release.yml

name: Release

# Release pipeline on GitHub-hosted runners. On every `v*` tag push we:
#
#   1. build-amd64 / build-arm64 (parallel) — compile on native GitHub-hosted runners
#      (ubuntu-latest + ubuntu-24.04-arm). Each job uploads its per-arch staging
#      tree as a workflow artifact. arm64 is not emulated under QEMU.
#   2. publish-image / publish-proxy-image (parallel after build) — assemble the
#      multi-arch Docker images from those prebuilt binaries (Dockerfile.runtime
#      and Dockerfile.proxy-runtime do no compilation), push both to GHCR.
#   3. publish-release — package tarballs, standalone CLI binaries, and create the
#      GitHub Release.
#
# Compilation caches use GitHub Actions cache (sccache + Swatinem/rust-cache) instead
# of the self-hosted runner hostPath used by CI.

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: write   # GitHub Release upload
  packages: write   # GHCR image push

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  RUSTFLAGS: "-D warnings"
  RUSTC_WRAPPER: sccache
  SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
  SCCACHE_CACHE_SIZE: 10G
  CHDB_RUST_REPO: https://github.com/hyperbyte-cloud/chdb-rust.git
  CHDB_RUST_REF: feat_arrow_insert
  REGISTRY: ghcr.io
  IMAGE_NAME: hyperbyte-cloud/hyperbytedb
  PROXY_IMAGE_NAME: hyperbyte-cloud/hyperbytedb-proxy

jobs:
  build-amd64:
    name: Build linux/amd64
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Checkout chdb-rust
        run: bash .github/scripts/checkout-chdb-rust.sh

      - name: Restore sccache
        uses: actions/cache@v4
        with:
          path: ${{ env.SCCACHE_DIR }}
          key: sccache-release-amd64-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            sccache-release-amd64-

      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: release-amd64

      - name: Compile release binaries
        run: |
          rm -rf release-staging/amd64
          bash .github/scripts/run-in-rust-container.sh \
            'bash .github/scripts/rust-container-setup.sh && \
             sccache --zero-stats && \
             cargo build --release --locked -p hyperbytedb --bin hyperbytedb -p hyperbytedb-cli --bin hyperbytedb-cli -p hyperbytedb-proxy --bin hyperbytedb-proxy && \
             sccache --show-stats && \
             mkdir -p release-staging/amd64 && \
             cp target/release/hyperbytedb target/release/hyperbytedb-cli target/release/hyperbytedb-proxy /usr/local/lib/libchdb.so release-staging/amd64/'

      - name: Upload amd64 staging artifact
        uses: actions/upload-artifact@v4
        with:
          name: release-staging-amd64
          path: release-staging/amd64/
          if-no-files-found: error

  build-arm64:
    name: Build linux/arm64
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v4

      - name: Checkout chdb-rust
        run: bash .github/scripts/checkout-chdb-rust.sh

      - name: Restore sccache
        uses: actions/cache@v4
        with:
          path: ${{ env.SCCACHE_DIR }}
          key: sccache-release-arm64-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            sccache-release-arm64-

      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: release-arm64

      - name: Compile release binaries
        run: |
          rm -rf release-staging/arm64
          bash .github/scripts/run-in-rust-container.sh \
            'bash .github/scripts/rust-container-setup.sh && \
             sccache --zero-stats && \
             cargo build --release --locked -p hyperbytedb --bin hyperbytedb -p hyperbytedb-cli --bin hyperbytedb-cli -p hyperbytedb-proxy --bin hyperbytedb-proxy && \
             sccache --show-stats && \
             mkdir -p release-staging/arm64 && \
             cp target/release/hyperbytedb target/release/hyperbytedb-cli target/release/hyperbytedb-proxy /usr/local/lib/libchdb.so release-staging/arm64/'

      - name: Upload arm64 staging artifact
        uses: actions/upload-artifact@v4
        with:
          name: release-staging-arm64
          path: release-staging/arm64/
          if-no-files-found: error

  publish-image:
    name: Publish container image
    runs-on: ubuntu-latest
    needs: [build-amd64, build-arm64]
    steps:
      - uses: actions/checkout@v4

      - name: Download prebuilt binaries
        uses: actions/download-artifact@v4
        with:
          name: release-staging-amd64
          path: release-staging/amd64

      - uses: actions/download-artifact@v4
        with:
          name: release-staging-arm64
          path: release-staging/arm64

      - name: Verify staging layout
        run: |
          set -euo pipefail
          for arch in amd64 arm64; do
            chmod +x "release-staging/${arch}/hyperbytedb" "release-staging/${arch}/hyperbytedb-cli"
            test -f "release-staging/${arch}/hyperbytedb"
            test -f "release-staging/${arch}/hyperbytedb-cli"
            test -f "release-staging/${arch}/hyperbytedb-proxy"
            test -s "release-staging/${arch}/libchdb.so"
          done
          ls -lh release-staging/*/*

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry (PAT)
        if: vars.GHCR_AUTH == 'pat'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.GHCR_PAT }}

      - name: Log in to GitHub Container Registry (GITHUB_TOKEN)
        if: vars.GHCR_AUTH != 'pat'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=
            type=raw,value=latest,enable=${{ github.ref_type == 'tag' }}

      - name: Build and push multi-arch image
        uses: docker/build-push-action@v6
        with:
          context: release-staging
          file: Dockerfile.runtime
          platforms: linux/amd64,linux/arm64
          push: true
          provenance: false
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  publish-proxy-image:
    name: Publish proxy container image
    runs-on: ubuntu-latest
    needs: [build-amd64, build-arm64]
    steps:
      - uses: actions/checkout@v4

