release.yml

name: Release Matrix

on:
  workflow_dispatch:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  build:
    name: Build ${{ matrix.name }}
    runs-on: ${{ matrix.os }}
    permissions:
      attestations: write
      contents: read
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux-x64
            os: ubuntu-latest
            artifact: deepseek-linux-x64
            binary: ./target/release/deepseek
            npm_platform: linux-x64
          - name: macos-x64
            os: macos-13
            artifact: deepseek-macos-x64
            binary: ./target/release/deepseek
            npm_platform: macos-x64
          - name: macos-arm64
            os: macos-14
            artifact: deepseek-macos-arm64
            binary: ./target/release/deepseek
            npm_platform: macos-arm64
          - name: windows-x64
            os: windows-latest
            artifact: deepseek-windows-x64
            binary: ./target/release/deepseek.exe
            npm_platform: windows-x64
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Format Check
        run: cargo fmt --check

      - name: Test
        run: cargo test -- --test-threads=1

      - name: Build Release Binary
        run: cargo build --release --bin deepseek

      - name: Verify Release Binary
        run: ${{ matrix.binary }} version

      - name: Package Release
        run: ${{ matrix.binary }} update package --bin ${{ matrix.binary }} --out dist

      - name: Archive Unix Release Package
        if: runner.os != 'Windows'
        run: |
          package_dir="$(find dist -mindepth 1 -maxdepth 1 -type d | head -n 1)"
          tar -czf "${{ matrix.artifact }}.tar.gz" -C "$package_dir" .

      - name: Checksum Unix Release Package
        if: runner.os != 'Windows'
        run: shasum -a 256 "${{ matrix.artifact }}.tar.gz" > "${{ matrix.artifact }}.tar.gz.sha256"

      - name: Archive Windows Release Package
        if: runner.os == 'Windows'
        run: Compress-Archive -Path dist\* -DestinationPath "${{ matrix.artifact }}.zip"

      - name: Checksum Windows Release Package
        if: runner.os == 'Windows'
        run: |
          $hash = Get-FileHash "${{ matrix.artifact }}.zip" -Algorithm SHA256
          "$($hash.Hash.ToLower())  ${{ matrix.artifact }}.zip" | Set-Content "${{ matrix.artifact }}.zip.sha256"

      - name: Attest Release Package
        uses: actions/attest@v4
        with:
          subject-path: ${{ matrix.artifact }}.*

      - name: Upload Release Package
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: ${{ matrix.artifact }}.*

      - name: Stage npm Platform Package
        run: node npm/scripts/stage-platform-package.js --platform ${{ matrix.npm_platform }} --binary ${{ matrix.binary }}

      - name: Verify npm Platform Package Binary
        run: node npm/scripts/verify-platform-package.js --platform ${{ matrix.npm_platform }}

      - name: Prepare npm Artifact Directory
        run: |
          node -e "require('fs').mkdirSync('dist-npm', { recursive: true })"

      - name: Pack npm Platform Package
        working-directory: npm/platforms/${{ matrix.npm_platform }}
        run: npm pack --pack-destination ../../../dist-npm

      - name: Upload npm Platform Package
        uses: actions/upload-artifact@v4
        with:
          name: npm-deepseek-${{ matrix.npm_platform }}
          path: dist-npm/*.tgz

  packaging:
    name: Packaging Checks
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cargo Metadata
        run: cargo metadata --no-deps --format-version 1

      - name: Cargo Package Verify
        run: cargo package

      - name: Version Sync Check
        run: node npm/scripts/check-version-sync.js

      - name: npm Wrapper Tests
        working-directory: npm
        run: npm test

      - name: npm Dry Pack
        working-directory: npm
        run: npm pack --dry-run

      - name: npm Platform Dry Packs
        run: |
          for package_dir in npm/platforms/*; do
            (cd "$package_dir" && npm pack --dry-run)
          done

      - name: Homebrew Formula Syntax
        run: ruby -c packaging/homebrew/deepseek.rb

