release.yml

name: Release Binaries

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      dry_run_note:
        description: Optional context for manual non-publishing release validation.
        required: false
        type: string

jobs:
  build:
    name: Build (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: macos-15-intel
            target: x86_64-apple-darwin
          - os: macos-latest
            target: aarch64-apple-darwin

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Cache Cargo build artifacts
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: release-${{ matrix.target }}

      - name: Compute crate name
        id: crate
        shell: bash
        run: |
          set -euo pipefail
          NAME="$(awk -F\" '/^name *=/ { print $2; exit }' Cargo.toml)"
          echo "name=${NAME}" >> "$GITHUB_OUTPUT"

      - name: Compute release version
        id: version
        shell: bash
        run: |
          set -euo pipefail
          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            VERSION="${GITHUB_REF#refs/tags/}"
          else
            VERSION="dev-$(echo "${GITHUB_SHA}" | cut -c1-7)"
          fi
          echo "value=${VERSION}" >> "$GITHUB_OUTPUT"

      - name: Verify tag matches Cargo.toml version
        if: startsWith(github.ref, 'refs/tags/v')
        shell: bash
        run: |
          set -euo pipefail
          TAG_VERSION="${GITHUB_REF#refs/tags/v}"
          CARGO_VERSION="$(awk -F\" '/^version *=/ { print $2; exit }' Cargo.toml)"
          if [[ "${TAG_VERSION}" != "${CARGO_VERSION}" ]]; then
            echo "::error::release tag v${TAG_VERSION} does not match Cargo.toml [package] version ${CARGO_VERSION}; bump Cargo.toml before tagging" >&2
            exit 1
          fi
          echo "tag v${TAG_VERSION} matches Cargo.toml version ${CARGO_VERSION}"

      - name: Install Linux build deps
        if: contains(matrix.target, 'linux')
        run: |
          sudo apt-get update
          sudo apt-get install -y libdbus-1-dev pkg-config

      - name: Build release binary
        shell: bash
        run: cargo build --release --target ${{ matrix.target }}

      - name: Stage artifact
        shell: bash
        run: |
          set -euo pipefail
          NAME="${{ steps.crate.outputs.name }}"
          VERSION="${{ steps.version.outputs.value }}"
          TARGET="${{ matrix.target }}"
          STAGE="${NAME}-${VERSION}-${TARGET}"
          ARCHIVE="${STAGE}.tar.gz"

          mkdir -p "${STAGE}"
          cp "target/${TARGET}/release/${NAME}" "${STAGE}/${NAME}"
          tar -czf "${ARCHIVE}" "${STAGE}"
          shasum -a 256 "${ARCHIVE}" | awk '{print $1}' > "${ARCHIVE}.sha256"
          echo "archive=${ARCHIVE}" >> "$GITHUB_ENV"

      - name: Upload archive artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.crate.outputs.name }}-${{ matrix.target }}
          path: |
            ${{ env.archive }}
            ${{ env.archive }}.sha256
          if-no-files-found: error

  publish:
    name: Publish GitHub release (tags only)
    runs-on: ubuntu-latest
    needs: build
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: write

    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist

      - name: Collect release assets
        shell: bash
        run: |
          set -euo pipefail
          ASSETS_DIR="dist/release-assets"
          mkdir -p "${ASSETS_DIR}"
          find dist -type f \( -name '*.tar.gz' -o -name '*.tar.gz.sha256' \) ! -path "${ASSETS_DIR}/*" -exec cp {} "${ASSETS_DIR}/" \;
          ls -la "${ASSETS_DIR}"

      - name: Publish release
        uses: softprops/action-gh-release@v2
        with:
          files: dist/release-assets/*
          fail_on_unmatched_files: true
          generate_release_notes: true