release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions: {}

env:
  BUN_VERSION: "1.3.14"

jobs:
  validate:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
        with:
          fetch-depth: 0

      - name: Ensure tag commit is on main
        if: github.event_name == 'push'
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
          TAG_COMMIT="$(git rev-parse "${GITHUB_SHA}^{commit}")"
          if ! git merge-base --is-ancestor "${TAG_COMMIT}" "origin/main"; then
            echo "Tag ${REF_NAME} is not on origin/main."
            exit 1
          fi

      - name: Ensure tag matches package.json version
        if: github.event_name == 'push'
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          TAG_NAME="${REF_NAME#v}"
          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
          if [ "${TAG_NAME}" != "${PACKAGE_VERSION}" ]; then
            echo "Tag ${REF_NAME} (stripped: ${TAG_NAME}) does not match package.json version ${PACKAGE_VERSION}."
            exit 1
          fi

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: ${{ env.BUN_VERSION }}

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Audit complete dependency graph
        run: bun audit

      - name: Audit production dependencies
        run: bun audit --audit-level=high --prod

      - name: Static checks, tests, coverage, and Fallow analysis
        run: bun run validate

      - name: Tests (Bun — DB)
        run: bun run test:db

  whisper-runtime:
    needs: validate
    uses: ./.github/workflows/whisper-runtime.yml
    permissions:
      contents: read

  build:
    runs-on: windows-latest
    needs:
      - validate
      - whisper-runtime
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: ${{ env.BUN_VERSION }}

      - name: Download the reviewed Whisper runtime
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
        with:
          name: hlid-whisper-runtime-windows-x64-v1.9.1
          path: .cache/whisper

      - name: Resolve version
        id: ver
        shell: pwsh
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          $v = $env:REF_NAME -replace "^v",""
          # Reject anything that isn't a clean semver to keep downstream shell-safe
          if ($v -notmatch '^[0-9]+(\.[0-9]+)*(-[A-Za-z0-9.]+)?$') {
            Write-Error "Refusing unsafe version string: $v"
            exit 1
          }
          "version=$v" >> $env:GITHUB_OUTPUT
          Write-Host "Resolved: semver=$v"

      - run: bun install --frozen-lockfile

      - run: bun scripts/generate-icons.ts

      - name: Build hlid.exe
        env:
          HLID_BUILD_OUTFILE: build/hlid.exe
          HLID_WHISPER_RUNTIME_ARCHIVE: ${{ github.workspace }}\.cache\whisper\hlid-whisper-runtime-windows-x64-v1.9.1.zip
          HLID_WHISPER_RUNTIME_MANIFEST: ${{ github.workspace }}\.cache\whisper\runtime-manifest.json
        run: bun run build:win

      - name: Smoke test hlid.exe
        shell: pwsh
        env:
          HLID_SKIP_SELF_INSTALL: "1"
        run: |
          $ErrorActionPreference = "Stop"
          $exe = Resolve-Path "build/hlid.exe"
          $proc = Start-Process -FilePath $exe -ArgumentList "--background" -PassThru -WindowStyle Hidden
          try {
            $deadline = (Get-Date).AddSeconds(30)
            $ok = $false
            do {
              Start-Sleep -Milliseconds 500
              if ($proc.HasExited) { break }
              try {
                $health = Invoke-RestMethod -Uri "http://127.0.0.1:3000/api/health" -TimeoutSec 2
                if ($health.service -eq "hlid") {
                  $ok = $true
                  break
                }
              } catch {}
            } while ((Get-Date) -lt $deadline)

            if (-not $ok) {
              if ($proc.HasExited) {
                Write-Host "hlid.exe exited early with code $($proc.ExitCode)"
              } else {
                Write-Host "hlid.exe did not become healthy before timeout"
              }
              Get-ChildItem -Path "build" -Filter "crash.log" -ErrorAction SilentlyContinue | ForEach-Object {
                Write-Host "==== $($_.FullName) ===="
                Get-Content $_.FullName -Raw
              }
              throw "hlid.exe smoke test failed"
            }
          } finally {
            try {
              Invoke-RestMethod -Uri "http://127.0.0.1:3000/api/lifecycle" -Method POST -ContentType "application/json" -Body '{"action":"shutdown"}' -TimeoutSec 2 | Out-Null
              Start-Sleep -Milliseconds 800
            } catch {}
            if (-not $proc.HasExited) {
              Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue
            }
          }

      - name: Rename for release
        shell: pwsh
        env:
          VERSION: ${{ steps.ver.outputs.version }}
        run: |
          $name = "hlid-v$($env:VERSION)-windows-x64.exe"
          Move-Item build/hlid.exe $name
          "ARTIFACT=$name" >> $env:GITHUB_ENV

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: hlid-windows-x64
          path: ${{ env.ARTIFACT }}
          if-no-files-found: error

  release:
    runs-on: ubuntu-latest
    needs: build
    permissions:
      contents: write
    steps:
      - name: Checkout release commit
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
        with:
          fetch-depth: 1

      - name: Read release notes from commit body
        shell: bash
        run: |
          git show -s --format=%b "${GITHUB_SHA}^{commit}" > release-notes.md
          if ! grep -q '[^[:space:]]' release-notes.md; then
            echo "Release commit body is empty; add curated Markdown release notes."
            exit 1
          fi

      - name: Download build artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
        with:
          name: hlid-windows-x64
          path: dist/

      - name: Generate checksums
        run: |
          cd dist
          sha256sum *.exe > hlid-checksums.txt
          cat hlid-checksums.txt

      - name: Publish release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3
        with:
          tag_name: ${{ github.ref_name }}
          body_path: release-notes.md
          generate_release_notes: true
          fail_on_unmatched_files: true
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}
          files: |
            dist/*.exe
            dist/hlid-checksums.txt