release.yml

name: Release

on:
  push:
    tags:
      - 'v[0-9]+.*-rust'

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always

jobs:
  verify:
    name: Verify Release Source
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
    steps:
      - uses: actions/checkout@v5

      - name: Validate tag version
        shell: bash
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF#refs/tags/v}"
          VERSION="${VERSION%-rust}"
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
            echo "::error::invalid release tag version: $VERSION"
            exit 1
          fi
          CARGO_VERSION=$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n 1)
          if [[ "$VERSION" != "$CARGO_VERSION" ]]; then
            echo "::error::tag version $VERSION does not match Cargo.toml version $CARGO_VERSION"
            exit 1
          fi

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Check code
        run: cargo check --workspace --all-targets --all-features --locked

      - name: Lint
        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings

      - name: Test
        run: cargo test --workspace --all-features --locked

      - name: Documentation
        run: cargo doc --workspace --no-deps --all-features --locked
        env:
          RUSTDOCFLAGS: -D warnings

      # audit-check installs the latest cargo-audit, whose own MSRV may be
      # newer than this project's MSRV. Run it while stable is still active.
      - name: Security audit
        uses: rustsec/audit-check@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install MSRV toolchain
        uses: dtolnay/rust-toolchain@1.88

      - name: Check MSRV
        run: cargo +1.88 check --workspace --all-targets --locked

  create-release:
    name: Create Release
    needs: verify
    runs-on: ubuntu-latest
    outputs:
      upload_url: ${{ steps.create_release.outputs.upload_url }}
      version: ${{ steps.get_version.outputs.version }}
    steps:
      - uses: actions/checkout@v5

      - name: Get version from tag
        id: get_version
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          VERSION=${VERSION%-rust}
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Create Release
        id: create_release
        uses: softprops/action-gh-release@v2
        with:
          draft: true
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build:
    name: Build (${{ matrix.target }})
    needs: create-release
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            archive: tar.gz
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            archive: tar.gz
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            archive: tar.gz
            cross: true

          # macOS
          - target: x86_64-apple-darwin
            os: macos-latest
            archive: tar.gz
          - target: aarch64-apple-darwin
            os: macos-latest
            archive: tar.gz

          # Windows
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            archive: zip

    steps:
      - uses: actions/checkout@v5

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install cross (for cross-compilation)
        if: matrix.cross
        run: cargo install cross --git https://github.com/cross-rs/cross

      - name: Install musl tools
        if: matrix.target == 'x86_64-unknown-linux-musl'
        run: sudo apt-get update && sudo apt-get install -y musl-tools

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}

      - name: Build (cross)
        if: matrix.cross
        run: cross build --release --target ${{ matrix.target }}

      - name: Build (native)
        if: "!matrix.cross"
        run: cargo build --release --target ${{ matrix.target }}

      - name: Prepare artifacts (Unix)
        if: runner.os != 'Windows'
        run: |
          cd target/${{ matrix.target }}/release
          strip codelens || true
          tar czf ../../../codelens-${{ needs.create-release.outputs.version }}-${{ matrix.target }}.${{ matrix.archive }} codelens

      - name: Prepare artifacts (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          cd target/${{ matrix.target }}/release
          Compress-Archive -Path codelens.exe -DestinationPath ../../../codelens-${{ needs.create-release.outputs.version }}-${{ matrix.target }}.${{ matrix.archive }}

      - name: Upload artifacts
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.create-release.outputs.version }}-rust
          files: codelens-${{ needs.create-release.outputs.version }}-${{ matrix.target }}.${{ matrix.archive }}
          # Keep the release as a draft while assets are uploading. Without an
          # explicit draft input, current action-gh-release@v2 finalizes
          # (publishes) the release as soon as the first matrix job finishes
          # uploading, exposing a half-assembled release. The publish-release
          # job flips it to published once every build has completed.
          draft: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  publish-release:
    name: Publish Release
    # Flip the draft release to published once all assets are attached, so the
    # public download URLs (used by the homebrew job) stop returning 404.
    # Intentionally no prerelease filter: alpha/beta/rc drafts must be
    # published as well. If any build fails, this job is skipped and the
    # release stays in draft.
    needs: [create-release, build, publish-crates]
    runs-on: ubuntu-latest
    steps:
      - name: Publish draft release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: v${{ needs.create-release.outputs.version }}-rust
        run: |
          # gh release edit resolves a draft release by its pending tag name
          # (REST lookup with a GraphQL fallback for drafts), so this works
          # while the release is still a draft.
          gh release edit "$TAG" --draft=false --repo "$GITHUB_REPOSITORY"

  publish-crates:
    name: Publish to crates.io
    needs: [create-release, build]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable

      - name: Publish codelens-core
        env:
          VERSION: ${{ needs.create-release.outputs.version }}
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          if curl -fsSL "https://crates.io/api/v1/crates/codelens-core/${VERSION}" >/dev/null; then
            echo "codelens-core ${VERSION} is already published; skipping"
          else
            cargo publish --locked -p codelens-core --token "$CARGO_REGISTRY_TOKEN"
          fi

      - name: Wait for crates.io index
        run: sleep 30

      - name: Publish codelens
        env:
          VERSION: ${{ needs.create-release.outputs.version }}
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          if curl -fsSL "https://crates.io/api/v1/crates/codelens/${VERSION}" >/dev/null; then
            echo "codelens ${VERSION} is already published; skipping"
          else
            cargo publish --locked -p codelens --token "$CARGO_REGISTRY_TOKEN"
          fi

  homebrew:
    name: Update Homebrew Formula
    needs: [create-release, build, publish-release]
    runs-on: ubuntu-latest
    if: "!contains(github.ref, 'alpha') && !contains(github.ref, 'beta') && !contains(github.ref, 'rc')"
    steps:
      - name: Download release assets and compute checksums
        id: checksums
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ needs.create-release.outputs.version }}
        run: |
          BASE_URL="https://github.com/DropFan/codelens/releases/download/v${VERSION}-rust"

