name: Release

on:
  push:
    tags: ['v*']
  # Manual cross-build dry-run: trigger on a release/* branch BEFORE tagging to
  # validate all three targets — notably aarch64-apple-darwin, which PR CI
  # never builds, so a platform-specific break is invisible until the tag (the
  # v1.46.0 darwin failure). Builds + uploads artifacts but does NOT publish a
  # release (that job is gated on a tag ref below).
  workflow_dispatch:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            runner: ubuntu-24.04
            archive: tar.gz
          # x86_64-apple-darwin dropped: ort-sys has no prebuilt binaries for Intel Mac
          # Intel Mac users can build from source: cargo install cqs
          - target: aarch64-apple-darwin
            runner: macos-latest
            archive: tar.gz
          - target: x86_64-pc-windows-msvc
            runner: windows-latest
            archive: zip
    steps:
      - uses: actions/checkout@v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      # Building each target on its native runner catches the hard-error class
      # of sibling-target break — notably the E0277 unsized-binding that failed
      # the v1.46.0 aarch64-apple-darwin build, invisible to Linux-only PR CI.
      # Fire this workflow via workflow_dispatch on the release branch before
      # tagging to validate. NB: this does NOT enforce `-D warnings` — Windows
      # currently carries a large dead_code backlog of daemon-client code that is
      # live only via the (unix-only) socket path and awaits the named-pipe
      # transport. Enforcing warnings here is deferred until that is swept; the
      # hard-error gate is what guards the actual "release skips a binary" risk.
      - name: Build release binary
        run: cargo build --release --target ${{ matrix.target }}

      - name: Package archive
        shell: bash
        run: |
          # Sanitize: on a workflow_dispatch dry-run GITHUB_REF_NAME is a branch
          # (e.g. release/v1.2.3) whose '/' would break archive filenames; on a
          # tag it is already slash-free, so this is a no-op for real releases.
          VERSION="${GITHUB_REF_NAME//\//-}"
          STAGING="cqs-${VERSION}-${{ matrix.target }}"
          mkdir -p "${STAGING}"

          if [ "${{ matrix.runner }}" = "windows-latest" ]; then
            cp "target/${{ matrix.target }}/release/cqs.exe" "${STAGING}/cqs.exe"
          else
            cp "target/${{ matrix.target }}/release/cqs" "${STAGING}/cqs"
          fi

          for f in README.md LICENSE; do
            [ -f "$f" ] && cp "$f" "${STAGING}/"
          done

          ARCHIVE="cqs-${VERSION}-${{ matrix.target }}.${{ matrix.archive }}"
          if [ "${{ matrix.archive }}" = "zip" ]; then
            7z a "${ARCHIVE}" "${STAGING}"
          else
            tar czf "${ARCHIVE}" "${STAGING}"
          fi

          echo "ARCHIVE=${ARCHIVE}" >> "$GITHUB_ENV"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: cqs-${{ matrix.target }}
          path: ${{ env.ARCHIVE }}
          if-no-files-found: error

  release:
    name: Create GitHub Release
    needs: build
    # Only a tag push publishes a release; a workflow_dispatch dry-run stops
    # after the cross-build (validation only).
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v5

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: cqs-*
          merge-multiple: true
          path: artifacts

      - name: Generate checksums
        working-directory: artifacts
        run: |
          VERSION="${GITHUB_REF_NAME}"
          sha256sum cqs-${VERSION}-* > "cqs-${VERSION}-checksums-sha256.txt"
          echo "## SHA256 Checksums"
          cat "cqs-${VERSION}-checksums-sha256.txt"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          generate_release_notes: true
          draft: false
          prerelease: false
          files: artifacts/*
