release.yml

# SPDX-FileCopyrightText: 2025 Adam Poulemanos <89049923+bashandbone@users.noreply.github.com>
#
# SPDX-License-Identifier: LicenseRef-PlainMIT OR MIT

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always

jobs:
  create-release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
      - uses: taiki-e/create-gh-release-action@v1
        if: github.event_name != 'workflow_dispatch'
        with:
          changelog: CHANGELOG.md
          token: ${{ secrets.GITHUB_TOKEN }}
          draft: true

  build:
    runs-on: ${{ matrix.os }}
    needs: [create-release]
    permissions:
      contents: write
    env:
      # Force curl-sys to build libcurl from source instead of probing pkg-config
      # for whatever the build image happens to expose. A release binary that
      # dynamically links the builder's libcurl is not portable, and on musl a
      # glibc-linked one would not work at all.
      #
      # Set unconditionally rather than per-target: this variable is presence-
      # checked, so a `${{ ... && '1' || '' }}` expression would still read as set
      # on every target. It only affects Linux anyway — curl-sys returns early
      # with the system libcurl on Apple targets and uses vcpkg on Windows.
      LIBCURL_NO_PKG_CONFIG: "1"
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            os: macos-latest
            build-tool: cargo
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            build-tool: cross
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            build-tool: cross
          # musl targets link every native dependency statically — OpenSSL (shared
          # by curl and libgit2 since submod dropped rustls), libgit2 and libssh2
          # come from the vendored features below, and musl itself replaces the
          # glibc the -gnu targets link dynamically. The result runs on any Linux.
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            build-tool: cross
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
            build-tool: cross
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            build-tool: cargo
          - target: aarch64-pc-windows-msvc
            os: windows-latest
            build-tool: cargo
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          fetch-tags: true
          lfs: false
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: rust-${{ matrix.target }}
      - uses: taiki-e/upload-rust-binary-action@v1
        with:
          bin: submod
          checksum: sha256
          target: ${{ matrix.target }}
          build-tool: ${{ matrix.build-tool }}
          token: ${{ secrets.GITHUB_TOKEN }}
          features: git2/vendored-libgit2,git2/vendored-openssl
          dry-run: ${{ github.event_name == 'workflow_dispatch' }}

      # A dry run builds the archive and then throws it away, which left the whole
      # point of the musl targets — that the binary is actually static — argued
      # from build-script logic rather than measured. These two steps only run on
      # workflow_dispatch, so a real tag release is unaffected.
      - name: Verify Linux binary linkage
        if: github.event_name == 'workflow_dispatch' && contains(matrix.target, 'linux')
        env:
          TARGET: ${{ matrix.target }}
        run: |
          set -euo pipefail
          mkdir -p /tmp/linkcheck
          tar xzf "submod-${TARGET}.tar.gz" -C /tmp/linkcheck
          desc=$(file /tmp/linkcheck/submod)
          echo "$desc"
          case "$TARGET" in
            *musl*)
              # Rust links musl targets as static-pie by default, which `file`
              # reports as "static-pie linked" rather than "statically linked".
              # Accept either; reject anything dynamically linked.
              case "$desc" in
                *"statically linked"*|*"static-pie linked"*)
                  echo "OK: ${TARGET} is statically linked" ;;
                *)
                  echo "::error::${TARGET} is not statically linked: ${desc}"
                  exit 1 ;;
              esac
              ;;
            *)
              echo "note: ${TARGET} is a glibc target; dynamic linking is expected" ;;
          esac

      - name: Upload dry-run archive for inspection
        if: github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v7
        with:
          name: dry-run-${{ matrix.target }}
          path: submod-${{ matrix.target }}.*
          retention-days: 7
          if-no-files-found: error

  publish:
    name: Publish to crates.io
    needs: [build]
    # workflow_dispatch is the dry run: `build` already honors it via its
    # dry-run input, but this job and `github_release` did not, so a manual
    # dispatch still ran `cargo publish` against crates.io and cut a real
    # GitHub release. Only a v* tag push publishes anything.
    if: github.event_name != 'workflow_dispatch'
    runs-on: ubuntu-latest
    environment: cratesio
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive
      - uses: dtolnay/rust-toolchain@stable
      - uses: rust-lang/crates-io-auth-action@v1
        id: auth
      - run: cargo publish --allow-dirty
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

  github_release:
    name: Publish GitHub Release
    needs: [build, publish]
    if: github.event_name != 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
      - name: Publish Release
        uses: softprops/action-gh-release@v3
        with:
          body_path: CHANGELOG.md
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}