release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to release (for example: v1.2.3)"
        required: true
        type: string
      enable_signing_hooks:
        description: "Run optional signing hooks when hook scripts are present"
        required: false
        default: false
        type: boolean
      enable_notarization_hooks:
        description: "Run optional macOS notarization hook when hook script is present"
        required: false
        default: false
        type: boolean

permissions:
  contents: write
  attestations: write
  id-token: write
  packages: write

env:
  CARGO_TERM_COLOR: always
  APP_NAME: tau-coding-agent
  RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }}
  ENABLE_SIGNING_HOOKS: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.enable_signing_hooks || vars.RELEASE_ENABLE_SIGNING_HOOKS || 'false' }}
  ENABLE_NOTARIZATION_HOOKS: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.enable_notarization_hooks || vars.RELEASE_ENABLE_NOTARIZATION_HOOKS || 'false' }}

jobs:
  build:
    name: Build (${{ matrix.platform }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            platform: linux-amd64
            archive_ext: tar.gz
            smoke_mode: run
            smoke_reason: native_arch
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            platform: linux-arm64
            archive_ext: tar.gz
            smoke_mode: skip
            smoke_reason: cross_arch_linux_arm64_on_amd64_runner
          - os: macos-14
            target: x86_64-apple-darwin
            platform: macos-amd64
            archive_ext: tar.gz
            smoke_mode: skip
            smoke_reason: cross_arch_macos_amd64_on_arm64_runner
          - os: macos-14
            target: aarch64-apple-darwin
            platform: macos-arm64
            archive_ext: tar.gz
            smoke_mode: run
            smoke_reason: native_arch
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            platform: windows-amd64
            archive_ext: zip
            smoke_mode: run
            smoke_reason: native_arch
          - os: windows-latest
            target: aarch64-pc-windows-msvc
            platform: windows-arm64
            archive_ext: zip
            smoke_mode: skip
            smoke_reason: cross_arch_windows_arm64_on_amd64_runner

    steps:
      - name: Checkout tag
        uses: actions/checkout@v6
        with:
          ref: ${{ env.RELEASE_TAG }}

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install Linux ARM64 linker
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        shell: bash
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install --yes gcc-aarch64-linux-gnu

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2

      - name: Build/package/smoke (Unix)
        if: runner.os != 'Windows'
        shell: bash
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: ${{ matrix.target == 'aarch64-unknown-linux-gnu' && 'aarch64-linux-gnu-gcc' || '' }}
        run: |
          set -euo pipefail
          cargo build --release -p "${APP_NAME}" --target "${{ matrix.target }}"

          mkdir -p dist
          binary_path="target/${{ matrix.target }}/release/${APP_NAME}"
          packaged_binary="dist/${APP_NAME}-${{ matrix.platform }}"

          cp "${binary_path}" "${packaged_binary}"
          chmod +x "${packaged_binary}"

          if [[ "${ENABLE_SIGNING_HOOKS}" == "true" ]]; then
            if [[ "${RUNNER_OS}" == "Linux" ]]; then
              hook_path="scripts/release/hooks/sign-linux.sh"
            else
              hook_path="scripts/release/hooks/sign-macos.sh"
            fi

            if [[ -x "${hook_path}" ]]; then
              "${hook_path}" "${packaged_binary}" "${{ matrix.target }}" "${RELEASE_TAG}"
            else
              echo "release_hook_reason=sign_hook_missing hook=${hook_path}"
            fi
          else
            echo "release_hook_reason=sign_hooks_disabled"
          fi

          if [[ "${{ matrix.smoke_mode }}" == "run" ]]; then
            # Smoke test gate: artifact must execute and print help before publish.
            "${packaged_binary}" --help > /dev/null
          else
            echo "release_smoke_reason=${{ matrix.smoke_reason }}"
          fi

          archive_path="dist/${APP_NAME}-${{ matrix.platform }}.tar.gz"
          tar -czf "${archive_path}" -C dist "${APP_NAME}-${{ matrix.platform }}"

          if [[ "${RUNNER_OS}" == "macOS" && "${ENABLE_NOTARIZATION_HOOKS}" == "true" ]]; then
            hook_path="scripts/release/hooks/notarize-macos.sh"
            if [[ -x "${hook_path}" ]]; then
              "${hook_path}" "${archive_path}" "${{ matrix.target }}" "${RELEASE_TAG}"
            else
              echo "release_hook_reason=notarize_hook_missing hook=${hook_path}"
            fi
          elif [[ "${RUNNER_OS}" == "macOS" ]]; then
            echo "release_hook_reason=notarization_hooks_disabled"
          fi

      - name: Build/package/smoke (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          cargo build --release -p "$env:APP_NAME" --target "${{ matrix.target }}"

          New-Item -ItemType Directory -Force dist | Out-Null
          $binaryPath = "target\\${{ matrix.target }}\\release\\$env:APP_NAME.exe"
          $packagedBinary = "dist\\$env:APP_NAME-${{ matrix.platform }}.exe"