      - name: Homebrew Formula Render Smoke
        run: |
          mkdir -p target/homebrew-shas
          printf '%064d  deepseek-linux-x64.tar.gz\n' 1 > target/homebrew-shas/deepseek-linux-x64.tar.gz.sha256
          printf '%064d  deepseek-macos-x64.tar.gz\n' 2 > target/homebrew-shas/deepseek-macos-x64.tar.gz.sha256
          printf '%064d  deepseek-macos-arm64.tar.gz\n' 3 > target/homebrew-shas/deepseek-macos-arm64.tar.gz.sha256
          cargo run --bin deepseek -- update homebrew-formula --version 0.1.0 --repo willamhou/DeepSeekCode --dist target/homebrew-shas --formula packaging/homebrew/deepseek.rb --out target/deepseek.rb
          ruby -c target/deepseek.rb

      - name: Docker Artifact Smoke
        run: |
          docker build -t deepseek-code:ci .
          docker run --rm deepseek-code:ci version

      - name: Runtime Service Template Smoke
        run: cargo run --bin deepseek -- agents service --kind all --out target/service-smoke --bin deepseek --workdir "$PWD"

  publish-github-release:
    name: Publish GitHub Release
    runs-on: ubuntu-latest
    needs:
      - build
      - packaging
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: write
    steps:
      - name: Download Release Artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: deepseek-*
          path: dist-assets
          merge-multiple: true

      - name: Write Release Notes
        run: |
          {
            echo "# DeepSeekCode ${GITHUB_REF_NAME}"
            echo
            echo "Automated release generated from ${GITHUB_SHA}."
            echo
            echo "Artifacts include Linux x64, macOS x64, macOS arm64, and Windows x64 packages plus SHA-256 checksum files."
            echo "Docker image target: ghcr.io/${GITHUB_REPOSITORY,,}:${GITHUB_REF_NAME#v} (also :${GITHUB_REF_NAME} and :latest)."
            echo
            echo "Verification gates completed in this workflow:"
            echo "- cargo fmt --check"
            echo "- cargo test -- --test-threads=1"
            echo "- cargo package"
            echo "- package version sync"
            echo "- npm wrapper tests and root/platform dry packs"
            echo "- staged npm platform binary smoke"
            echo "- Homebrew formula syntax and render smoke"
            echo "- Docker artifact smoke"
            echo "- runtime service template smoke"
          } > release-notes.md

      - name: Publish Release Assets
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if gh release view "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
            gh release edit "${GITHUB_REF_NAME}" --title "DeepSeekCode ${GITHUB_REF_NAME}" --notes-file release-notes.md --repo "${GITHUB_REPOSITORY}"
            gh release upload "${GITHUB_REF_NAME}" dist-assets/* --clobber --repo "${GITHUB_REPOSITORY}"
          else
            gh release create "${GITHUB_REF_NAME}" dist-assets/* --verify-tag --title "DeepSeekCode ${GITHUB_REF_NAME}" --notes-file release-notes.md --repo "${GITHUB_REPOSITORY}"
          fi

  publish-docker:
    name: Publish Docker Image
    runs-on: ubuntu-latest
    needs:
      - build
      - packaging
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Verify Tag Matches Cargo Version
        run: |
          version="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n 1)"
          test "v${version}" = "${GITHUB_REF_NAME}"

      - name: Set Docker Metadata
        id: docker
        run: |
          image="ghcr.io/${GITHUB_REPOSITORY,,}"
          version="${GITHUB_REF_NAME#v}"
          echo "image=${image}" >> "${GITHUB_OUTPUT}"
          echo "version=${version}" >> "${GITHUB_OUTPUT}"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and Push Docker Image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ steps.docker.outputs.image }}:${{ steps.docker.outputs.version }}
            ${{ steps.docker.outputs.image }}:${{ github.ref_name }}
            ${{ steps.docker.outputs.image }}:latest
          labels: |
            org.opencontainers.image.title=DeepSeekCode
            org.opencontainers.image.description=DeepSeek-first terminal code agent
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ steps.docker.outputs.version }}

  publish-crates:
    name: Cargo Registry Policy
    runs-on: ubuntu-latest
    needs:
      - packaging
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Verify Tag Matches Cargo Version
        run: |
          version="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n 1)"
          test "v${version}" = "${GITHUB_REF_NAME}"