          # Fail loudly on any download error: without -f / pipefail a 404
          # body would be hashed and a bogus checksum pushed to the tap.
          set -o pipefail

          # Download and compute SHA256 for each platform
          SHA_MACOS_X86=$(curl -fsSL "${BASE_URL}/codelens-${VERSION}-x86_64-apple-darwin.tar.gz" | sha256sum | cut -d' ' -f1)
          SHA_MACOS_ARM=$(curl -fsSL "${BASE_URL}/codelens-${VERSION}-aarch64-apple-darwin.tar.gz" | sha256sum | cut -d' ' -f1)
          SHA_LINUX_X86=$(curl -fsSL "${BASE_URL}/codelens-${VERSION}-x86_64-unknown-linux-gnu.tar.gz" | sha256sum | cut -d' ' -f1)
          SHA_LINUX_ARM=$(curl -fsSL "${BASE_URL}/codelens-${VERSION}-aarch64-unknown-linux-gnu.tar.gz" | sha256sum | cut -d' ' -f1)

          echo "sha_macos_x86=${SHA_MACOS_X86}" >> $GITHUB_OUTPUT
          echo "sha_macos_arm=${SHA_MACOS_ARM}" >> $GITHUB_OUTPUT
          echo "sha_linux_x86=${SHA_LINUX_X86}" >> $GITHUB_OUTPUT
          echo "sha_linux_arm=${SHA_LINUX_ARM}" >> $GITHUB_OUTPUT

      - name: Checkout homebrew-tap
        uses: actions/checkout@v5
        with:
          repository: DropFan/homebrew-tap
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: homebrew-tap

      - name: Update formula
        env:
          VERSION: ${{ needs.create-release.outputs.version }}
          SHA_MACOS_X86: ${{ steps.checksums.outputs.sha_macos_x86 }}
          SHA_MACOS_ARM: ${{ steps.checksums.outputs.sha_macos_arm }}
          SHA_LINUX_X86: ${{ steps.checksums.outputs.sha_linux_x86 }}
          SHA_LINUX_ARM: ${{ steps.checksums.outputs.sha_linux_arm }}
        run: |
          cat > homebrew-tap/Formula/codelens.rb << 'FORMULA'
          class Codelens < Formula
            desc "Code stats, health scores, hotspots, coupling, diffs, and cost estimation"
            homepage "https://github.com/DropFan/codelens"
            version "VERSION_PLACEHOLDER"
            license "MIT"

            on_macos do
              on_intel do
                url "https://github.com/DropFan/codelens/releases/download/vVERSION_PLACEHOLDER-rust/codelens-VERSION_PLACEHOLDER-x86_64-apple-darwin.tar.gz"
                sha256 "SHA_MACOS_X86_PLACEHOLDER"
              end
              on_arm do
                url "https://github.com/DropFan/codelens/releases/download/vVERSION_PLACEHOLDER-rust/codelens-VERSION_PLACEHOLDER-aarch64-apple-darwin.tar.gz"
                sha256 "SHA_MACOS_ARM_PLACEHOLDER"
              end
            end

            on_linux do
              on_intel do
                url "https://github.com/DropFan/codelens/releases/download/vVERSION_PLACEHOLDER-rust/codelens-VERSION_PLACEHOLDER-x86_64-unknown-linux-gnu.tar.gz"
                sha256 "SHA_LINUX_X86_PLACEHOLDER"
              end
              on_arm do
                url "https://github.com/DropFan/codelens/releases/download/vVERSION_PLACEHOLDER-rust/codelens-VERSION_PLACEHOLDER-aarch64-unknown-linux-gnu.tar.gz"
                sha256 "SHA_LINUX_ARM_PLACEHOLDER"
              end
            end

            def install
              bin.install "codelens"
            end

            test do
              assert_match "codelens", shell_output("#{bin}/codelens --version")
            end
          end
          FORMULA

          # Replace placeholders with actual values
          sed -i "s/VERSION_PLACEHOLDER/${VERSION}/g" homebrew-tap/Formula/codelens.rb
          sed -i "s/SHA_MACOS_X86_PLACEHOLDER/${SHA_MACOS_X86}/g" homebrew-tap/Formula/codelens.rb
          sed -i "s/SHA_MACOS_ARM_PLACEHOLDER/${SHA_MACOS_ARM}/g" homebrew-tap/Formula/codelens.rb
          sed -i "s/SHA_LINUX_X86_PLACEHOLDER/${SHA_LINUX_X86}/g" homebrew-tap/Formula/codelens.rb
          sed -i "s/SHA_LINUX_ARM_PLACEHOLDER/${SHA_LINUX_ARM}/g" homebrew-tap/Formula/codelens.rb

          # Remove leading spaces from heredoc
          sed -i 's/^          //' homebrew-tap/Formula/codelens.rb

      - name: Commit and push
        working-directory: homebrew-tap
        env:
          VERSION: ${{ needs.create-release.outputs.version }}
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git remote set-url origin "https://x-access-token:${HOMEBREW_TAP_TOKEN}@github.com/DropFan/homebrew-tap.git"
          git add Formula/codelens.rb
          git commit -m "codelens ${VERSION}" || echo "No changes to commit"
          git push