release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # ─── Job 1: Changesets — npm publish + create release PR ────────────────────
  release-npm:
    name: Publish to npm (Changesets)
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    outputs:
      published: ${{ steps.changesets.outputs.published }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: 'pnpm'
          registry-url: 'https://registry.npmjs.org'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build packages
        run: pnpm --filter './packages/**' build

      - name: Guard against publishing an older version as latest
        run: |
          set -euo pipefail
          for dir in packages/*/; do
            pkg_json="${dir}package.json"
            [ -f "$pkg_json" ] || continue
            is_private=$(node -p "require('./$pkg_json').private === true")
            [ "$is_private" = "true" ] && continue
            name=$(node -p "require('./$pkg_json').name")
            local_version=$(node -p "require('./$pkg_json').version")
            published_latest=$(npm view "$name" dist-tags.latest 2>/dev/null || echo "")
            if [ -n "$published_latest" ]; then
              if ! npx --yes semver "$local_version" -r ">$published_latest" >/dev/null 2>&1; then
                echo "::error::$name: local version $local_version is not greater than published latest ($published_latest). Refusing to publish — this would move npm's 'latest' tag backwards."
                exit 1
              fi
            fi
          done

      - name: Create release PR or publish to npm
        id: changesets
        uses: changesets/action@v1
        with:
          publish: pnpm release
          createGithubReleases: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Output published status
        run: echo "published=${{ steps.changesets.outputs.published }}"

  # ─── Job 2: Build native binaries via Bun ───────────────────────────────────
  build-binaries:
    name: Build Binaries (${{ matrix.target }})
    needs: release-npm
    if: needs.release-npm.outputs.published == 'true'
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            runner: macos-latest
            bun_target: bun-darwin-arm64
            artifact: agentplugins-darwin-arm64
          - target: x86_64-apple-darwin
            runner: macos-latest
            bun_target: bun-darwin-x64
            artifact: agentplugins-darwin-x64
          - target: x86_64-unknown-linux-gnu
            runner: ubuntu-latest
            bun_target: bun-linux-x64
            artifact: agentplugins-linux-x64
          - target: aarch64-unknown-linux-gnu
            runner: ubuntu-latest
            bun_target: bun-linux-arm64
            artifact: agentplugins-linux-arm64
          - target: x86_64-pc-windows-msvc
            runner: ubuntu-latest
            bun_target: bun-windows-x64
            artifact: agentplugins-windows-x64.exe

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: 'pnpm'

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build all packages (topological)
        run: pnpm --filter './packages/**' build

      - name: Compile native binary
        run: |
          bun build packages/cli/dist/cli.js \
            --compile \
            --target=${{ matrix.bun_target }} \
            --outfile=agentplugins-${{ matrix.target }}

      - name: Create archive
        run: |
          if [[ "${{ matrix.target }}" == *"windows"* ]]; then
            zip agentplugins-${{ matrix.target }}.zip agentplugins-${{ matrix.target }}.exe
          else
            tar -czf agentplugins-${{ matrix.target }}.tar.gz agentplugins-${{ matrix.target }}
          fi

      - name: Generate checksum
        run: |
          if [[ "${{ matrix.target }}" == *"windows"* ]]; then
            BIN="agentplugins-${{ matrix.target }}.exe"
          else
            BIN="agentplugins-${{ matrix.target }}"
          fi
          if command -v shasum &>/dev/null; then
            shasum -a 256 "$BIN" | awk '{print $1}' > agentplugins-${{ matrix.target }}.sha256
          else
            sha256sum "$BIN" | awk '{print $1}' > agentplugins-${{ matrix.target }}.sha256
          fi

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: binary-${{ matrix.target }}
          path: |
            agentplugins-${{ matrix.target }}.tar.gz
            agentplugins-${{ matrix.target }}.zip
            agentplugins-${{ matrix.target }}.sha256
          retention-days: 5

  # ─── Job 3: Create GitHub Release with all binaries ─────────────────────────
  github-release:
    name: Create GitHub Release
    needs: [release-npm, build-binaries]
    if: always() && needs.release-npm.outputs.published == 'true' && needs.build-binaries.result != 'cancelled'
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      tag: ${{ steps.version.outputs.tag }}
    permissions:
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get version
        id: version
        run: |
          VERSION=$(node -p "require('./packages/cli/package.json').version")
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"

      - name: Download all binary artifacts
        uses: actions/download-artifact@v4
        with:
          path: release-assets
          pattern: binary-*
          merge-multiple: true

      - name: Generate combined checksums
        working-directory: release-assets
        run: |
          # Collect all .sha256 files into one checksums file
          cat agentplugins-*.sha256 | sort > checksums-sha256.txt
          rm -f agentplugins-*.sha256
          ls -la

