release.yml

name: Release 🏗️

on:
  push:
    branches: [master]
  workflow_dispatch:

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  contents: write
  pull-requests: write

jobs:
  release:
    name: Handle release 🦋
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      published: ${{ steps.changesets.outputs.published }}
      version_commit: ${{ steps.detect_version_commit.outputs.version_commit }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: oven-sh/setup-bun@v2
      - name: Install dependencies
        run: bun i
      - name: Create release pull request
        id: changesets
        uses: changesets/action@v1.7.0
        with:
          version: bun run version && git add Cargo.toml
          publish: |
            echo "Publishing @omnidotdev/cli@$(jq -r '.version' package.json)"
          title: "chore(release): version packages"
          commit: "chore(release): version packages"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Detect version commit
        id: detect_version_commit
        run: |
          # Detect the merged "version packages" commit even when changesets/action sets published=false.
          FILES=$(git diff-tree --no-commit-id --name-only -r "$GITHUB_SHA")
          if echo "$FILES" | grep -q '^CHANGELOG.md$' \
            && echo "$FILES" | grep -q '^Cargo.toml$' \
            && echo "$FILES" | grep -q '^package.json$'; then
            echo "version_commit=true" >> "$GITHUB_OUTPUT"
          else
            echo "version_commit=false" >> "$GITHUB_OUTPUT"
          fi

  build:
    name: Build ${{ matrix.target }}
    needs: release
    if: needs.release.outputs.published == 'true' || needs.release.outputs.version_commit == 'true' || github.event_name == 'workflow_dispatch'
    timeout-minutes: 30
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
          - target: x86_64-apple-darwin
            os: macos-latest
          - target: aarch64-apple-darwin
            os: macos-latest

    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install cross-compilation tools
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu
          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV

      - name: Build
        run: cargo build --release --target ${{ matrix.target }}

      - name: Package
        run: |
          cd target/${{ matrix.target }}/release
          tar -czvf omni-${{ matrix.target }}.tar.gz omni
          mv omni-${{ matrix.target }}.tar.gz ../../../

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: omni-${{ matrix.target }}
          path: omni-${{ matrix.target }}.tar.gz

  publish:
    name: Create GitHub Release
    needs: [release, build]
    if: needs.release.outputs.published == 'true' || needs.release.outputs.version_commit == 'true' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6

      - name: Get version from Cargo.toml
        id: version
        run: |
          VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts

      - name: Extract changelog for version
        id: changelog
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          # Extract the section for this version from CHANGELOG.md
          BODY=$(awk -v ver="## ${VERSION}" '
            $0 ~ ver { found=1; next }
            found && /^## / { exit }
            found { print }
          ' CHANGELOG.md)
          # Use a delimiter to handle multiline output
          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
          echo "body<<${EOF}" >> "$GITHUB_OUTPUT"
          echo "${BODY}" >> "$GITHUB_OUTPUT"
          echo "${EOF}" >> "$GITHUB_OUTPUT"

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ steps.version.outputs.version }}
          name: v${{ steps.version.outputs.version }}
          body: ${{ steps.changelog.outputs.body }}
          files: artifacts/**/*.tar.gz
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Update Homebrew tap
        env:
          TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          MACOS_X86_SHA256=$(shasum -a 256 artifacts/omni-x86_64-apple-darwin/omni-x86_64-apple-darwin.tar.gz | awk '{print $1}')
          MACOS_ARM_SHA256=$(shasum -a 256 artifacts/omni-aarch64-apple-darwin/omni-aarch64-apple-darwin.tar.gz | awk '{print $1}')
          LINUX_X86_SHA256=$(shasum -a 256 artifacts/omni-x86_64-unknown-linux-gnu/omni-x86_64-unknown-linux-gnu.tar.gz | awk '{print $1}')
          LINUX_ARM_SHA256=$(shasum -a 256 artifacts/omni-aarch64-unknown-linux-gnu/omni-aarch64-unknown-linux-gnu.tar.gz | awk '{print $1}')

          git clone https://x-access-token:${TAP_GITHUB_TOKEN}@github.com/omnidotdev/homebrew-tap.git tap
          cd tap

          mkdir -p Formula
          cat > Formula/omni-cli.rb <<'FORMULAEOF'
          class OmniCli < Formula
            desc "Agentic CLI for the Omni ecosystem"
            homepage "https://cli.omni.dev"
            version "${VERSION}"
            license "Apache-2.0"

            on_macos do
              on_arm do
                url "https://github.com/omnidotdev/cli/releases/download/v${VERSION}/omni-aarch64-apple-darwin.tar.gz"
                sha256 "${MACOS_ARM_SHA256}"
              end
              on_intel do
                url "https://github.com/omnidotdev/cli/releases/download/v${VERSION}/omni-x86_64-apple-darwin.tar.gz"
                sha256 "${MACOS_X86_SHA256}"
              end
            end

