release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      bump:
        description: Version bump to release (ignored when existing_tag is set)
        type: choice
        required: true
        options:
          - patch
          - minor
          - major
      existing_tag:
        description: >-
          Build and upload artifacts for a tag that already exists, skipping the
          version bump and the tagging. Recovery path for a run that tagged but
          did not produce its bundles.
        type: string
        required: false
        default: ''

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

permissions:
  contents: write

jobs:
  publish:
    name: Version and tag
    # This crate is **not published to crates.io**. It is consumed as a git
    # submodule by its hosts and shipped to them as the module artifacts this
    # workflow builds, so a registry upload would be a third distribution
    # channel nobody reads.
    #
    # There used to be a `cargo publish` step here, and its failure was not
    # cosmetic: `release-target` gates on this job succeeding, so a release
    # would tag the commit, fail the upload, and then skip every artifact job —
    # forcing a second run with `existing_tag` to build the bundles. `cargo
    # package` below still runs, so a manifest that could not be packaged is
    # still caught; nothing uploads it.
    #
    # The job id stays `publish` because several `needs:` and `needs.publish.*`
    # references depend on it.
    #
    # Skipped entirely when re-cutting artifacts for an existing tag.
    if: ${{ github.ref == 'refs/heads/main' && inputs.existing_tag == '' }}
    runs-on: ubuntu-latest
    environment: Production
    outputs:
      crate_name: ${{ steps.version.outputs.crate_name }}
      next_version: ${{ steps.version.outputs.next_version }}
      tag: ${{ steps.version.outputs.tag }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          submodules: true

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - uses: Swatinem/rust-cache@v2

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

      - name: Test
        run: cargo test --all-features

      - name: Build documentation
        env:
          RUSTDOCFLAGS: -D warnings
        run: cargo doc --no-deps --all-features

      - name: Compute next version
        id: version
        shell: bash
        run: |
          set -euo pipefail

          metadata="$(cargo metadata --format-version 1 --no-deps)"
          crate_name="$(jq -r '.packages[0].name' <<< "$metadata")"
          current_version="$(jq -r '.packages[0].version' <<< "$metadata")"
          if [[ -z "$current_version" || "$current_version" == "null" ]]; then
            echo "Could not resolve the current crate version" >&2
            exit 1
          fi

          IFS=. read -r major minor patch <<< "$current_version"
          case "${{ inputs.bump }}" in
            major)
              major=$((major + 1))
              minor=0
              patch=0
              ;;
            minor)
              minor=$((minor + 1))
              patch=0
              ;;
            patch)
              patch=$((patch + 1))
              ;;
            *)
              echo "Unsupported bump: ${{ inputs.bump }}" >&2
              exit 1
              ;;
          esac

          next_version="${major}.${minor}.${patch}"
          tag="v${next_version}"

          git fetch --tags origin
          if git rev-parse --verify --quiet "refs/tags/${tag}"; then
            echo "Tag ${tag} already exists" >&2
            exit 1
          fi

          {
            echo "crate_name=${crate_name}"
            echo "current_version=${current_version}"
            echo "next_version=${next_version}"
            echo "tag=${tag}"
          } >> "$GITHUB_OUTPUT"

      - name: Update crate version
        env:
          CRATE_NAME: ${{ steps.version.outputs.crate_name }}
          NEXT_VERSION: ${{ steps.version.outputs.next_version }}
        run: |
          set -euo pipefail
          bump() {
            perl -0pi -e 's/(\[package\][\s\S]*?\nversion = ")[^"]+(")/$1$ENV{NEXT_VERSION}$2/' "$1"
          }
          bump Cargo.toml
          # The module crate is bumped in lockstep, not left behind. Its
          # `cdylib` ships in an archive named for the *root* crate's version,
          # so a drift here would publish `tinywallet-module-0.2.0-*.tar.gz`
          # containing a library that reports 0.1.0 — with nothing to catch it.
          bump crates/tinywallet-module/Cargo.toml
          # Refreshes both workspace members in the lockfile. `cargo update -p`
          # cannot do this: these are path dependencies, and the later
          # `--locked` steps fail against a stale lock.
          cargo update --workspace

      - name: Commit version bump and tag
        env:
          RELEASE_TAG: ${{ steps.version.outputs.tag }}
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add Cargo.toml Cargo.lock crates/tinywallet-module/Cargo.toml
          git commit -m "Release ${RELEASE_TAG}"
          git tag -a "${RELEASE_TAG}" -m "Release ${RELEASE_TAG}"

      # Scoped to the library. Unscoped, `cargo package` also verifies
      # `tinywallet-module`, whose path dependency on this crate carries no
      # version — correct for a crate that is `publish = false` and shipped as
      # a release artifact, but fatal to a workspace-wide package step.
      - name: Package crate
        run: cargo package --locked --package tinywallet

