release-cli.yml

name: Release CLI Binaries

on:
  push:
    tags:
      - 'cli/v*'

permissions:
  contents: write

jobs:
  verify-version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.extract.outputs.version }}
    steps:
      - uses: actions/checkout@v4

      - name: Extract version from tag
        id: extract
        run: |
          TAG="${GITHUB_REF#refs/tags/cli/v}"
          echo "version=$TAG" >> $GITHUB_OUTPUT

      - name: Check Cargo.toml versions match tag
        run: |
          TAG_VERSION="${{ steps.extract.outputs.version }}"
          for dir in jacs jacs-mcp jacs-cli; do
            CARGO_VERSION=$(grep '^version = ' $dir/Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
            echo "$dir version: $CARGO_VERSION, tag: $TAG_VERSION"
            if [ "$CARGO_VERSION" != "$TAG_VERSION" ]; then
              echo "::error::Version mismatch! $dir/Cargo.toml has $CARGO_VERSION but tag is $TAG_VERSION"
              exit 1
            fi
          done

  build:
    needs: verify-version
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            target: aarch64-apple-darwin
            asset_suffix: darwin-arm64
            archive_ext: tar.gz
          - os: macos-14
            target: x86_64-apple-darwin
            asset_suffix: darwin-x64
            archive_ext: tar.gz
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            asset_suffix: linux-x64
            archive_ext: tar.gz
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            asset_suffix: linux-arm64
            archive_ext: tar.gz
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            asset_suffix: windows-x64
            archive_ext: zip

    runs-on: ${{ matrix.os }}
    env:
      VERSION: ${{ needs.verify-version.outputs.version }}
      CLI_ASSET_NAME: jacs-cli-${{ needs.verify-version.outputs.version }}-${{ matrix.asset_suffix }}
    steps:
      - uses: actions/checkout@v4
        if: runner.os != 'Windows'

      - name: Stage source tree (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          $ErrorActionPreference = 'Stop'
          $archive = Join-Path $env:RUNNER_TEMP 'jacs-cli-source.tar.gz'
          $manifest = Join-Path $env:RUNNER_TEMP 'jacs-cli-source-files.txt'
          $workspace = $env:GITHUB_WORKSPACE

          Invoke-WebRequest `
            -Headers @{ Authorization = "Bearer $env:GITHUB_TOKEN"; "X-GitHub-Api-Version" = "2022-11-28" } `
            -Uri "https://api.github.com/repos/$env:GITHUB_REPOSITORY/tarball/$env:GITHUB_SHA" `
            -OutFile $archive

          $entries = tar -tf $archive
          $prefix = ($entries | Select-Object -First 1).TrimEnd('/')

          $requiredFiles = $entries | Where-Object {
            $_ -eq "$prefix/Cargo.toml" -or
            $_ -eq "$prefix/Cargo.lock" -or
            $_ -eq "$prefix/README.md" -or
            $_ -eq "$prefix/LICENSE" -or
            $_ -eq "$prefix/binding-core/Cargo.toml" -or
            $_ -eq "$prefix/jacs/Cargo.toml" -or
            $_ -eq "$prefix/jacs/README.md" -or
            $_ -eq "$prefix/jacs/LICENSE" -or
            $_ -eq "$prefix/jacs/build.rs" -or
            $_ -like "$prefix/jacs/benches/*" -or
            $_ -like "$prefix/jacs/examples/*.rs" -or
            $_ -like "$prefix/jacs/examples/*.json" -or
            $_ -eq "$prefix/jacs-cli/Cargo.toml" -or
            $_ -eq "$prefix/jacs-mcp/Cargo.toml" -or
            $_ -eq "$prefix/jacs-mcp/README.md" -or
            $_ -eq "$prefix/jacsnpm/Cargo.toml" -or
            $_ -eq "$prefix/jacsnpm/src/lib.rs" -or
            $_ -eq "$prefix/jacspy/Cargo.toml" -or
            $_ -eq "$prefix/jacspy/src/lib.rs" -or
            $_ -eq "$prefix/jacsgo/lib/Cargo.toml" -or
            $_ -eq "$prefix/jacsgo/lib/src/lib.rs" -or
            $_ -eq "$prefix/jacs-duckdb/Cargo.toml" -or
            $_ -like "$prefix/jacs-duckdb/src/*" -or
            $_ -eq "$prefix/jacs-redb/Cargo.toml" -or
            $_ -like "$prefix/jacs-redb/src/*" -or
            $_ -eq "$prefix/jacs-surrealdb/Cargo.toml" -or
            $_ -like "$prefix/jacs-surrealdb/src/*" -or
            $_ -eq "$prefix/jacs-postgresql/Cargo.toml" -or
            $_ -like "$prefix/jacs-postgresql/src/*" -or
            $_ -like "$prefix/binding-core/src/*" -or
            $_ -like "$prefix/jacs/src/*" -or
            $_ -like "$prefix/jacs/schemas/*" -or
            $_ -like "$prefix/jacs-cli/src/*" -or
            $_ -like "$prefix/jacs-mcp/src/*"
          }

