ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  verify:
    if: github.event_name != 'push' || !contains(github.event.head_commit.message, '[skip ci]')
    name: Verify CLI
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read

    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Vite+
        uses: ./.github/actions/setup-vp
        with:
          node-version-file: ".node-version"
          cache: true

      - name: Install dependencies
        run: vp install

      - name: Verify repository
        run: vp run verify

      - name: Smoke test packed install surface
        run: vp run smoke:pack

  release:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && !contains(github.event.head_commit.message, '[skip ci]')
    name: Release CLI
    needs:
      - verify
    runs-on: ubuntu-latest
    timeout-minutes: 20
    environment:
      name: release
      deployment: false
    permissions:
      contents: read
      id-token: write
    outputs:
      new_release_published: ${{ steps.semantic.outputs.new_release_published }}
      new_release_git_tag: ${{ steps.semantic.outputs.new_release_git_tag }}
      new_release_version: ${{ steps.semantic.outputs.new_release_version }}

    steps:
      - name: Create release bot token
        id: release-bot
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.PUTIO_RELEASE_BOT_CLIENT_ID }}
          private-key: ${{ secrets.PUTIO_RELEASE_BOT_PRIVATE_KEY }}
          permission-contents: write
          permission-issues: write
          permission-pull-requests: write
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Vite+
        uses: ./.github/actions/setup-vp
        with:
          node-version-file: ".node-version"
          cache: false

      - name: Install dependencies
        run: vp install

      - name: Build package
        run: vp run build

      - name: Configure release bot remote
        run: git remote set-url origin "https://x-access-token:${RELEASE_BOT_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
        env:
          RELEASE_BOT_TOKEN: ${{ steps.release-bot.outputs.token }}

      - name: Release package
        id: semantic
        uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
        with:
          extra_plugins: |
            @semantic-release/commit-analyzer@13.0.1
            @semantic-release/release-notes-generator@14.1.1
            @semantic-release/npm@13.1.5
            @semantic-release/github@12.0.8
            @semantic-release/git@10.0.1
            conventional-changelog-conventionalcommits@9.3.1
        env:
          GITHUB_TOKEN: ${{ steps.release-bot.outputs.token }}
          GIT_AUTHOR_NAME: ${{ steps.release-bot.outputs.app-slug }}[bot]
          GIT_AUTHOR_EMAIL: ${{ steps.release-bot.outputs.app-slug }}[bot]@users.noreply.github.com
          GIT_COMMITTER_NAME: ${{ steps.release-bot.outputs.app-slug }}[bot]
          GIT_COMMITTER_EMAIL: ${{ steps.release-bot.outputs.app-slug }}[bot]@users.noreply.github.com

  build-unix-binaries:
    if: needs.release.outputs.new_release_published == 'true'
    name: Build ${{ matrix.os }} release assets
    needs:
      - release
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    environment:
      name: release
      deployment: false
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            asset_os: linux
            asset_arch: amd64
          - os: macos-latest
            asset_os: darwin
            asset_arch: arm64

    steps:
      - name: Create release bot token
        id: release-bot
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.PUTIO_RELEASE_BOT_CLIENT_ID }}
          private-key: ${{ secrets.PUTIO_RELEASE_BOT_PRIVATE_KEY }}
          permission-contents: write
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0
          ref: ${{ needs.release.outputs.new_release_git_tag }}
          persist-credentials: false

      - name: Set up Vite+
        uses: ./.github/actions/setup-vp
        with:
          node-version-file: ".node-version"
          cache: false

      - name: Install dependencies
        run: vp install

      - name: Build SEA binary
        run: vp run build:sea

      - name: Verify SEA binary
        run: vp run verify:sea

      - name: Package release assets
        shell: pwsh
        run: |
          $version = "${{ needs.release.outputs.new_release_version }}"
          $assetBase = "putio-cli-$version-${{ matrix.asset_os }}-${{ matrix.asset_arch }}"
          $releaseDir = ".artifacts/release"
          New-Item -ItemType Directory -Force -Path $releaseDir | Out-Null
          $binaryPath = ".artifacts/sea/putio"
          $stageDir = "$releaseDir/stage"
          New-Item -ItemType Directory -Force -Path $stageDir | Out-Null
          Copy-Item $binaryPath "$stageDir/putio"
          tar -czf "$releaseDir/$assetBase.tar.gz" -C $stageDir putio
          Remove-Item -Recurse -Force $stageDir
          $assetPath = "$releaseDir/$assetBase.tar.gz"

