release.yml

name: Release

on:
  schedule:
    - cron: "23 6 * * *"
  pull_request:
    # Drafts skip CI; run the checks locally while iterating. Marking a PR ready runs them here.
    types: [opened, synchronize, reopened, ready_for_review]
    paths:
      - .github/workflows/release.yml
      - scripts/package-sdk.py
      - scripts/rust-notices.py
      - scripts/install-typescript.mjs
  workflow_dispatch:
    inputs:
      channel:
        description:
          "`nightly` publishes `<workspace version>-nightly.<UTC commit time>.g<commit>`; `release` publishes the
          workspace version"
        type: choice
        options: [nightly, release]
        default: nightly

permissions:
  contents: read

# Publishing runs one at a time, so a version is never published concurrently.
concurrency:
  group: release-${{ github.event_name == 'pull_request' && github.ref || 'publish' }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CHANNEL: ${{ inputs.channel || 'nightly' }}

jobs:
  version:
    if: ${{ !github.event.pull_request.draft }}
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      version: ${{ steps.version.outputs.version }}
      published: ${{ steps.version.outputs.published }}
    steps:
      - uses: actions/checkout@v5
      - id: base
        run: |
          python3 - <<'PY' >> "$GITHUB_OUTPUT"
          import tomllib
          with open("Cargo.toml", "rb") as source:
              print("version=" + tomllib.load(source)["workspace"]["package"]["version"])
          PY
      - id: version
        uses: chunkzero/release-tools/version@v1
        with:
          base: ${{ steps.base.outputs.version }}
          channel: ${{ env.CHANNEL }}

  # GitHub-hosted runners: they cover every platform, and the public repository runs them free.
  package:
    needs: version
    # A commit's version is fixed, so an already published version only needs registering.
    if: needs.version.outputs.published != 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            platform: linux-x64
            maven: true
          - runner: ubuntu-24.04-arm
            platform: linux-arm64
          - runner: macos-15
            platform: darwin-arm64
          - runner: macos-15-intel
            platform: darwin-x64
          - runner: windows-2025
            platform: windows-x64
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 120
    defaults:
      run:
        shell: bash
    env:
      CHUNK_RELEASE_VERSION: ${{ needs.version.outputs.version }}
    steps:
      - name: Free disk space
        if: runner.os == 'Linux'
        run: sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
      - uses: actions/checkout@v5
      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v5
        with:
          node-version: 24
      - name: Install the pinned TypeScript compiler
        run: pnpm install --frozen-lockfile --filter chunk-monorepo
      - uses: actions/setup-java@v5
        if: matrix.maven
        with:
          distribution: temurin
          java-version: 21
      - uses: gradle/actions/setup-gradle@v5
        if: matrix.maven
      - run: rustup toolchain install --no-self-update
      - uses: ./.github/actions/rust-cache
        with:
          profile: release
          key: ${{ matrix.platform }}
      - name: Configure the vendored OpenSSL with Strawberry Perl
        if: runner.os == 'Windows'
        # Git's MSYS Perl, first on the bash PATH, cannot configure OpenSSL for MSVC.
        run: echo 'OPENSSL_SRC_PERL=C:/Strawberry/perl/bin/perl.exe' >> "$GITHUB_ENV"
      - run: cargo build --release --locked -p chunk-cli
      - run: python scripts/package-sdk.py --output dist ${{ !matrix.maven && '--no-maven' || '' }}
      - name: Compile and type-check a project with the extracted CLI
        if: runner.os != 'Windows'
        run: |
          name="chunk-$CHUNK_RELEASE_VERSION-${{ matrix.platform }}"
          mkdir -p "$RUNNER_TEMP/sdk"
          tar -xzf "dist/$name.tar.gz" -C "$RUNNER_TEMP/sdk"
          chunk="$RUNNER_TEMP/sdk/$name/chunk"
          test "$("$chunk" --version)" = "chunk $CHUNK_RELEASE_VERSION"
          if [ "$RUNNER_OS" = macOS ] && otool -L "$chunk" | tail -n +2 | grep -v -e '/usr/lib/' -e '/System/'; then
            echo "chunk links libraries macOS does not ship" >&2
            exit 1
          fi
          "$chunk" gen examples/local --target typescript --frozen \
            --output "$RUNNER_TEMP/generated" --backend-output "$RUNNER_TEMP/backend"
      - uses: actions/upload-artifact@v4
        with:
          name: archive-${{ matrix.platform }}
          path: |
            dist/*.tar.gz
            dist/*.sha256
          if-no-files-found: error
          # Cleanup deletes it once used; retention only bounds runs that never reach cleanup.
          retention-days: 1
      - uses: actions/upload-artifact@v4
        if: matrix.maven
        with:
          name: maven
          path: dist/maven
          if-no-files-found: error
          retention-days: 1