      - name: Apply Cargo Registry Policy
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          if grep -q '^publish = false' Cargo.toml; then
            echo "Cargo.toml sets publish = false; DeepSeekCode is source-build/package-only for Cargo registry distribution."
            exit 0
          fi
          if [ -z "${CARGO_REGISTRY_TOKEN}" ]; then
            echo "CARGO_REGISTRY_TOKEN is not configured; skipping crates.io publish."
            exit 0
          fi
          cargo publish --token "${CARGO_REGISTRY_TOKEN}"

  publish-npm:
    name: Publish npm Packages
    runs-on: ubuntu-latest
    needs:
      - build
      - packaging
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          registry-url: "https://registry.npmjs.org"

      - name: Verify Tag Matches npm Version
        run: |
          version="$(node -p "require('./npm/package.json').version")"
          test "v${version}" = "${GITHUB_REF_NAME}"

      - name: Download npm Platform Packages
        uses: actions/download-artifact@v4
        with:
          pattern: npm-deepseek-*
          path: npm-dist
          merge-multiple: true

      - name: Publish npm Packages
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          if [ -z "${NODE_AUTH_TOKEN}" ]; then
            echo "NPM_TOKEN is not configured; skipping npm publish."
            exit 0
          fi
          test -n "$(find npm-dist -name '*.tgz' -print -quit)"
          for package in npm-dist/*.tgz; do
            npm publish "$package" --access public
          done
          (cd npm && npm publish --access public)

  publish-homebrew-tap:
    name: Publish Homebrew Tap
    runs-on: ubuntu-latest
    needs:
      - build
      - packaging
      - publish-github-release
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: read
    steps:
      - name: Check Homebrew Tap Configuration
        id: tap
        env:
          TAP_REPOSITORY: ${{ vars.HOMEBREW_TAP_REPOSITORY }}
          TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          if [ -z "${TAP_REPOSITORY}" ] || [ -z "${TAP_TOKEN}" ]; then
            echo "publish=false" >> "${GITHUB_OUTPUT}"
            echo "HOMEBREW_TAP_REPOSITORY or HOMEBREW_TAP_TOKEN is not configured; skipping Homebrew tap publish."
          else
            echo "publish=true" >> "${GITHUB_OUTPUT}"
          fi

      - name: Checkout
        if: steps.tap.outputs.publish == 'true'
        uses: actions/checkout@v4

      - name: Install Rust
        if: steps.tap.outputs.publish == 'true'
        uses: dtolnay/rust-toolchain@stable

      - name: Download Release Checksums
        if: steps.tap.outputs.publish == 'true'
        uses: actions/download-artifact@v4
        with:
          pattern: deepseek-*
          path: dist-assets
          merge-multiple: true

      - name: Render Homebrew Formula
        if: steps.tap.outputs.publish == 'true'
        run: |
          version="${GITHUB_REF_NAME#v}"
          cargo run --bin deepseek -- update homebrew-formula --version "${version}" --repo "${GITHUB_REPOSITORY}" --dist dist-assets --formula packaging/homebrew/deepseek.rb --out target/deepseek.rb
          ruby -c target/deepseek.rb

      - name: Checkout Homebrew Tap
        if: steps.tap.outputs.publish == 'true'
        uses: actions/checkout@v4
        with:
          repository: ${{ vars.HOMEBREW_TAP_REPOSITORY }}
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: homebrew-tap

      - name: Commit Homebrew Formula
        if: steps.tap.outputs.publish == 'true'
        run: |
          mkdir -p homebrew-tap/Formula
          cp target/deepseek.rb homebrew-tap/Formula/deepseek.rb
          cd homebrew-tap
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          if [ -z "$(git status --porcelain -- Formula/deepseek.rb)" ]; then
            echo "Homebrew tap formula is already up to date."
            exit 0
          fi
          git add Formula/deepseek.rb
          git commit -m "Update deepseek ${GITHUB_REF_NAME}"
          git push