          if (-not $requiredFiles) {
            throw 'Failed to determine the Windows source file subset for CLI builds.'
          }

          $requiredFiles | Set-Content -Path $manifest
          tar -xf $archive -C $workspace --strip-components 1 -T $manifest

      - name: Install system dependencies (D-Bus for keychain support)
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev pkg-config

      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: '1.93'
          targets: ${{ matrix.target }}

      - name: Build binaries
        run: |
          cargo build --release -p jacs-cli --target ${{ matrix.target }}

      - name: Smoke test (Unix)
        if: runner.os != 'Windows'
        run: |
          ./target/${{ matrix.target }}/release/jacs --version

      - name: Smoke test (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          .\target\${{ matrix.target }}\release\jacs.exe --version

      - name: Package (Unix)
        if: runner.os != 'Windows'
        run: |
          cp target/${{ matrix.target }}/release/jacs jacs-cli
          tar czf ${CLI_ASSET_NAME}.tar.gz jacs-cli
          shasum -a 256 ${CLI_ASSET_NAME}.tar.gz > ${CLI_ASSET_NAME}.tar.gz.sha256

      - name: Package (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          Copy-Item "target/${{ matrix.target }}/release/jacs.exe" "jacs-cli.exe"
          Compress-Archive -Path "jacs-cli.exe" -DestinationPath "${env:CLI_ASSET_NAME}.zip"
          Get-FileHash "${env:CLI_ASSET_NAME}.zip" -Algorithm SHA256 | ForEach-Object { "$($_.Hash.ToLower())  ${env:CLI_ASSET_NAME}.zip" } | Out-File "${env:CLI_ASSET_NAME}.zip.sha256" -Encoding ascii

      - uses: actions/upload-artifact@v4
        with:
          name: binaries-${{ matrix.asset_suffix }}
          path: |
            ${{ env.CLI_ASSET_NAME }}.*

  release:
    needs: [verify-version, build]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Collect checksums
        run: |
          cd artifacts
          find . -name "*.sha256" -exec cat {} \; > ../sha256sums.txt
          cd ..
          cat sha256sums.txt

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: cli/v${{ needs.verify-version.outputs.version }}
          name: JACS CLI v${{ needs.verify-version.outputs.version }}
          body: |
            ## JACS CLI v${{ needs.verify-version.outputs.version }}

            Unified `jacs` binary with CLI + built-in MCP server.

            ### Install

            **From crates.io:**
            ```bash
            cargo install jacs-cli
            ```

            **From prebuilt binary:**
            ```bash
            # macOS (Apple Silicon)
            curl -LO https://github.com/HumanAssisted/JACS/releases/download/cli/v${{ needs.verify-version.outputs.version }}/jacs-cli-${{ needs.verify-version.outputs.version }}-darwin-arm64.tar.gz
            tar xzf jacs-cli-*.tar.gz
            sudo mv jacs-cli /usr/local/bin/jacs

            # Linux (x86_64)
            curl -LO https://github.com/HumanAssisted/JACS/releases/download/cli/v${{ needs.verify-version.outputs.version }}/jacs-cli-${{ needs.verify-version.outputs.version }}-linux-x64.tar.gz
            tar xzf jacs-cli-*.tar.gz
            sudo mv jacs-cli /usr/local/bin/jacs
            ```

            **Start MCP server (stdio):**
            ```bash
            jacs mcp
            ```

            ### Verify checksums
            ```bash
            shasum -a 256 -c sha256sums.txt
            ```
          files: |
            artifacts/**/*.tar.gz
            artifacts/**/*.zip
            sha256sums.txt