  verify:
    needs: [version, package]
    runs-on: ubuntu-24.04
    container: ubuntu:24.04
    timeout-minutes: 20
    steps:
      - name: Install consumer prerequisites
        run: |
          apt-get update -qq
          apt-get install -y --no-install-recommends ca-certificates curl git python3
      - uses: actions/checkout@v5
        with:
          sparse-checkout-cone-mode: false
          sparse-checkout: |
            /scripts/check-sdk.py
            /scripts/check-consumers.py
            /scripts/install.sh
      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 21
      - uses: actions/download-artifact@v4
        with:
          name: archive-linux-x64
          path: dist
      - uses: actions/download-artifact@v4
        with:
          name: maven
          path: maven
      - name: Create, generate and build Java and Kotlin projects with only the installed SDK and staged Maven files
        env:
          VERSION: ${{ needs.version.outputs.version }}
        run: python3 scripts/check-sdk.py "dist/chunk-$VERSION-linux-x64.tar.gz" maven

  # Maven first: a published CLI pins JVM artifacts that must already resolve.
  publish:
    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
    needs: [version, package, verify]
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: write
    env:
      VERSION: ${{ needs.version.outputs.version }}
      REPOSITORY: ${{ inputs.channel == 'release' && 'releases' || 'nightlies' }}
      MAVEN_URL: https://maven.chunkzero.com${{ inputs.channel != 'release' && '/nightlies' || '' }}
    steps:
      - uses: actions/checkout@v5
      - uses: actions/download-artifact@v4
        with:
          pattern: archive-*
          merge-multiple: true
          path: dist
      - uses: actions/download-artifact@v4
        with:
          name: maven
          path: maven
      - uses: chunkzero/maven-r2@v1
        with:
          version: v0.1.0
      - name: Publish the Maven artifacts
        env:
          MAVEN_R2_SERVER: https://maven.chunkzero.com
          MAVEN_R2_TOKEN: ${{ secrets.MAVEN_R2_TOKEN }}
        run: |
          : "${MAVEN_R2_TOKEN:?Set the Maven R2 publishing token secret}"
          maven-r2 publish --repository "default/$REPOSITORY" -- python3 scripts/publish-maven.py maven "$VERSION"
          pom="com/chunkzero/chunk/runtime/$VERSION/runtime-$VERSION.pom"
          curl --fail --retry 5 --retry-all-errors --retry-delay 2 "$MAVEN_URL/$pom" -o published.pom
          cmp published.pom "maven/$pom"
      - uses: chunkzero/release-tools/publish@v1
        with:
          version: ${{ needs.version.outputs.version }}
          directory: dist
          title: Chunk

  register:
    if: >-
      always() && github.event_name != 'pull_request' && github.ref == 'refs/heads/main' && needs.version.result ==
      'success' && (needs.publish.result == 'success' || needs.version.outputs.published == 'true')
    needs: [version, publish]
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: Download the published archives
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.version.outputs.version }}
        run: gh release download "v$VERSION" --repo "$GITHUB_REPOSITORY" --dir dist
      - uses: actions/create-github-app-token@v2
        id: token
        with:
          app-id: ${{ secrets.REGISTRY_APP_ID }}
          private-key: ${{ secrets.REGISTRY_APP_PRIVATE_KEY }}
          owner: chunkzero
          repositories: mise-registry
      - uses: chunkzero/release-tools/mise-registry@v1
        with:
          tool: chunk
          version: ${{ needs.version.outputs.version }}
          directory: dist
          token: ${{ steps.token.outputs.token }}

  # Preserve archives after failures so retries can reuse the successful builds.
  cleanup:
    if: >-
      always() && (needs.publish.result == 'success' || (github.event_name == 'pull_request' && needs.verify.result ==
      'success' && github.event.pull_request.head.repo.full_name == github.repository))
    needs: [verify, publish]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      actions: write
    steps:
      - name: Delete this run's artifacts
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/artifacts" --paginate --jq '.artifacts[].id' |
            while read -r id; do
              gh api --method DELETE "repos/$GITHUB_REPOSITORY/actions/artifacts/$id"
            done