      - name: Push release commit and tag
        env:
          RELEASE_TAG: ${{ steps.version.outputs.tag }}
        run: |
          set -euo pipefail
          git push origin "HEAD:${GITHUB_REF_NAME}"
          git push origin "${RELEASE_TAG}"

  # What the bundles need is a tag and a version. That used to be entangled with
  # a crates.io upload in one job, so a missing registry token took the module
  # artifacts down with it even though nothing about them touches crates.io.
  # The upload is gone now, so this job's gate means what it says: the tag
  # exists and was pushed.
  release-target:
    name: Resolve release target
    needs: publish
    # `always()` is required because this job must still run when `publish` is
    # *skipped* — the `existing_tag` recovery path, where the tag already
    # exists. It is deliberately NOT tolerant of a `publish` *failure*: that job
    # now only versions, packages and tags, and without a tag there is nothing
    # for the bundles to attach to.
    if: ${{ always() && (inputs.existing_tag != '' || needs.publish.result == 'success') }}
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.resolve.outputs.tag }}
      next_version: ${{ steps.resolve.outputs.next_version }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Resolve the tag and version to build
        id: resolve
        shell: bash
        env:
          EXISTING_TAG: ${{ inputs.existing_tag }}
          PUBLISHED_TAG: ${{ needs.publish.outputs.tag }}
          PUBLISHED_VERSION: ${{ needs.publish.outputs.next_version }}
        run: |
          set -euo pipefail
          if [[ -n "$EXISTING_TAG" ]]; then
            git fetch --tags origin
            git rev-parse --verify --quiet "refs/tags/${EXISTING_TAG}" >/dev/null \
              || { echo "tag ${EXISTING_TAG} does not exist" >&2; exit 1; }
            tag="$EXISTING_TAG"
            version="${EXISTING_TAG#v}"
          else
            tag="$PUBLISHED_TAG"
            version="$PUBLISHED_VERSION"
          fi
          [[ -n "$tag" && -n "$version" ]] || { echo "could not resolve a release target" >&2; exit 1; }
          {
            echo "tag=${tag}"
            echo "next_version=${version}"
          } >> "$GITHUB_OUTPUT"

  native-bundles:
    name: Module bundle (${{ matrix.id }})
    needs: release-target
    # `always()` is required even though `release-target` succeeds: GitHub
    # propagates a skip transitively, so a skipped `publish` upstream would
    # skip this job regardless of its direct dependency's result. The explicit
    # success check is what actually gates it.
    if: ${{ always() && needs.release-target.result == 'success' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - id: ubuntu-22.04-x86_64
            os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
          - id: ubuntu-22.04-arm64
            os: ubuntu-22.04-arm
            target: aarch64-unknown-linux-gnu
          - id: ubuntu-24.04-x86_64
            os: ubuntu-24.04
            target: x86_64-unknown-linux-gnu
          - id: ubuntu-24.04-arm64
            os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
          - id: macos-15-x86_64
            os: macos-15-intel
            target: x86_64-apple-darwin
          - id: macos-15-arm64
            os: macos-15
            target: aarch64-apple-darwin
          - id: macos-26-x86_64
            os: macos-26-intel
            target: x86_64-apple-darwin
          - id: macos-26-arm64
            os: macos-26
            target: aarch64-apple-darwin
          - id: windows-2022-x86_64
            os: windows-2022
            target: x86_64-pc-windows-msvc
          - id: windows-2025-x86_64
            os: windows-2025
            target: x86_64-pc-windows-msvc
          - id: windows-11-arm64
            os: windows-11-arm
            target: aarch64-pc-windows-msvc
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.release-target.outputs.tag }}
          persist-credentials: false
          submodules: true

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Verify native Rust target
        shell: bash
        env:
          EXPECTED_TARGET: ${{ matrix.target }}
        run: |
          set -euo pipefail
          actual_target="$(rustc -vV | sed -n 's/^host: //p')"
          [[ "$actual_target" == "$EXPECTED_TARGET" ]]

      - name: Build installable module
        run: cargo build --locked --release --package tinywallet-module

      - name: Assemble Unix module package
        if: ${{ runner.os != 'Windows' }}
        id: unix_package
        shell: bash
        env:
          BUNDLE_ID: ${{ matrix.id }}
          VERSION: ${{ needs.release-target.outputs.next_version }}
        run: |
          set -euo pipefail

          library_name="tinywallet_module"
          case "$RUNNER_OS" in
            Linux) module="target/release/lib${library_name}.so" ;;
            macOS) module="target/release/lib${library_name}.dylib" ;;
            *) echo "unsupported Unix runner: ${RUNNER_OS}" >&2; exit 1 ;;
          esac
          package_name="tinywallet-module-${VERSION}-${BUNDLE_ID}"
          package_root="dist/${package_name}"
          mkdir -p "$package_root"
          install -m 755 "$module" "$package_root/"
          install -m 644 LICENSE README.md docs/specs/tinybus-module.md "$package_root/"
          module_name="$(basename "$module")"
          module_hash="$(sha256sum "$package_root/$module_name" | awk '{print $1}')"
          printf '"%s" = "%s"\n' "$module_name" "$module_hash" \
            > "$package_root/modules.toml"
          tar -C "$package_root" -czf "dist/${package_name}.tar.gz" .
          echo "archive=dist/${package_name}.tar.gz" >> "$GITHUB_OUTPUT"