            on_linux do
              on_arm do
                url "https://github.com/omnidotdev/cli/releases/download/v${VERSION}/omni-aarch64-unknown-linux-gnu.tar.gz"
                sha256 "${LINUX_ARM_SHA256}"
              end
              on_intel do
                url "https://github.com/omnidotdev/cli/releases/download/v${VERSION}/omni-x86_64-unknown-linux-gnu.tar.gz"
                sha256 "${LINUX_X86_SHA256}"
              end
            end

            def install
              bin.install "omni"
            end

            test do
              assert_match version.to_s, shell_output("#{bin}/omni --version")
            end
          end
          FORMULAEOF
          sed -i "s/\${VERSION}/${VERSION}/g; s/\${MACOS_ARM_SHA256}/${MACOS_ARM_SHA256}/g; s/\${MACOS_X86_SHA256}/${MACOS_X86_SHA256}/g; s/\${LINUX_X86_SHA256}/${LINUX_X86_SHA256}/g; s/\${LINUX_ARM_SHA256}/${LINUX_ARM_SHA256}/g" Formula/omni-cli.rb

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Formula/omni-cli.rb
          if ! git diff --cached --quiet; then
            git commit -m "chore: update omni-cli to v${VERSION}"
            git push
          fi
      - name: Publish to AUR
        env:
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
        if: env.AUR_SSH_PRIVATE_KEY != ''
        run: |
          VERSION="${{ steps.version.outputs.version }}"

          mkdir -p ~/.ssh
          echo "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          cat >> ~/.ssh/config <<SSH
          Host aur.archlinux.org
            IdentityFile ~/.ssh/aur
            User aur
          SSH
          ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null

          publish_aur() {
            local pkg="$1"
            git clone "ssh://aur@aur.archlinux.org/${pkg}.git" "${pkg}" 2>/dev/null || {
              mkdir "${pkg}" && cd "${pkg}" && git init && git remote add origin "ssh://aur@aur.archlinux.org/${pkg}.git" && cd ..
            }
            cd "${pkg}"
            cp "../misc/packaging/aur/${pkg}/PKGBUILD" .
            sed -i "s/^pkgver=.*/pkgver=${VERSION}/" PKGBUILD
            # Compute checksums for source URLs (replaces updpkgsums)
            local -a checksums=()
            while IFS= read -r src; do
              local url="${src#*::}"
              checksums+=("$(curl -fsSL "$url" | sha256sum | awk '{print $1}')")
            done < <(bash -c "source PKGBUILD 2>/dev/null; printf '%s\n' \"\${source[@]}\"")

            # Update sha256sums in PKGBUILD
            perl -i -0777 -pe 's/^sha256sums=\(.*?\)\n//ms' PKGBUILD
            {
              printf "sha256sums=("
              for i in "${!checksums[@]}"; do
                [[ $i -gt 0 ]] && printf "\n            "
                printf "'%s'" "${checksums[$i]}"
              done
              printf ")\n"
            } >> PKGBUILD

            # Generate .SRCINFO (replaces makepkg --printsrcinfo)
            (
              source PKGBUILD 2>/dev/null
              printf "pkgbase = %s\n" "$pkgname"
              printf "\tpkgdesc = %s\n" "$pkgdesc"
              printf "\tpkgver = %s\n" "$pkgver"
              printf "\tpkgrel = %s\n" "$pkgrel"
              printf "\turl = %s\n" "$url"
              for v in "${arch[@]}"; do printf "\tarch = %s\n" "$v"; done
              for v in "${license[@]}"; do printf "\tlicense = %s\n" "$v"; done
              for v in "${makedepends[@]}"; do printf "\tmakedepends = %s\n" "$v"; done
              for v in "${depends[@]}"; do printf "\tdepends = %s\n" "$v"; done
              [[ -v provides ]] && for v in "${provides[@]}"; do printf "\tprovides = %s\n" "$v"; done
              [[ -v conflicts ]] && for v in "${conflicts[@]}"; do printf "\tconflicts = %s\n" "$v"; done
              for v in "${source[@]}"; do printf "\tsource = %s\n" "$v"; done
              for v in "${sha256sums[@]}"; do printf "\tsha256sums = %s\n" "$v"; done
              printf "\n"
              printf "pkgname = %s\n" "$pkgname"
            ) > .SRCINFO
            git config user.name "Omni"
            git config user.email "team@omni.dev"
            git add PKGBUILD .SRCINFO
            git diff --cached --quiet || git commit -m "Update to v${VERSION}"
            git push origin master
            cd ..
          }

          publish_aur "omnidotdev-cli"
          publish_aur "omnidotdev-cli-bin"

          rm -f ~/.ssh/aur