-platform flag; we then create a separate venv
      # for it. All subsequent commands wrapped in `arch -x86_64`
      # so uv, python, and any subprocess they invoke run as x86_64
      # under Rosetta.
      - name: Set up Python 3.11 (x86_64 via Rosetta)
        env:
          # Pin the uv version we download as x86_64 to match the
          # arm64 one that astral-sh/setup-uv@v5 installed earlier.
          # If they diverge, lockfile-resolution would too.
          UV_PIN: "0.11.14"
        run: |
          # The astral.sh/uv install.sh script reads
          # `sysctl hw.optional.arm64` directly, so running it under
          # `arch -x86_64` still picks the arm64 binary. We bypass
          # the install script entirely and download the explicit
          # x86_64 release tarball — that's the only way to get a
          # truly x86_64 uv onto an arm64 host runner.
          mkdir -p "$HOME/.local/bin-x86_64"
          curl -fsSL --retry 3 \
            "https://github.com/astral-sh/uv/releases/download/${UV_PIN}/uv-x86_64-apple-darwin.tar.gz" \
            -o /tmp/uv-x86_64.tar.gz
          tar -xzf /tmp/uv-x86_64.tar.gz -C "$HOME/.local/bin-x86_64" --strip-components=1
          # Assert via `file -b` (no path prefix) that the binary is
          # x86_64 — the previous attempt grepped `file <path>` and
          # got fooled by "x86_64" appearing in the install dir name.
          ARCH_LINE=$(file -b "$HOME/.local/bin-x86_64/uv")
          echo "uv arch: $ARCH_LINE"
          case "$ARCH_LINE" in
            *x86_64*) echo "uv is x86_64 — ok" ;;
            *)
              echo "expected x86_64 binary, got: $ARCH_LINE" >&2
              exit 1 ;;
          esac
          # Smoke-test under Rosetta — fails immediately if the
          # binary somehow still can't translate, sparing us a
          # confusing "Bad CPU type" later in the pipeline.
          arch -x86_64 "$HOME/.local/bin-x86_64/uv" --version
          echo "ROSETTA_UV=$HOME/.local/bin-x86_64/uv" >> $GITHUB_ENV

      - name: Install x86_64 Python via Rosetta uv
        run: |
          arch -x86_64 "$ROSETTA_UV" python install 3.11

      - name: Wipe arm64 venv before x86_64 sync
        # `uv sync` reuses .venv/ if present. The arm64 build above
        # populated it with arm64 wheels (pyobjc et al.); we need a
        # clean slate for the x86_64 install so the right wheels get
        # pulled.
        run: rm -rf .venv

      - name: Sync release deps (x86_64)
        run: |
          arch -x86_64 "$ROSETTA_UV" sync --group release --python 3.11

      - name: Clean previous build artefacts
        # PyInstaller and the staging dir from the arm64 run.
        run: rm -rf build dist

      - name: Package x86_64 tarball
        run: |
          arch -x86_64 "$ROSETTA_UV" run --python 3.11 \
            bash scripts/package_release.sh "${{ steps.ver.outputs.num_version }}"

      - name: Restore arm64 tarball alongside x86_64
        run: |
          mv stash/* dist/

      # ---- Upload both tarballs -----------------------------------
      - name: Upload tarballs to release
        uses: softprops/action-gh-release@v2
        if: github.event_name == 'push'
        with:
          tag_name: ${{ steps.ver.outputs.version }}
          files: |
            dist/diting-${{ steps.ver.outputs.num_version }}-darwin-arm64.tar.gz
            dist/diting-${{ steps.ver.outputs.num_version }}-darwin-arm64.tar.gz.sha256
            dist/diting-${{ steps.ver.outputs.num_version }}-darwin-x86_64.tar.gz
            dist/diting-${{ steps.ver.outputs.num_version }}-darwin-x86_64.tar.gz.sha256

      - name: Upload tarballs as workflow artifacts (dispatch dry-runs)
        if: github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v4
        with:
          name: diting-${{ steps.ver.outputs.num_version }}-darwin
          path: |
            dist/diting-${{ steps.ver.outputs.num_version }}-darwin-arm64.tar.gz
            dist/diting-${{ steps.ver.outputs.num_version }}-darwin-arm64.tar.gz.sha256
            dist/diting-${{ steps.ver.outputs.num_version }}-darwin-x86_64.tar.gz
            dist/diting-${{ steps.ver.outputs.num_version }}-darwin-x86_64.tar.gz.sha256
          retention-days: 14

  shasums:
    # Aggregate the per-arch .sha256 sidecars into a single
    # SHASUMS256.txt sibling asset on the release, which is what
    # install.sh fetches for verification.
    runs-on: ubuntu-latest
    needs: build
    if: github.event_name == 'push'
    steps:
      - uses: actions/checkout@v4

      - name: Resolve version
        id: ver
        run: |
          echo "version=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
          echo "num_version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Fetch per-arch tarballs from the release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mkdir -p tarballs
          gh release download "${{ steps.ver.outputs.version }}" \
            --repo "$GITHUB_REPOSITORY" \
            --pattern "diting-${{ steps.ver.outputs.num_version }}-darwin-*.tar.gz" \
            --dir tarballs

      - name: Compute SHASUMS256.txt
        run: |
          ( cd tarballs && sha256sum *.tar.gz ) > SHASUMS256.txt
          cat SHASUMS256.txt

      - name: Upload SHASUMS256.txt to release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.ver.outputs.version }}
          files: SHASUMS256.txt