      - name: Assemble Windows module package
        if: ${{ runner.os == 'Windows' }}
        id: windows_package
        shell: pwsh
        env:
          BUNDLE_ID: ${{ matrix.id }}
          VERSION: ${{ needs.release-target.outputs.next_version }}
        run: |
          $ErrorActionPreference = 'Stop'
          $libraryName = 'tinywallet_module'
          $module = "target/release/$libraryName.dll"
          $packageName = "tinywallet-module-$env:VERSION-$env:BUNDLE_ID"
          $packageRoot = "dist/$packageName"
          New-Item -ItemType Directory -Force $packageRoot | Out-Null
          Copy-Item -LiteralPath $module, 'LICENSE', 'README.md' -Destination $packageRoot
          $hash = (Get-FileHash -LiteralPath $module -Algorithm SHA256).Hash.ToLowerInvariant()
          $moduleName = Split-Path -Leaf $module
          "`"$moduleName`" = `"$hash`"`n" |
            Set-Content -Path "$packageRoot/modules.toml" -Encoding utf8NoBOM
          Compress-Archive -Path "$packageRoot/*" -DestinationPath "dist/$packageName.zip"
          "archive=dist/$packageName.zip" >> $env:GITHUB_OUTPUT

      - name: Upload Unix module package
        if: ${{ runner.os != 'Windows' }}
        uses: actions/upload-artifact@v7
        with:
          name: tinywallet-module-${{ matrix.id }}
          path: ${{ steps.unix_package.outputs.archive }}
          if-no-files-found: error

      - name: Upload Windows module package
        if: ${{ runner.os == 'Windows' }}
        uses: actions/upload-artifact@v7
        with:
          name: tinywallet-module-${{ matrix.id }}
          path: ${{ steps.windows_package.outputs.archive }}
          if-no-files-found: error

  github-release:
    name: Create GitHub release
    needs:
      - release-target
      - native-bundles
    # Same transitive-skip rule as above.
    if: >-
      ${{ always()
      && needs.release-target.result == 'success'
      && needs.native-bundles.result == 'success' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.release-target.outputs.tag }}
          persist-credentials: false
          submodules: true

      - name: Download workflow artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: tinywallet-module-*
          path: release-assets
          merge-multiple: true

      - uses: dtolnay/rust-toolchain@stable

      - name: Create release checksum manifest with TinyBus
        shell: bash
        run: |
          set -euo pipefail
          mapfile -t assets < <(
            find release-assets -type f \
              \( -name '*.tar.gz' -o -name '*.zip' \) \
              | sort
          )
          if [[ ${#assets[@]} -ne 11 ]]; then
            printf 'expected 11 module archives, found %s:\n' "${#assets[@]}" >&2
            find release-assets -type f -print >&2 || true
            exit 1
          fi
          checksum_args=()
          for asset in "${assets[@]}"; do checksum_args+=(--path "$asset"); done
          cargo run --manifest-path vendor/tinybus/Cargo.toml --locked \
            --package tinybus --all-features --bin tinybus -- \
            modules checksum "${checksum_args[@]}" --output release-assets/checksum.toml

      - name: Create release and upload assets
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ needs.release-target.outputs.tag }}
          REPOSITORY: ${{ github.repository }}
        run: |
          set -euo pipefail
          mapfile -t release_files < <(find release-assets -type f | sort)
          gh release create "$RELEASE_TAG" "${release_files[@]}" \
            --repo "$REPOSITORY" \
            --verify-tag \
            --title "$RELEASE_TAG" \
            --generate-notes

      - name: Verify the published module through TinyBus
        shell: bash
        env:
          RELEASE_TAG: ${{ needs.release-target.outputs.tag }}
          REPOSITORY: ${{ github.repository }}
          VERSION: ${{ needs.release-target.outputs.next_version }}
        run: |
          set -euo pipefail
          archive="tinywallet-module-${VERSION}-ubuntu-24.04-x86_64.tar.gz"
          release_url="https://github.com/${REPOSITORY}/releases/tag/${RELEASE_TAG}"
          sha256="$(sed -n "s/^\"${archive}\" = \"\([0-9a-f]\{64\}\)\"$/\1/p" release-assets/checksum.toml)"
          test -n "$sha256"
          cargo run --manifest-path vendor/tinybus/Cargo.toml --locked \
            --package tinybus --all-features --example github_module_host -- \
            "$release_url" "$archive" "$sha256"