      - name: Download prebuilt binaries
        uses: actions/download-artifact@v4
        with:
          name: release-staging-amd64
          path: release-staging/amd64

      - uses: actions/download-artifact@v4
        with:
          name: release-staging-arm64
          path: release-staging/arm64

      - name: Verify proxy binary
        run: |
          set -euo pipefail
          for arch in amd64 arm64; do
            chmod +x "release-staging/${arch}/hyperbytedb-proxy"
            test -f "release-staging/${arch}/hyperbytedb-proxy"
          done
          ls -lh release-staging/*/hyperbytedb-proxy

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry (PAT)
        if: vars.GHCR_AUTH == 'pat'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.GHCR_PAT }}

      - name: Log in to GitHub Container Registry (GITHUB_TOKEN)
        if: vars.GHCR_AUTH != 'pat'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.PROXY_IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=
            type=raw,value=latest,enable=${{ github.ref_type == 'tag' }}

      - name: Build and push multi-arch proxy image
        uses: docker/build-push-action@v6
        with:
          context: release-staging
          file: Dockerfile.proxy-runtime
          platforms: linux/amd64,linux/arm64
          push: true
          provenance: false
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  publish-release:
    name: Publish GitHub Release
    runs-on: ubuntu-latest
    needs: [build-amd64, build-arm64, publish-image, publish-proxy-image]
    if: github.ref_type == 'tag'
    steps:
      - name: Download prebuilt binaries
        uses: actions/download-artifact@v4
        with:
          name: release-staging-amd64
          path: release-staging/amd64

      - uses: actions/download-artifact@v4
        with:
          name: release-staging-arm64
          path: release-staging/arm64

      - name: Package release tarballs
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          for arch in amd64 arm64; do
            chmod +x "release-staging/${arch}/hyperbytedb" \
                     "release-staging/${arch}/hyperbytedb-cli" \
                     "release-staging/${arch}/hyperbytedb-proxy"
          done
          mkdir -p out
          declare -A ARCHES=( [amd64]=x86_64 [arm64]=aarch64 )
          for src in "${!ARCHES[@]}"; do
            dst="${ARCHES[$src]}"

            NAME="hyperbytedb-${TAG}-linux-${dst}"
            tar -C "release-staging/${src}" -czf "out/${NAME}.tar.gz" \
              hyperbytedb hyperbytedb-cli hyperbytedb-proxy libchdb.so
            ( cd out && sha256sum "${NAME}.tar.gz" > "${NAME}.tar.gz.sha256" )
            ls -lh "out/${NAME}.tar.gz" "out/${NAME}.tar.gz.sha256"

            CLI_NAME="hyperbytedb-cli-${TAG}-linux-${dst}"
            cp "release-staging/${src}/hyperbytedb-cli" "out/${CLI_NAME}"
            gzip -f "out/${CLI_NAME}"
            ( cd out && sha256sum "${CLI_NAME}.gz" > "${CLI_NAME}.gz.sha256" )
            ls -lh "out/${CLI_NAME}.gz" "out/${CLI_NAME}.gz.sha256"

            PROXY_NAME="hyperbytedb-proxy-${TAG}-linux-${dst}"
            cp "release-staging/${src}/hyperbytedb-proxy" "out/${PROXY_NAME}"
            gzip -f "out/${PROXY_NAME}"
            ( cd out && sha256sum "${PROXY_NAME}.gz" > "${PROXY_NAME}.gz.sha256" )
            ls -lh "out/${PROXY_NAME}.gz" "out/${PROXY_NAME}.gz.sha256"
          done

      - name: Verify release artifacts
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          for arch in x86_64 aarch64; do
            tarball="out/hyperbytedb-${TAG}-linux-${arch}.tar.gz"
            test -s "${tarball}"
            test -s "out/hyperbytedb-${TAG}-linux-${arch}.tar.gz.sha256"
            listing="$(tar -tzf "${tarball}")"
            for entry in hyperbytedb hyperbytedb-cli hyperbytedb-proxy libchdb.so; do
              grep -qx "${entry}" <<<"${listing}"
            done

            cli="out/hyperbytedb-cli-${TAG}-linux-${arch}.gz"
            test -s "${cli}"
            test -s "${cli}.sha256"

            proxy="out/hyperbytedb-proxy-${TAG}-linux-${arch}.gz"
            test -s "${proxy}"
            test -s "${proxy}.sha256"
          done
          ls -lh out/

      - name: Create / update GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          generate_release_notes: true
          fail_on_unmatched_files: true
          files: |
            out/hyperbytedb-${{ github.ref_name }}-linux-x86_64.tar.gz
            out/hyperbytedb-${{ github.ref_name }}-linux-x86_64.tar.gz.sha256
            out/hyperbytedb-${{ github.ref_name }}-linux-aarch64.tar.gz
            out/hyperbytedb-${{ github.ref_name }}-linux-aarch64.tar.gz.sha256
            out/hyperbytedb-cli-${{ github.ref_name }}-linux-x86_64.gz
            out/hyperbytedb-cli-${{ github.ref_name }}-linux-x86_64.gz.sha256
            out/hyperbytedb-cli-${{ github.ref_name }}-linux-aarch64.gz
            out/hyperbytedb-cli-${{ github.ref_name }}-linux-aarch64.gz.sha256
            out/hyperbytedb-proxy-${{ github.ref_name }}-linux-x86_64.gz
            out/hyperbytedb-proxy-${{ github.ref_name }}-linux-x86_64.gz.sha256
            out/hyperbytedb-proxy-${{ github.ref_name }}-linux-aarch64.gz
            out/hyperbytedb-proxy-${{ github.ref_name }}-linux-aarch64.gz.sha256