release.yml

name: Release
on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
concurrency:
  group: release
  cancel-in-progress: false
jobs:
  preflight:
    runs-on: depot-ubuntu-24.04
    steps:
      - name: Verify PostHog key is configured
        run: |
          if [ -z "${{ secrets.POSTHOG_PUBLIC_KEY }}" ]; then
            echo "::error::POSTHOG_PUBLIC_KEY secret is not set"
            exit 1
          fi
  test-binary:
    needs: preflight
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            target: node24-macos-arm64
            binary: dist/resend
          - os: ubuntu-latest
            target: node24-linux-x64
            binary: dist/resend
          - os: windows-latest
            target: node24-win-x64
            binary: dist/resend.exe
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6
      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: 24
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Build Node bundle
        run: pnpm build
        env:
          POSTHOG_PUBLIC_KEY: ${{ secrets.POSTHOG_PUBLIC_KEY }}
      - name: Build binary
        run: pnpm exec pkg dist/cli.cjs --config package.json --compress Brotli --target ${{ matrix.target }} --output ${{ matrix.binary }}
      - name: Verify binary runs
        run: |
          ${{ matrix.binary }} --version
          ${{ matrix.binary }} --help
  test-binary-linux-arm64:
    needs: preflight
    runs-on: depot-ubuntu-24.04-4
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6
      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: 24
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Build Node bundle
        run: pnpm build
        env:
          POSTHOG_PUBLIC_KEY: ${{ secrets.POSTHOG_PUBLIC_KEY }}
      - name: Build binary (no-bytecode workaround)
        run: pnpm exec pkg dist/cli.cjs --config package.json --compress Brotli --target node24-linux-arm64 --output dist/resend --no-bytecode --public-packages "*" --public
      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
        with:
          platforms: arm64
      - name: Verify binary runs under arm64 emulation
        run: |
          docker run --rm --platform linux/arm64 \
            -v "$PWD/dist/resend:/usr/local/bin/resend" \
            debian:bookworm-slim \
            sh -c "resend --version && resend --help"
  build-macos:
    needs: [test-binary, test-binary-linux-arm64]
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6
      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: 24
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Build Node bundle
        run: pnpm build
        env:
          POSTHOG_PUBLIC_KEY: ${{ secrets.POSTHOG_PUBLIC_KEY }}
      - name: Build macOS binaries
        run: |
          pnpm exec pkg dist/cli.cjs --config package.json --compress Brotli --target node24-macos-arm64 --output dist/resend-darwin-arm64
          pnpm exec pkg dist/cli.cjs --config package.json --compress Brotli --target node24-macos-x64   --output dist/resend-darwin-x64
      - name: Verify signatures
        run: |
          codesign -v dist/resend-darwin-arm64
          codesign -v dist/resend-darwin-x64
      - name: Package archives
        run: |
          cd dist
          for bin in resend-darwin-arm64 resend-darwin-x64; do
            cp "$bin" resend
            chmod +x resend
            tar -czf "${bin}.tar.gz" resend
            rm resend
          done
      - name: Upload macOS artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: macos-archives
          path: |
            dist/resend-darwin-arm64.tar.gz
            dist/resend-darwin-x64.tar.gz
  build-linux-windows:
    needs: [test-binary, test-binary-linux-arm64]
    runs-on: depot-ubuntu-24.04-4
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6
      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: 24
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Build Node bundle
        run: pnpm build
        env:
          POSTHOG_PUBLIC_KEY: ${{ secrets.POSTHOG_PUBLIC_KEY }}
      - name: Build binaries
        run: |
          pnpm exec pkg dist/cli.cjs --config package.json --compress Brotli --target node24-linux-x64   --output dist/resend-linux-x64
          pnpm exec pkg dist/cli.cjs --config package.json --compress Brotli --target node24-linux-arm64 --output dist/resend-linux-arm64 --no-bytecode --public-packages "*" --public
          pnpm exec pkg dist/cli.cjs --config package.json --compress Brotli --target node24-win-x64     --output dist/resend-windows-x64.exe
      - name: Verify binaries
        run: |
          for f in dist/resend-linux-x64 dist/resend-linux-arm64 dist/resend-windows-x64.exe; do
            [ -s "$f" ] || { echo "Missing or empty: $f"; exit 1; }
          done
      - name: Package archives
        run: |
          cd dist
          for bin in resend-linux-x64 resend-linux-arm64; do
            cp "$bin" resend
            chmod +x resend
            tar -czf "${bin}.tar.gz" resend
            rm resend
          done
          cp resend-windows-x64.exe resend.exe
          zip resend-windows-x64.zip resend.exe
          rm resend.exe
      - name: Upload Linux/Windows artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: linux-windows-archives
          path: |
            dist/resend-linux-x64.tar.gz
            dist/resend-linux-arm64.tar.gz
            dist/resend-windows-x64.zip
  release:
    if: github.event_name != 'workflow_dispatch'
    needs: [build-macos, build-linux-windows]
    permissions:
      contents: write
    runs-on: depot-ubuntu-24.04
    outputs:
      prerelease: ${{ steps.meta.outputs.prerelease }}
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: dist
          merge-multiple: true
      - name: Verify all archives exist
        run: |
          for f in dist/resend-darwin-arm64.tar.gz dist/resend-darwin-x64.tar.gz \
                    dist/resend-linux-x64.tar.gz dist/resend-linux-arm64.tar.gz \
                    dist/resend-windows-x64.zip; do
            [ -s "$f" ] || { echo "Missing or empty: $f"; exit 1; }
          done
      - name: Detect pre-release
        id: meta
        run: |
          if [[ "${{ github.ref_name }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "prerelease=false" >> "$GITHUB_OUTPUT"
            echo "make_latest=true" >> "$GITHUB_OUTPUT"
          else
            echo "prerelease=true" >> "$GITHUB_OUTPUT"
            echo "make_latest=false" >> "$GITHUB_OUTPUT"
          fi
      - name: Create GitHub Release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
        with:
          prerelease: ${{ steps.meta.outputs.prerelease }}
          make_latest: ${{ steps.meta.outputs.make_latest }}
          generate_release_notes: true
          body: |
            ## Install

