release.yml

name: Release

on:
  push:
    tags: ['v*.*.*']

permissions:
  contents: write

jobs:
  # ── 1. Build CLI binaries (all platforms) ─────────────────────────────────
  build:
    name: Build ${{ matrix.artifact }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            artifact: gitintel-linux-amd64
          - os: ubuntu-latest
            target: aarch64-unknown-linux-musl
            artifact: gitintel-linux-arm64
          - os: macos-latest
            target: x86_64-apple-darwin
            artifact: gitintel-macos-amd64
          - os: macos-latest
            target: aarch64-apple-darwin
            artifact: gitintel-macos-arm64
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact: gitintel-windows-amd64.exe

    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: packages/cli

      - name: Install musl tools (Linux)
        if: contains(matrix.target, 'linux-musl')
        run: sudo apt-get update && sudo apt-get install -y musl-tools

      - name: Install cross (ARM64 Linux)
        if: matrix.target == 'aarch64-unknown-linux-musl'
        run: cargo install cross

      - name: Build (native)
        if: matrix.target != 'aarch64-unknown-linux-musl'
        working-directory: packages/cli
        run: cargo build --release --target ${{ matrix.target }}

      - name: Build (cross ARM64)
        if: matrix.target == 'aarch64-unknown-linux-musl'
        working-directory: packages/cli
        run: cross build --release --target ${{ matrix.target }}

      - name: Stage artifact
        shell: bash
        run: |
          src="packages/cli/target/${{ matrix.target }}/release/gitintel"
          [[ "${{ matrix.os }}" == "windows-latest" ]] && src="${src}.exe"
          cp "$src" "${{ matrix.artifact }}"

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: ${{ matrix.artifact }}

  # ── 2. Create GitHub Release ──────────────────────────────────────────────
  release:
    name: Publish GitHub Release
    needs: build
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/download-artifact@v4
        with:
          merge-multiple: true

      - uses: softprops/action-gh-release@v2
        with:
          files: gitintel-*
          generate_release_notes: true

  # ── 3. Update Homebrew tap ────────────────────────────────────────────────
  homebrew:
    name: Update Homebrew tap
    needs: release
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          merge-multiple: true

      - name: Compute checksums and update formula
        shell: bash
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}

          sha_macos_arm64=$(sha256sum gitintel-macos-arm64   | awk '{print $1}')
          sha_macos_amd64=$(sha256sum gitintel-macos-amd64   | awk '{print $1}')
          sha_linux_arm64=$(sha256sum gitintel-linux-arm64   | awk '{print $1}')
          sha_linux_amd64=$(sha256sum gitintel-linux-amd64   | awk '{print $1}')

          # Write checksums file for the release assets
          echo "$sha_macos_arm64  gitintel-macos-arm64"   >> checksums.sha256
          echo "$sha_macos_amd64  gitintel-macos-amd64"   >> checksums.sha256
          echo "$sha_linux_arm64  gitintel-linux-arm64"   >> checksums.sha256
          echo "$sha_linux_amd64  gitintel-linux-amd64"   >> checksums.sha256
          sha256sum gitintel-windows-amd64.exe           >> checksums.sha256

          # Patch the formula
          sed -i "s/version \".*\"/version \"$VERSION\"/"                               Formula/gitintel.rb
          sed -i "s/PLACEHOLDER_MACOS_ARM64_SHA256/$sha_macos_arm64/"                   Formula/gitintel.rb
          sed -i "s/PLACEHOLDER_MACOS_AMD64_SHA256/$sha_macos_amd64/"                   Formula/gitintel.rb
          sed -i "s/PLACEHOLDER_LINUX_ARM64_SHA256/$sha_linux_arm64/"                   Formula/gitintel.rb
          sed -i "s/PLACEHOLDER_LINUX_AMD64_SHA256/$sha_linux_amd64/"                   Formula/gitintel.rb

      - name: Upload checksums to release
        uses: softprops/action-gh-release@v2
        with:
          files: checksums.sha256

      - name: Push formula to homebrew-tap repo
        env:
          TAP_DEPLOY_KEY: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
        run: |
          if [ -z "$TAP_DEPLOY_KEY" ]; then
            echo "HOMEBREW_TAP_DEPLOY_KEY not set — skipping tap push"
            exit 0
          fi

          eval "$(ssh-agent -s)"
          echo "$TAP_DEPLOY_KEY" | ssh-add -

          git config --global user.email "ci@gitintel.com"
          git config --global user.name "GitIntel CI"

          git clone git@github.com:gitintel-ai/homebrew-tap.git /tmp/homebrew-tap
          cp Formula/gitintel.rb /tmp/homebrew-tap/Formula/gitintel.rb
          cd /tmp/homebrew-tap
          git add Formula/gitintel.rb
          git commit -m "gitintel ${GITHUB_REF#refs/tags/}"
          git push

  # ── 4. Publish to npm ─────────────────────────────────────────────────────
  npm:
    name: Publish npm
    needs: release
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'

      - name: Publish
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          # Copy to /tmp to escape the bun monorepo (workspace:* protocol confuses npm)
          cp -r packages/cli-npm /tmp/gitintel-npm
          cd /tmp/gitintel-npm
          npm version "$VERSION" --no-git-tag-version --allow-same-version
          echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" > .npmrc
          npm publish --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}