release.yml

name: Release

# Tag-driven release: pushing a `vX.Y.Z` tag cross-builds the `mem4n6` binary for
# all platforms and attaches the artifacts (+ SHA-256 checksums) to a GitHub
# Release. The Linux targets are **musl** so the binary is a genuinely static,
# self-contained executable — the README's "single static binary" claim made
# literally true (a CI job verifies this on every push; see ci.yml `musl-static`).
#
# Scope: build + GitHub Release only. The fleet distribution fan-out
# (Homebrew tap / apt-Cloudsmith / winget / crates.io) is intentionally NOT wired
# here yet — each needs external bootstrapping (a created Cloudsmith repo, a tap
# handler, winget registration) that would 404/fail until set up. Add per channel
# when mem4n6 is ready to publish, modelled on `~/src/blazehash/.github/workflows/release.yml`.

on:
  push:
    tags: ["v[0-9]*"]

permissions:
  contents: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            os: macos-latest
          - target: x86_64-apple-darwin
            os: macos-15
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
          - target: x86_64-pc-windows-msvc
            os: windows-latest
    runs-on: ${{ matrix.os }}
    environment: release
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: Set version
        id: version
        shell: bash
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      # Pin to the repo toolchain (rust-toolchain.toml = 1.96.0). MUST match that
      # pin: a floating `stable` here adds the target to the wrong toolchain, so
      # rust-toolchain.toml's 1.96.0 builds without the cross-target → E0463.
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: "1.96.0"
          targets: ${{ matrix.target }}

      - name: Install musl tools (Linux)
        if: contains(matrix.target, 'musl')
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools
          if [[ "${{ matrix.target }}" == "aarch64-unknown-linux-musl" ]]; then
            sudo apt-get install -y gcc-aarch64-linux-gnu
            echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
          fi

      - name: Build
        run: cargo build --release --target ${{ matrix.target }} --bin mem4n6

      - name: Azure login (OIDC)
        if: runner.os == 'Windows'
        uses: azure/login@93381592711f247e165c389ebb30b596c84cdc48 # v3.0.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - name: Sign Windows .exe (Azure Trusted Signing)
        if: runner.os == 'Windows'
        uses: azure/trusted-signing-action@208f8af4bf26cf2af8597424e3cb5582801523ba # v2.0.0
        with:
          endpoint: https://neu.codesigning.azure.net
          trusted-signing-account-name: securityronin
          certificate-profile-name: securityronin-public
          files-folder: target/${{ matrix.target }}/release
          files-folder-filter: exe
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com

      # Make the "static binary" claim self-enforcing: fail the release build if
      # the musl artifact is not actually statically linked.
      - name: Verify static linking (musl)
        if: contains(matrix.target, 'musl')
        run: |
          BIN="target/${{ matrix.target }}/release/mem4n6"
          file "$BIN"
          # Accept classic static and static-PIE (self-contained + ASLR) — both have no external deps.
          file "$BIN" | grep -qE 'statically linked|static-pie linked' || { echo "::error::$BIN is NOT statically linked"; exit 1; }

      - name: Package (Unix)
        if: runner.os != 'Windows'
        run: |
          cd "target/${{ matrix.target }}/release"
          tar czf "../../../mem4n6-${{ steps.version.outputs.version }}-${{ matrix.target }}.tar.gz" mem4n6
          cd ../../..

      - name: Package (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: Compress-Archive -Path "target/${{ matrix.target }}/release/mem4n6.exe" -DestinationPath "mem4n6-${{ steps.version.outputs.version }}-${{ matrix.target }}.zip"

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: mem4n6-${{ steps.version.outputs.version }}-${{ matrix.target }}
          path: mem4n6-${{ steps.version.outputs.version }}-${{ matrix.target }}.*

  # Publish the crate to crates.io on the release tag (was hand-published before).
  # Gated on build; idempotent (skip if this version is already on crates.io) so a
  # re-tag never wedges on "already exists". Uses the org CARGO_REGISTRY_TOKEN.
  publish-crate:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
      - name: cargo publish (skip if already published)
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          VER="${GITHUB_REF_NAME#v}"
          if curl -sf "https://index.crates.io/me/m4/mem4n6" | grep -q "\"vers\":\"$VER\""; then
            echo "mem4n6 $VER already on crates.io — skipping publish"
          else
            cargo publish --locked
          fi

  release:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          path: artifacts
          pattern: "mem4n6-*-*"
          merge-multiple: true

      - name: Generate checksums
        run: |
          cd artifacts
          sha256sum * > checksums.txt
          cat checksums.txt

      - name: Create release
        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
        with:
          files: |
            artifacts/mem4n6-*
            artifacts/checksums.txt
          generate_release_notes: true