release.yml

name: release

on:
  push:
    tags: ["v*"]

permissions:
  contents: write

jobs:
  validate-version:
    runs-on: windows-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v5
      - name: Validate tag, Cargo and Skill versions before releasing
        shell: powershell
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: .\.github\scripts\verify-release-version.ps1 -ReleaseTag $env:RELEASE_TAG

  build-macos:
    needs: validate-version
    runs-on: macos-14
    environment: macos-release
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin
      - run: cargo test --locked
      - run: cargo build --release --locked --target aarch64-apple-darwin
      - name: Verify compiled version before signing
        shell: bash
        run: |
          actual="$(target/aarch64-apple-darwin/release/browser-cli --version)"
          expected="browser-cli ${GITHUB_REF_NAME#v}"
          [ "$actual" = "$expected" ] || { echo "Version mismatch: expected $expected, got $actual" >&2; exit 1; }
      - name: Sign and notarize
        env:
          MACOS_DEVELOPER_ID_APPLICATION_P12_BASE64: ${{ secrets.MACOS_DEVELOPER_ID_APPLICATION_P12_BASE64 }}
          MACOS_DEVELOPER_ID_P12_PASSWORD: ${{ secrets.MACOS_DEVELOPER_ID_P12_PASSWORD }}
          APPLE_NOTARY_APPLE_ID: ${{ secrets.APPLE_NOTARY_APPLE_ID }}
          APPLE_NOTARY_TEAM_ID: ${{ secrets.APPLE_NOTARY_TEAM_ID }}
          APPLE_NOTARY_APP_PASSWORD: ${{ secrets.APPLE_NOTARY_APP_PASSWORD }}
        run: ./scripts/sign_and_notarize_macos.sh target/aarch64-apple-darwin/release/browser-cli
      - name: Package
        run: |
          version="${GITHUB_REF_NAME#v}"
          asset="browser-cli-v${version}-aarch64-apple-darwin"
          cp target/aarch64-apple-darwin/release/browser-cli "$asset"
          shasum -a 256 "$asset" > "$asset.sha256"
      - uses: actions/upload-artifact@v4
        with:
          name: release-aarch64-apple-darwin
          path: browser-cli-v*-aarch64-apple-darwin*

  build-linux:
    needs: validate-version
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-musl
      - run: sudo apt-get update && sudo apt-get install --yes musl-tools
      - run: cargo test --locked
      - name: Build static Linux binary
        run: cargo build --release --locked --target x86_64-unknown-linux-musl
      - name: Verify compiled version before packaging
        shell: bash
        run: |
          actual="$(target/x86_64-unknown-linux-musl/release/browser-cli --version)"
          expected="browser-cli ${GITHUB_REF_NAME#v}"
          [ "$actual" = "$expected" ] || { echo "Version mismatch: expected $expected, got $actual" >&2; exit 1; }
      - name: Package
        run: |
          version="${GITHUB_REF_NAME#v}"
          asset="browser-cli-v${version}-x86_64-unknown-linux-musl"
          cp target/x86_64-unknown-linux-musl/release/browser-cli "$asset"
          chmod 755 "$asset"
          if readelf --program-headers --wide "$asset" | grep -F 'Requesting program interpreter'; then
            echo 'Linux release binary is dynamically linked' >&2
            exit 1
          fi
          "./$asset" version
          sha256sum "$asset" > "$asset.sha256"
      - uses: actions/upload-artifact@v4
        with:
          name: release-x86_64-unknown-linux-musl
          path: browser-cli-v*-x86_64-unknown-linux-musl*

  build-windows:
    needs: validate-version
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-pc-windows-msvc
      - run: cargo test --locked
      - run: cargo build --release --locked --target x86_64-pc-windows-msvc
      - name: Verify compiled version before packaging
        shell: bash
        run: |
          actual="$(target/x86_64-pc-windows-msvc/release/browser-cli.exe --version)"
          expected="browser-cli ${GITHUB_REF_NAME#v}"
          [ "$actual" = "$expected" ] || { echo "Version mismatch: expected $expected, got $actual" >&2; exit 1; }
      - name: Package
        shell: bash
        run: |
          version="${GITHUB_REF_NAME#v}"
          asset="browser-cli-v${version}-x86_64-pc-windows-msvc.exe"
          cp target/x86_64-pc-windows-msvc/release/browser-cli.exe "$asset"
          sha256sum "$asset" > "$asset.sha256"
      - uses: actions/upload-artifact@v4
        with:
          name: release-x86_64-pc-windows-msvc
          path: browser-cli-v*-x86_64-pc-windows-msvc*

  publish:
    needs: [build-linux, build-macos, build-windows]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment: cos-release
    steps:
      - uses: actions/checkout@v5
      - uses: actions/download-artifact@v4
        with:
          pattern: release-*
          merge-multiple: true
      - name: Package SkillHub upload ZIP
        run: |
          version="${GITHUB_REF_NAME#v}"
          ./scripts/package-skill.sh
          cp dist/lexmount-browser.zip "lexmount-browser-v${version}-skillhub.zip"
          sha256sum "lexmount-browser-v${version}-skillhub.zip" > "lexmount-browser-v${version}-skillhub.zip.sha256"
      - run: cat *.sha256 | sort -k2 > SHA256SUMS
      - name: Upload platform binaries to Tencent Cloud COS
        env:
          TENCENT_CLOUD_SECRET_ID: ${{ secrets.TENCENT_CLOUD_SECRET_ID }}
          TENCENT_CLOUD_SECRET_KEY: ${{ secrets.TENCENT_CLOUD_SECRET_KEY }}
          COS_BUCKET: ${{ vars.COS_BUCKET }}
          COS_REGION: ${{ vars.COS_REGION }}
          COS_PUBLIC_BASE_URL: ${{ vars.COS_PUBLIC_BASE_URL }}
          COS_OBJECT_PREFIX: ${{ vars.COS_OBJECT_PREFIX }}
        run: |
          version="${GITHUB_REF_NAME#v}"
          mkdir cos-upload
          cp \
            "browser-cli-v${version}-aarch64-apple-darwin" \
            "browser-cli-v${version}-x86_64-unknown-linux-musl" \
            "browser-cli-v${version}-x86_64-pc-windows-msvc.exe" \
            cos-upload/
          (cd cos-upload && sha256sum browser-cli-v* | sort -k2 > SHA256SUMS)
          ./scripts/upload-release-to-cos.sh cos-upload browser-cli "${version}"
      - run: rm -f -- *.sha256
      - uses: softprops/action-gh-release@v2
        with:
          files: |
            browser-cli-v*
            lexmount-browser-v*-skillhub.zip
            SHA256SUMS