release.yml

# SPDX-License-Identifier: MPL-2.0
#
# Release (ADR-019 / #260 S2). On a `v*` tag: build the AffineScript
# compiler for each supported platform, attach the raw per-platform
# binaries plus a single `SHA256SUMS` manifest to the GitHub Release.
# Releases are the CANONICAL distribution artifact; the thin Deno/JSR
# shim `@hyperpolymath/affinescript` (#260 S3) downloads + checksum-
# verifies the binary named for its host triple against SHA256SUMS.
#
# Asset contract (ADR-019; do not rename without amending the ADR + the
# shim): `affinescript-<target>` raw executables + `SHA256SUMS`
# (sha256sum format: "<hex>  affinescript-<target>"). Targets:
#   linux-x64, macos-x64, macos-arm64.  windows-x64 is a tracked
#   follow-up (native OCaml Windows CI is flaky; #260 S2 is bounded to
#   the three POSIX targets).
#
# Asset handling uses the runner-native `gh` CLI (GITHUB_TOKEN), so no
# third-party action needs SHA-pinning beyond checkout + setup-ocaml.

name: Release
on:
  push:
    tags:
      - 'v*'
permissions:
  contents: write
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  prepare:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Create the release as a draft (idempotent)
        # Immutable releases (enabled on this repo) forbid adding assets to a
        # *published* release — the v0.2.0 build legs hit "HTTP 422: Cannot
        # upload assets to an immutable release", so it shipped source-only.
        # Fix: create the release as a DRAFT (still mutable); the build legs
        # upload binaries into the draft and the checksums job publishes it
        # last, sealing it atomically with all assets attached.
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag="${GITHUB_REF_NAME}"
          if gh release view "$tag" >/dev/null 2>&1; then
            echo "release $tag already exists; reusing"
          else
            gh release create "$tag" --draft --generate-notes --verify-tag --title "$tag"
          fi
  build:
    needs: prepare
    permissions:
      contents: write
      id-token: write
      attestations: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: linux-x64
          - os: macos-15-intel
            target: macos-x64
          - os: macos-14
            target: macos-arm64
    runs-on: ${{ matrix.os }}
    timeout-minutes: 10
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up OCaml
        uses: ocaml/setup-ocaml@15d660006c1d3110d77c34b7faa3bddefe8b82f0 # v3
        with:
          ocaml-compiler: "5.1"
      - name: Install dependencies
        run: opam install . --deps-only --yes
      - name: Bake release version into source (#297)
        # Single source of truth for the compiler version string lives
        # in `lib/version.ml`; `dune-project` mirrors it for opam.  The
        # release workflow rewrites both from the tag so every emitted
        # binary self-reports the right number (--version, REPL banner,
        # LSP serverInfo, ONNX producer_version).
        run: |
          v="${GITHUB_REF_NAME#v}"
          # Use `sed -i.bak` (backup-suffix attached): both GNU sed (Linux) and
          # BSD sed (macOS) accept it. Bare `sed -i "s/..."` makes BSD sed treat
          # the script as the backup suffix and the filename as a command, dying
          # with "extra characters at the end of l command" — which is exactly
          # why the v0.2.0 macOS legs failed before building anything.
          sed -i.bak "s/^let value = .*/let value = \"$v\"/" lib/version.ml
          sed -i.bak "s/^(version .*)/(version $v)/" .build/dune-project
          rm -f lib/version.ml.bak .build/dune-project.bak
          echo "Baked version: $v"
          grep '^let value' lib/version.ml
          grep '^(version' .build/dune-project
      - name: Build release
        run: opam exec -- dune build --release
      - name: Stage the binary
        run: |
          install -m 0755 _build/default/bin/main.exe \
            "affinescript-${{ matrix.target }}"
      - name: Attest build provenance
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
        with:
          subject-path: 'affinescript-${{ matrix.target }}'
      - name: Upload the binary to the release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release upload "${GITHUB_REF_NAME}" \
            "affinescript-${{ matrix.target }}" --clobber
  checksums:
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Collect binaries and publish SHA256SUMS
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag="${GITHUB_REF_NAME}"
          mkdir -p dl
          gh release download "$tag" --repo "$GITHUB_REPOSITORY" --dir dl --pattern 'affinescript-*'
          ( cd dl && sha256sum affinescript-* | sort -k2 > SHA256SUMS )
          cat dl/SHA256SUMS
          gh release upload "$tag" --repo "$GITHUB_REPOSITORY" dl/SHA256SUMS --clobber
          # Seal the release last. Under immutable releases assets can only be
          # added while the release is a draft, so publish only once all four
          # assets (three binaries + SHA256SUMS) are attached.
          gh release edit "$tag" --repo "$GITHUB_REPOSITORY" --draft=false --latest