          $hash = (Get-FileHash -Algorithm SHA256 $assetPath).Hash.ToLower()
          "$hash  $(Split-Path $assetPath -Leaf)" | Out-File "$assetPath.sha256" -Encoding ascii -NoNewline

      - name: Generate SHA-256 checksums
        shell: pwsh
        run: Get-ChildItem .artifacts/release

      - name: Upload binary assets to the GitHub release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
        with:
          token: ${{ steps.release-bot.outputs.token }}
          tag_name: ${{ needs.release.outputs.new_release_git_tag }}
          files: |
            .artifacts/release/*

  build-windows-binary:
    if: needs.release.outputs.new_release_published == 'true'
    name: Build windows-latest release assets
    needs:
      - release
    runs-on: windows-latest
    timeout-minutes: 30
    environment:
      name: release
      deployment: false
    permissions:
      contents: read

    steps:
      - name: Create release bot token
        id: release-bot
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.PUTIO_RELEASE_BOT_CLIENT_ID }}
          private-key: ${{ secrets.PUTIO_RELEASE_BOT_PRIVATE_KEY }}
          permission-contents: write
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0
          ref: ${{ needs.release.outputs.new_release_git_tag }}
          persist-credentials: false

      - name: Set up Vite+
        uses: ./.github/actions/setup-vp
        with:
          node-version-file: ".node-version"
          cache: false

      - name: Install dependencies
        run: vp install

      - name: Build SEA binary
        run: vp run build:sea

      - name: Verify SEA binary
        run: vp run verify:sea

      - name: Package release assets
        shell: pwsh
        run: |
          $version = "${{ needs.release.outputs.new_release_version }}"
          $assetBase = "putio-cli-$version-windows-amd64"
          $releaseDir = ".artifacts/release"
          New-Item -ItemType Directory -Force -Path $releaseDir | Out-Null
          $binaryPath = ".artifacts/sea/putio.exe"
          Compress-Archive -Path $binaryPath -DestinationPath "$releaseDir/$assetBase.zip" -Force
          $assetPath = "$releaseDir/$assetBase.zip"
          $hash = (Get-FileHash -Algorithm SHA256 $assetPath).Hash.ToLower()
          "$hash  $(Split-Path $assetPath -Leaf)" | Out-File "$assetPath.sha256" -Encoding ascii -NoNewline

      - name: Generate SHA-256 checksums
        shell: pwsh
        run: Get-ChildItem .artifacts/release

      - name: Upload binary assets to the GitHub release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
        with:
          token: ${{ steps.release-bot.outputs.token }}
          tag_name: ${{ needs.release.outputs.new_release_git_tag }}
          files: |
            .artifacts/release/*

  update-homebrew-tap:
    if: needs.release.outputs.new_release_published == 'true'
    name: Update Homebrew tap
    needs:
      - release
      - build-unix-binaries
    runs-on: ubuntu-latest
    timeout-minutes: 20
    environment:
      name: release
      deployment: false
    permissions:
      contents: read

    steps:
      - name: Release to Homebrew tap
        uses: Justintime50/homebrew-releaser@a62d7a359683bfc047cdb2431f53ee58241464d1 # v3
        with:
          homebrew_owner: putdotio
          homebrew_tap: homebrew-tap
          github_token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          commit_owner: devsputio
          commit_email: devs@put.io
          branch: main
          formula_folder: Formula
          install: 'bin.install "putio"'
          test: |
            output = shell_output("#{bin}/putio version")
            assert_match "putio", output
            assert_match version.to_s, output
          target_darwin_arm64: true
          target_linux_amd64: true
          skip_checksum: true