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.version.outputs.tag }}
          name: ${{ steps.version.outputs.tag }}
          generate_release_notes: true
          files: |
            release-assets/*
          draft: false
          prerelease: ${{ contains(steps.version.outputs.version, '-') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # ─── Job 4: Update Homebrew tap ─────────────────────────────────────────────
  update-homebrew-tap:
    name: Update Homebrew Tap
    needs: [release-npm, github-release]
    if: always() && needs.release-npm.outputs.published == 'true' && needs.github-release.result == 'success'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout tap repository
        uses: actions/checkout@v4
        with:
          repository: sigilco/homebrew-tap-agentplugins
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: homebrew-tap-agentplugins

      - name: Download release assets
        uses: actions/download-artifact@v4
        with:
          path: release-assets
          pattern: binary-*
          merge-multiple: true

      - name: Compute tarball SHA256s
        id: shas
        working-directory: release-assets
        run: |
          echo "darwin-arm64=$(sha256sum agentplugins-aarch64-apple-darwin.tar.gz | awk '{print $1}')" >> "$GITHUB_OUTPUT"
          echo "darwin-x64=$(sha256sum agentplugins-x86_64-apple-darwin.tar.gz | awk '{print $1}')" >> "$GITHUB_OUTPUT"
          echo "linux-arm64=$(sha256sum agentplugins-aarch64-unknown-linux-gnu.tar.gz | awk '{print $1}')" >> "$GITHUB_OUTPUT"
          echo "linux-x64=$(sha256sum agentplugins-x86_64-unknown-linux-gnu.tar.gz | awk '{print $1}')" >> "$GITHUB_OUTPUT"

      - name: Update formula
        env:
          VERSION: ${{ needs.github-release.outputs.version }}
          TAG: ${{ needs.github-release.outputs.tag }}
          SHA256_DARWIN_ARM64: ${{ steps.shas.outputs.darwin-arm64 }}
          SHA256_DARWIN_X64: ${{ steps.shas.outputs.darwin-x64 }}
          SHA256_LINUX_ARM64: ${{ steps.shas.outputs.linux-arm64 }}
          SHA256_LINUX_X64: ${{ steps.shas.outputs.linux-x64 }}
        run: |
          mkdir -p homebrew-tap-agentplugins/Formula
          cat > homebrew-tap-agentplugins/Formula/agentplugins.rb <<EOF
          class Agentplugins < Formula
            desc "Write AI agent plugins once, ship to any harness"
            homepage "https://github.com/sigilco/agentplugins"
            version "\${VERSION}"

            on_macos do
              on_arm do
                url "https://github.com/sigilco/agentplugins/releases/download/\${TAG}/agentplugins-aarch64-apple-darwin.tar.gz"
                sha256 "\${SHA256_DARWIN_ARM64}"
              end
              on_intel do
                url "https://github.com/sigilco/agentplugins/releases/download/\${TAG}/agentplugins-x86_64-apple-darwin.tar.gz"
                sha256 "\${SHA256_DARWIN_X64}"
              end
            end

            on_linux do
              on_arm do
                url "https://github.com/sigilco/agentplugins/releases/download/\${TAG}/agentplugins-aarch64-unknown-linux-gnu.tar.gz"
                sha256 "\${SHA256_LINUX_ARM64}"
              end
              on_intel do
                url "https://github.com/sigilco/agentplugins/releases/download/\${TAG}/agentplugins-x86_64-unknown-linux-gnu.tar.gz"
                sha256 "\${SHA256_LINUX_X64}"
              end
            end

            def install
              bin.install "agentplugins-aarch64-apple-darwin" => "agentplugins" if Hardware::CPU.arm? && OS.mac?
              bin.install "agentplugins-x86_64-apple-darwin" => "agentplugins" if Hardware::CPU.intel? && OS.mac?
              bin.install "agentplugins-aarch64-unknown-linux-gnu" => "agentplugins" if Hardware::CPU.arm? && OS.linux?
              bin.install "agentplugins-x86_64-unknown-linux-gnu" => "agentplugins" if Hardware::CPU.intel? && OS.linux?
            end

            test do
              assert_match "\${VERSION}", shell_output("#{bin}/agentplugins --version")
              assert_match "Usage", shell_output("#{bin}/agentplugins --help")
            end
          end
          EOF

      - name: Commit and push formula
        working-directory: homebrew-tap-agentplugins
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Formula/agentplugins.rb
          git diff --cached --quiet || git commit -m "chore: bump agentplugins to \${{ needs.github-release.outputs.tag }}"
          git push