          Copy-Item "$binaryPath" "$packagedBinary"

          if ($env:ENABLE_SIGNING_HOOKS -eq "true") {
            $hookPath = "scripts/release/hooks/sign-windows.ps1"
            if (Test-Path $hookPath) {
              & $hookPath -BinaryPath "$packagedBinary" -Target "${{ matrix.target }}" -Tag "$env:RELEASE_TAG"
            } else {
              Write-Output "release_hook_reason=sign_hook_missing hook=$hookPath"
            }
          } else {
            Write-Output "release_hook_reason=sign_hooks_disabled"
          }

          if ("${{ matrix.smoke_mode }}" -eq "run") {
            # Smoke test gate: artifact must execute and print help before publish.
            & "$packagedBinary" --help | Out-Null
          } else {
            Write-Output "release_smoke_reason=${{ matrix.smoke_reason }}"
          }

          Compress-Archive -Path "$packagedBinary" -DestinationPath "dist\\$env:APP_NAME-${{ matrix.platform }}.zip" -Force

      - name: Upload release artifact
        uses: actions/upload-artifact@v6
        with:
          name: release-${{ matrix.platform }}
          if-no-files-found: error
          path: dist/${{ env.APP_NAME }}-${{ matrix.platform }}.${{ matrix.archive_ext }}

  checksums:
    name: Generate checksums
    runs-on: ubuntu-latest
    needs:
      - build
    steps:
      - name: Download release artifacts
        uses: actions/download-artifact@v7
        with:
          pattern: release-*
          merge-multiple: true
          path: dist

      - name: Generate checksum manifests
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          artifacts=(dist/*.tar.gz dist/*.zip)
          if [[ ${#artifacts[@]} -eq 0 ]]; then
            echo "::error::no release archives were downloaded"
            exit 1
          fi

          for artifact in "${artifacts[@]}"; do
            sha256sum "${artifact}" > "${artifact}.sha256"
          done
          sha256sum "${artifacts[@]}" > dist/SHA256SUMS

      - name: Upload checksum artifacts
        uses: actions/upload-artifact@v6
        with:
          name: release-checksums
          if-no-files-found: error
          path: |
            dist/*.sha256
            dist/SHA256SUMS

  publish:
    name: Publish release
    runs-on: ubuntu-latest
    needs:
      - build
      - checksums
    steps:
      - name: Checkout tag
        uses: actions/checkout@v6
        with:
          ref: ${{ env.RELEASE_TAG }}

      - name: Download release artifacts
        uses: actions/download-artifact@v7
        with:
          pattern: release-*
          merge-multiple: true
          path: dist

      - name: Download checksums for Homebrew formula
        uses: actions/download-artifact@v7
        with:
          name: release-checksums
          path: dist

      - name: Render Homebrew formula
        shell: bash
        run: |
          set -euo pipefail
          scripts/release/render-homebrew-formula.sh \
            "${RELEASE_TAG}" \
            dist/SHA256SUMS \
            "${GITHUB_REPOSITORY}" > dist/tau.rb

      - name: Generate shell completions
        shell: bash
        run: |
          set -euo pipefail
          tar -xzf "dist/${APP_NAME}-linux-amd64.tar.gz" -C dist
          chmod +x "dist/${APP_NAME}-linux-amd64"
          scripts/release/generate-shell-completions.sh \
            "dist/${APP_NAME}-linux-amd64" \
            dist/completions

      - name: Verify staged files
        shell: bash
        run: |
          set -euo pipefail
          ls -la dist

      - name: Attest release artifacts
        uses: actions/attest-build-provenance@v3
        with:
          subject-path: |
            dist/*.tar.gz
            dist/*.zip
            dist/*.sha256
            dist/SHA256SUMS
            dist/tau.rb
            dist/completions/tau-coding-agent.bash
            dist/completions/tau-coding-agent.zsh
            dist/completions/tau-coding-agent.fish

      - name: Publish release assets
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          generate_release_notes: true
          files: |
            dist/*.tar.gz
            dist/*.zip
            dist/*.sha256
            dist/SHA256SUMS
            dist/tau.rb
            dist/completions/tau-coding-agent.bash
            dist/completions/tau-coding-agent.zsh
            dist/completions/tau-coding-agent.fish

  publish-container:
    name: Publish container image
    runs-on: ubuntu-latest
    needs:
      - publish
    steps:
      - name: Checkout tag
        uses: actions/checkout@v6
        with:
          ref: ${{ env.RELEASE_TAG }}

      - name: Compute image metadata
        id: image_meta
        shell: bash
        run: |
          set -euo pipefail
          owner_lowercase="${GITHUB_REPOSITORY_OWNER,,}"
          echo "image_repository=ghcr.io/${owner_lowercase}/${APP_NAME}" >> "$GITHUB_OUTPUT"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Build and publish container image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          push: true
          platforms: linux/amd64,linux/arm64
          tags: |
            ${{ steps.image_meta.outputs.image_repository }}:${{ env.RELEASE_TAG }}
            ${{ steps.image_meta.outputs.image_repository }}:latest

      - name: Release summary
        shell: bash
        run: |
          {
            echo "### Container Publish"
            echo "- Repository: ${{ steps.image_meta.outputs.image_repository }}"
            echo "- Tags:"
            echo "  - ${{ env.RELEASE_TAG }}"
            echo "  - latest"
            echo "- Platforms: linux/amd64,linux/arm64"
          } >> "$GITHUB_STEP_SUMMARY"