name: Release

on:
  push:
    tags: ["v*"]

permissions: read-all

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  SQLX_OFFLINE: true
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  server:
    name: Server (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    strategy:
      matrix:
        include:
          - arch: x86_64
            target: x86_64-unknown-linux-musl
            runner: ubuntu-latest
          - arch: aarch64
            target: aarch64-unknown-linux-musl
            runner: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          key: release-server-${{ matrix.arch }}
          save-if: true
      - name: Install musl tools
        run: sudo apt-get update && sudo apt-get install -y musl-tools
      - name: Build server
        run: cargo build --release --bin ccag-server --target ${{ matrix.target }} --locked
      - name: Package
        run: |
          cd target/${{ matrix.target }}/release
          tar czf ../../../ccag-server-linux-${{ matrix.arch }}.tar.gz ccag-server
      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: server-${{ matrix.arch }}
          path: ccag-server-linux-${{ matrix.arch }}.tar.gz

  cli:
    name: CLI (${{ matrix.os }}-${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: linux
            arch: x86_64
            target: x86_64-unknown-linux-musl
            runner: ubuntu-latest
          - os: linux
            arch: aarch64
            target: aarch64-unknown-linux-musl
            runner: ubuntu-24.04-arm
          - os: darwin
            arch: x86_64
            target: x86_64-apple-darwin
            runner: macos-latest
          - os: darwin
            arch: aarch64
            target: aarch64-apple-darwin
            runner: macos-latest
          - os: windows
            arch: x86_64
            target: x86_64-pc-windows-msvc
            runner: windows-latest
          - os: windows
            arch: aarch64
            target: aarch64-pc-windows-msvc
            runner: windows-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          key: release-cli-${{ matrix.os }}-${{ matrix.arch }}
          workspaces: cli
          save-if: true
      - name: Install musl tools
        if: matrix.os == 'linux'
        run: sudo apt-get update && sudo apt-get install -y musl-tools
      - name: Build CLI
        run: cargo build --release --package ccag-cli --target ${{ matrix.target }} --locked
      - name: Package (Unix)
        if: matrix.os != 'windows'
        run: |
          cd target/${{ matrix.target }}/release
          tar czf ../../../ccag-cli-${{ matrix.os }}-${{ matrix.arch }}.tar.gz ccag
      - name: Package (Windows)
        if: matrix.os == 'windows'
        shell: pwsh
        run: |
          Compress-Archive -Path "target/${{ matrix.target }}/release/ccag.exe" -DestinationPath "ccag-cli-windows-${{ matrix.arch }}.zip"
      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: cli-${{ matrix.os }}-${{ matrix.arch }}
          path: ccag-cli-${{ matrix.os }}-${{ matrix.arch }}.*

  docker:
    name: Docker Image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    needs: [server]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: server-*
          merge-multiple: true
      - name: Prepare binaries
        run: |
          mkdir -p build/linux/amd64 build/linux/arm64
          tar xzf ccag-server-linux-x86_64.tar.gz -C build/linux/amd64
          tar xzf ccag-server-linux-aarch64.tar.gz -C build/linux/arm64
          chmod +x build/linux/amd64/ccag-server build/linux/arm64/ccag-server
      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
      - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
        id: meta
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable={{is_default_branch}}
      - uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
        with:
          context: .
          file: Dockerfile.release
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: mode=max

  release:
    name: GitHub Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    needs: [server, cli, docker]
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: "{server,cli}-*"
          merge-multiple: true
      - name: Generate checksums
        run: sha256sum ccag-*.tar.gz ccag-*.zip > checksums-sha256.txt 2>/dev/null || sha256sum ccag-*.tar.gz > checksums-sha256.txt
      - uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2
        with:
          generate_release_notes: true
          files: |
            ccag-*.tar.gz
            ccag-*.zip
            checksums-sha256.txt

  publish-crates:
    name: Publish to crates.io
    runs-on: ubuntu-latest
    needs: [release]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
      - name: Publish ccag (server)
        run: cargo publish --package ccag --locked
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      - name: Publish ccag-cli
        run: cargo publish --package ccag-cli --locked
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