            **cURL**
            ```sh
            curl -fsSL https://resend.com/install.sh | bash
            ```

            **Node.js**
            ```sh
            npm install -g resend-cli
            ```

            **Homebrew (macOS / Linux)**
            ```sh
            brew install resend/cli/resend
            ```

            **PowerShell (Windows)**
            ```sh
            irm https://resend.com/install.ps1 | iex
            ```
          files: |
            dist/resend-darwin-arm64.tar.gz
            dist/resend-darwin-x64.tar.gz
            dist/resend-linux-x64.tar.gz
            dist/resend-linux-arm64.tar.gz
            dist/resend-windows-x64.zip
  publish-npm:
    if: github.event_name != 'workflow_dispatch'
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6
      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Determine npm tag
        id: npm-tag
        run: |
          TAG="${{ github.ref_name }}"
          if [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "tag=latest" >> "$GITHUB_OUTPUT"
          else
            PRERELEASE="${TAG#v[0-9]*.[0-9]*.[0-9]*-}"
            echo "tag=${PRERELEASE%%[-.]*}" >> "$GITHUB_OUTPUT"
          fi
      - name: Publish to npm
        run: npm publish --provenance --tag ${{ steps.npm-tag.outputs.tag }}
        env:
          POSTHOG_PUBLIC_KEY: ${{ secrets.POSTHOG_PUBLIC_KEY }}
  notify-tap:
    if: github.event_name != 'workflow_dispatch' && needs.release.outputs.prerelease == 'false'
    name: Trigger Homebrew Tap Update
    needs: release
    runs-on: depot-ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Dispatch publish-release workflow on tap
        env:
          GH_TOKEN: ${{ secrets.RELEASE_CLI_ON_HOMEBREW }}
        run: |
          gh workflow run publish-release.yml \
            --repo resend/homebrew-cli \
            --field version="${GITHUB_REF_NAME}" \
            --field reviewer="${GITHUB_ACTOR}"