release.yml

name: Create GitHub Release

# Independent of the npm and VS Code publishes. This builds the per-platform
# release binaries at the released commit, attaches them (one archive per
# platform + SHA256SUMS) to the GitHub Release, and writes the notes — but it
# does NOT publish to npm or the Marketplace. `publish-npm` later reuses these
# exact attached binaries, so npm ships the same bytes the Release does.
#
# Single-version policy: the Cargo workspace version (the single source — every
# crate inherits it via `version.workspace = true`, and npm/config.mjs reads it)
# and the VS Code extension must already equal the requested version (checked
# first, before the expensive build), so npm and the extension never diverge.
on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version without the leading v, e.g. 0.1.0'
        required: true
        type: string

permissions:
  contents: write

concurrency:
  group: create-release
  cancel-in-progress: false

jobs:
  check:
    name: Verify versions
    timeout-minutes: 10
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Verify all versions match the requested release
        env:
          VERSION: ${{ github.event.inputs.version }}
        run: |
          # The Cargo workspace version is the single source for every crate (they use
          # `version.workspace = true`) and for the npm CLI (npm/config.mjs reads it). Only
          # the VS Code extension keeps its own version; require both to equal VERSION.
          cargo_ver=$(grep -m1 '^version' Cargo.toml | sed -E 's/.*"([^"]+)".*/\1/')
          vsc_ver=$(node -p "require('./vscode-extension/package.json').version")
          fail=0
          for entry in "Cargo workspace=$cargo_ver" "vscode extension=$vsc_ver"; do
            name=${entry%%=*}; val=${entry#*=}
            if [[ "$val" != "$VERSION" ]]; then
              echo "::error::$name version is '$val' but the release is '$VERSION'."
              fail=1
            fi
          done
          if [[ $fail -ne 0 ]]; then
            echo "Bump every source to $VERSION before creating the release." >&2
            exit 1
          fi
          echo "All versions are $VERSION."

  build:
    # Build the per-platform release binaries at the commit being released.
    needs: check
    uses: ./.github/workflows/_build-matrix.yml
    with:
      ref: ${{ github.sha }}

  release:
    name: Package + publish release
    needs: [check, build]
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Extract changelog section
        env:
          VERSION: ${{ github.event.inputs.version }}
        run: |
          # Slice the "## [VERSION]" block out of CHANGELOG.md for the notes.
          awk -v ver="$VERSION" '
            index($0, "## [" ver "]") == 1 { grab = 1; next }
            grab && /^## \[/ { exit }
            grab { print }
          ' CHANGELOG.md > RELEASE_NOTES.md
          if [[ ! -s RELEASE_NOTES.md ]]; then
            echo "::error::No '## [$VERSION]' section found in CHANGELOG.md." >&2
            exit 1
          fi
          echo "Release notes:"; cat RELEASE_NOTES.md

      - name: Download platform binaries
        uses: actions/download-artifact@v4
        with:
          pattern: bin-*
          path: staging

      - name: Package per-platform archives + checksums
        env:
          VERSION: ${{ github.event.inputs.version }}
        run: |
          # One archive per platform, driven by config.mjs (the single source of
          # the platform list), named to match what publish-npm downloads:
          # coregraph-<version>-<os>-<cpu>.{tar.gz,zip}, each holding the binary.
          mkdir -p assets
          assets="$(pwd)/assets"
          node -e 'import("./npm/config.mjs").then(m=>{for(const p of m.PLATFORMS)console.log(p.os+" "+p.cpu+" "+p.binary)})' > /tmp/platforms.txt
          while read -r os cpu bin; do
            dir="staging/bin-${os}-${cpu}"
            if [[ ! -f "${dir}/${bin}" ]]; then
              echo "::error::missing binary ${dir}/${bin}" >&2; exit 1
            fi
            chmod +x "${dir}/${bin}" || true
            if [[ "$os" == "win32" ]]; then
              (cd "$dir" && zip -q -j "${assets}/coregraph-${VERSION}-${os}-${cpu}.zip" "$bin")
            else
              tar -czf "${assets}/coregraph-${VERSION}-${os}-${cpu}.tar.gz" -C "$dir" "$bin"
            fi
          done < /tmp/platforms.txt
          (cd assets && sha256sum -- * > SHA256SUMS)
          echo "Release assets:"; ls -la assets

      - name: Create the GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ github.event.inputs.version }}
        run: |
          tag="v${VERSION}"
          if gh release view "$tag" >/dev/null 2>&1; then
            echo "::error::Release $tag already exists." >&2
            exit 1
          fi
          gh release create "$tag" \
            --title "$tag" \
            --notes-file RELEASE_NOTES.md \
            --target "${GITHUB_SHA}" \
            ./assets/*