name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  test:
    name: Run Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Run tests
        run: cargo test --verbose --all-features

  release:
    needs: test
    name: Release - ${{ matrix.platform.release_for }}
    runs-on: ${{ matrix.platform.os }}
    strategy:
      matrix:
        platform:
          - release_for: Linux-x86_64
            os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            binary_path: target/x86_64-unknown-linux-gnu/release/secrets
            asset_name: secrets-linux-x86_64

          - release_for: Linux-x86_64-musl
            os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            binary_path: target/x86_64-unknown-linux-musl/release/secrets
            asset_name: secrets-linux-x86_64-musl

          - release_for: macOS-x86_64
            os: macos-15
            target: x86_64-apple-darwin
            binary_path: target/x86_64-apple-darwin/release/secrets
            asset_name: secrets-macos-x86_64

          - release_for: macOS-aarch64
            os: macos-14
            target: aarch64-apple-darwin
            binary_path: target/aarch64-apple-darwin/release/secrets
            asset_name: secrets-macos-aarch64

          - release_for: Windows-x86_64
            os: windows-latest
            target: x86_64-pc-windows-msvc
            binary_path: target/x86_64-pc-windows-msvc/release/secrets.exe
            asset_name: secrets-windows-x86_64.exe

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.platform.target }}

      - name: Install build dependencies (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y pkg-config perl make

      - name: Install musl tools
        if: matrix.platform.target == 'x86_64-unknown-linux-musl'
        run: sudo apt-get install -y musl-tools

      - name: Build
        run: cargo build --release --target ${{ matrix.platform.target }}

      - name: Strip binary (Linux/macOS)
        if: runner.os != 'Windows'
        run: strip ${{ matrix.platform.binary_path }}

      - name: Generate SHA256 checksums
        shell: bash
        if: runner.os != 'Windows'
        run: |
          shasum -a 256 ${{ matrix.platform.binary_path }} > ${{ matrix.platform.asset_name }}.sha256

      - name: Generate SHA256 checksums (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $hash = Get-FileHash ${{ matrix.platform.binary_path }} -Algorithm SHA256
          $hash.Hash > ${{ matrix.platform.asset_name }}.sha256

      - name: Upload binaries to release
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: ${{ matrix.platform.binary_path }}
          asset_name: ${{ matrix.platform.asset_name }}
          tag: ${{ github.ref }}
          overwrite: true

      - name: Upload SHA256 checksums
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: ${{ matrix.platform.asset_name }}.sha256
          asset_name: ${{ matrix.platform.asset_name }}.sha256
          tag: ${{ github.ref }}
          overwrite: true

  release-summary:
    name: Generate Release Summary
    needs: release
    runs-on: ubuntu-latest
    if: always()

    steps:
      - name: Generate release summary
        run: |
          echo "# 🚀 Release ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "## 📦 Download Binaries" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Platform | Binary | SHA256 |" >> $GITHUB_STEP_SUMMARY
          echo "|----------|--------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| Linux x86_64 | [secrets-linux-x86_64](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/secrets-linux-x86_64) | [checksum](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/secrets-linux-x86_64.sha256) |" >> $GITHUB_STEP_SUMMARY
          echo "| Linux x86_64 (musl) | [secrets-linux-x86_64-musl](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/secrets-linux-x86_64-musl) | [checksum](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/secrets-linux-x86_64-musl.sha256) |" >> $GITHUB_STEP_SUMMARY
          echo "| macOS (Intel) | [secrets-macos-x86_64](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/secrets-macos-x86_64) | [checksum](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/secrets-macos-x86_64.sha256) |" >> $GITHUB_STEP_SUMMARY
          echo "| macOS (Apple Silicon) | [secrets-macos-aarch64](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/secrets-macos-aarch64) | [checksum](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/secrets-macos-aarch64.sha256) |" >> $GITHUB_STEP_SUMMARY
          echo "| Windows x86_64 | [secrets-windows-x86_64.exe](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/secrets-windows-x86_64.exe) | [checksum](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/secrets-windows-x86_64.exe.sha256) |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "## 📋 Installation" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### macOS (Homebrew):" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo '```bash' >> $GITHUB_STEP_SUMMARY
          echo "brew install frankwiles/tools/kube-secrets" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Manual installation:" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo '```bash' >> $GITHUB_STEP_SUMMARY
          echo "# Download the binary for your platform above" >> $GITHUB_STEP_SUMMARY
          echo "chmod +x secrets  # or secrets.exe on Windows" >> $GITHUB_STEP_SUMMARY
          echo "mv secrets /usr/local/bin/  # or add to PATH" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo '### Verify checksum:' >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo '```bash' >> $GITHUB_STEP_SUMMARY
          echo "# On Linux/macOS:" >> $GITHUB_STEP_SUMMARY
          echo 'shasum -a 256 -c secrets-*.sha256' >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "# On Windows:" >> $GITHUB_STEP_SUMMARY
          echo 'Get-FileHash secrets.exe -Algorithm SHA256' >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
