release.yml

# Release workflow for deep-code
#
# 触发条件：推送 v* 标签（如 v0.1.0）
# 执行：多平台编译 → GitHub Release → npm publish
#
# 前置条件：npm 侧把本仓库配成该包的 trusted publisher（OIDC）。
# 不需要 NPM_TOKEN —— publish 步骤走 id-token 权限，无 token、无 OTP。

name: Release

on:
  push:
    tags: ['v*']
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always

jobs:
  # ═══════════════════════════════════════════════
  # 阶段 1：并行编译 5 个平台
  # ═══════════════════════════════════════════════
  build:
    name: Build ${{ matrix.name }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: darwin-arm64
            os: macos-latest
            target: aarch64-apple-darwin
          - name: darwin-x64
            # Intel macOS runners (macos-13) are scarce/retiring and can queue
            # forever; cross-compile x86_64 on the arm64 runner instead.
            os: macos-latest
            target: x86_64-apple-darwin
          # Pinned to the OLDEST available Ubuntu runner on purpose: a
          # `-gnu` binary requires at least the glibc it was linked against, and
          # `ubuntu-latest` (24.04, glibc 2.39) produced binaries that refused to
          # start on Ubuntu 22.04, Debian 12, RHEL 9 and Amazon Linux 2023 — i.e.
          # most of the installed base. `npm i -g` succeeded and then every run
          # died with `GLIBC_2.3x not found`. 22.04 lowers the floor to glibc
          # 2.35. Do not "modernize" these back to `-latest`.
          - name: linux-x64
            os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
          - name: linux-arm64
            os: ubuntu-22.04-arm
            target: aarch64-unknown-linux-gnu
          - name: win32-x64
            os: windows-latest
            target: x86_64-pc-windows-msvc

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        # Pinned to match rust-toolchain.toml; bump both together.
        uses: dtolnay/rust-toolchain@1.96.0
        with:
          targets: ${{ matrix.target }}

      # The release pipeline used to go straight from build to npm publish with
      # no test gate at all, so tagging a commit whose CI was red (or tagging
      # before CI finished) shipped a broken binary as npm `latest`. Host-native
      # (no `--target`): a cross-compiled artifact cannot be executed here, but
      # the workspace tests still run on every platform in the matrix.
      - name: Test
        run: cargo test --locked --workspace

      - name: Build (release)
        run: cargo build --locked --release --package deep-code-tui --target ${{ matrix.target }}

      - name: Rename binary for release
        shell: bash
        run: |
          TARGET="${{ matrix.target }}"
          if [[ "${{ matrix.os }}" == "windows-latest" ]]; then
            cp "target/${TARGET}/release/deep-code.exe" "deep-code-${TARGET}.exe"
          else
            cp "target/${TARGET}/release/deep-code" "deep-code-${TARGET}"
            chmod +x "deep-code-${TARGET}"
          fi

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: deep-code-${{ matrix.target }}
          path: deep-code-${{ matrix.target }}*

  # ═══════════════════════════════════════════════
  # 阶段 2：GitHub Release + npm publish
  # ═══════════════════════════════════════════════
  publish:
    name: Release & Publish
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write # OIDC trusted publishing to npm (no token, no OTP)
    steps:
      - uses: actions/checkout@v4

      - name: Verify tag matches package versions
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          NPM=$(grep -m1 '"version"' packages/deepcode/package.json \
            | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')
          CARGO=$(grep -m1 '^version' Cargo.toml | sed -E 's/.*"([^"]+)".*/\1/')
          echo "tag=$TAG  npm=$NPM  cargo=$CARGO"
          if [ "$TAG" != "$NPM" ]; then
            echo "::error::git tag v$TAG does not match packages/deepcode/package.json ($NPM)"
            exit 1
          fi
          if [ "$TAG" != "$CARGO" ]; then
            echo "::error::git tag v$TAG does not match Cargo.toml ($CARGO)"
            exit 1
          fi

      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Prepare release assets
        run: |
          mkdir -p release-assets
          find artifacts -type f | while read f; do
            cp "$f" release-assets/
          done
          echo "=== Release assets ==="
          ls -lh release-assets/

      - name: Generate SHA256SUMS
        working-directory: release-assets
        run: |
          sha256sum * > SHA256SUMS
          echo "=== SHA256SUMS ==="
          cat SHA256SUMS

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: release-assets/*
          generate_release_notes: true
          fail_on_unmatched_files: true

      # Node 24 ships with npm >= 11.5.1, meeting the OIDC trusted publishing
      # requirement without a separate upgrade step that can break module paths.
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'

      - name: Publish to npm (OIDC trusted publishing)
        working-directory: packages/deepcode
        # No NODE_AUTH_TOKEN: auth comes from GitHub OIDC via the package's
        # configured trusted publisher, so it bypasses 2FA/OTP entirely.
        run: npm publish --access public