release-binaries.yml

name: Release Client Binaries

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version without v prefix (e.g. 1.20.5)'
        required: true
        type: string
      release_tag:
        description: 'GitHub release tag (e.g. v1.20.5)'
        required: true
        type: string
      target_repo:
        description: 'GitHub repo to attach binaries to'
        required: false
        default: terraphim-ai
        type: string

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always

jobs:
  build-binaries:
    name: Build client binaries for ${{ matrix.target }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # GitHub-hosted Linux: terraphim-ai self-hosted runners are repo-scoped.
          - os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            use_cross: false
          - os: ubuntu-22.04
            target: x86_64-unknown-linux-musl
            use_cross: true
          - os: ubuntu-22.04
            target: aarch64-unknown-linux-musl
            use_cross: true
          - os: macos-latest
            target: x86_64-apple-darwin
            use_cross: false
          - os: macos-latest
            target: aarch64-apple-darwin
            use_cross: false
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            use_cross: false
    runs-on: ${{ matrix.os }}
    env:
      CARGO_REGISTRIES_TERRAPHIM_TOKEN: ${{ secrets.CARGO_REGISTRIES_TERRAPHIM_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - name: Install zig
        if: contains(matrix.target, 'apple-darwin') || contains(matrix.target, 'windows')
        shell: bash
        run: |
          if command -v zig &>/dev/null; then exit 0; fi
          if command -v brew &>/dev/null; then brew install zig; fi
          if command -v choco &>/dev/null; then choco install zig -y; fi
      - name: Install cross
        if: matrix.use_cross
        run: |
          if command -v cross &>/dev/null; then
            cross --version
            exit 0
          fi
          rustup run stable cargo install cross --locked --git https://github.com/cross-rs/cross
      - uses: Swatinem/rust-cache@v2
        if: matrix.target != 'x86_64-unknown-linux-gnu'
        with:
          key: clients-${{ matrix.target }}
      - name: Build client binaries
        shell: bash
        run: |
          if [ "${{ matrix.use_cross }}" = "true" ]; then
            BUILD="rustup run stable cross"
          else
            BUILD="rustup run stable cargo"
          fi
          $BUILD build --release --target ${{ matrix.target }} -p terraphim_agent --bin terraphim-agent
          $BUILD build --release --target ${{ matrix.target }} -p terraphim-cli --bin terraphim-cli
          $BUILD build --release --target ${{ matrix.target }} -p terraphim_grep --bin terraphim-grep --features "code-search openrouter"
      - name: Package artifacts (Unix)
        if: matrix.os != 'windows-latest'
        env:
          VERSION: ${{ inputs.version }}
        run: |
          mkdir -p artifacts
          tar -czf "artifacts/terraphim-agent-${VERSION}-${{ matrix.target }}.tar.gz" -C "target/${{ matrix.target }}/release" terraphim-agent
          tar -czf "artifacts/terraphim-cli-${VERSION}-${{ matrix.target }}.tar.gz" -C "target/${{ matrix.target }}/release" terraphim-cli
          tar -czf "artifacts/terraphim-grep-${VERSION}-${{ matrix.target }}.tar.gz" -C "target/${{ matrix.target }}/release" terraphim-grep
          cp target/${{ matrix.target }}/release/terraphim-agent artifacts/terraphim-agent-${{ matrix.target }}
          cp target/${{ matrix.target }}/release/terraphim-cli artifacts/terraphim-cli-${{ matrix.target }}
          cp target/${{ matrix.target }}/release/terraphim-grep artifacts/terraphim-grep-${{ matrix.target }}
          chmod +x artifacts/*
      - name: Package artifacts (Windows)
        if: matrix.os == 'windows-latest'
        shell: bash
        env:
          VERSION: ${{ inputs.version }}
        run: |
          mkdir -p artifacts
          cd "target/${{ matrix.target }}/release"
          7z a -tzip "../../../artifacts/terraphim-agent-${VERSION}-${{ matrix.target }}.zip" terraphim-agent.exe
          7z a -tzip "../../../artifacts/terraphim-cli-${VERSION}-${{ matrix.target }}.zip" terraphim-cli.exe
          7z a -tzip "../../../artifacts/terraphim-grep-${VERSION}-${{ matrix.target }}.zip" terraphim-grep.exe
          cd -
          cp target/${{ matrix.target }}/release/terraphim-agent.exe artifacts/terraphim-agent-${{ matrix.target }}.exe
          cp target/${{ matrix.target }}/release/terraphim-cli.exe artifacts/terraphim-cli-${{ matrix.target }}.exe
          cp target/${{ matrix.target }}/release/terraphim-grep.exe artifacts/terraphim-grep-${{ matrix.target }}.exe
      - uses: actions/upload-artifact@v4
        with:
          name: client-binaries-${{ matrix.target }}
          path: artifacts/*

  create-universal-macos:
    name: Create macOS universal client binaries
    needs: build-binaries
    if: always() && needs.build-binaries.result != 'cancelled'
    runs-on: macos-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: client-binaries-x86_64-apple-darwin
          path: x86_64
      - uses: actions/download-artifact@v4
        with:
          name: client-binaries-aarch64-apple-darwin
          path: aarch64
      - run: |
          mkdir -p universal
          lipo -create x86_64/terraphim-agent-x86_64-apple-darwin aarch64/terraphim-agent-aarch64-apple-darwin -output universal/terraphim-agent-universal-apple-darwin
          lipo -create x86_64/terraphim-grep-x86_64-apple-darwin aarch64/terraphim-grep-aarch64-apple-darwin -output universal/terraphim-grep-universal-apple-darwin
          chmod +x universal/*
      - uses: actions/upload-artifact@v4
        with:
          name: client-binaries-universal-apple-darwin
          path: universal/*

  sign-and-notarize-macos:
    name: Sign and notarize macOS client binaries
    needs: create-universal-macos
    if: always() && needs.create-universal-macos.result == 'success'
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: client-binaries-universal-apple-darwin
          path: universal
      - uses: 1password/install-cli-action@v2
      - name: Load signing credentials
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
        run: |
          echo "APPLE_ID=$(op read 'op://TerraphimPlatform/apple.developer.credentials/username' --no-newline)" >> $GITHUB_ENV
          echo "APPLE_TEAM_ID=$(op read 'op://TerraphimPlatform/apple.developer.credentials/APPLE_TEAM_ID' --no-newline)" >> $GITHUB_ENV
          echo "APPLE_APP_PASSWORD=$(op read 'op://TerraphimPlatform/apple.developer.credentials/APPLE_APP_SPECIFIC_PASSWORD' --no-newline)" >> $GITHUB_ENV
          echo "CERT_BASE64=$(op read 'op://TerraphimPlatform/apple.developer.certificate/base64' --no-newline)" >> $GITHUB_ENV
          echo "CERT_PASSWORD=$(op read 'op://TerraphimPlatform/apple.developer.certificate/password' --no-newline)" >> $GITHUB_ENV
      - name: Sign and notarize agent and grep
        env:
          RUNNER_TEMP: ${{ runner.temp }}
        run: |
          chmod +x scripts/sign-macos-binary.sh
          ./scripts/sign-macos-binary.sh universal/terraphim-agent-universal-apple-darwin "$APPLE_ID" "$APPLE_TEAM_ID" "$APPLE_APP_PASSWORD" "$CERT_BASE64" "$CERT_PASSWORD"
          ./scripts/sign-macos-binary.sh universal/terraphim-grep-universal-apple-darwin "$APPLE_ID" "$APPLE_TEAM_ID" "$APPLE_APP_PASSWORD" "$CERT_BASE64" "$CERT_PASSWORD"
      - uses: actions/upload-artifact@v4
        with:
          name: client-binaries-signed-universal-apple-darwin
          path: universal/*

  upload-to-target-release:
    name: Attach client binaries to terraphim-ai release
    needs: [build-binaries, sign-and-notarize-macos]
    # Attach when macOS sign succeeded; do not require full matrix (Windows is optional).
    if: >-
      always() &&
      !cancelled() &&
      needs.sign-and-notarize-macos.result == 'success' &&
      needs.build-binaries.result != 'cancelled'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: client-binaries*
          path: release-assets
          merge-multiple: true
      - name: Upload to target GitHub release
        env:
          GH_TOKEN: ${{ secrets.TERRAPHIM_AI_RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
        run: |
          TAG="${{ inputs.release_tag }}"
          REPO="terraphim/${{ inputs.target_repo }}"
          find release-assets -type f | sort
          gh release upload "$TAG" release-assets/* --repo "$REPO" --clobber