release-cli.yml

name: Release CLI

on:
  push:
    branches: [main]
    paths:
      - "apps/cli/**"
      - ".github/workflows/release-cli.yml"
      - ".github/workflows/update-homebrew-tap.yml"
  workflow_dispatch:
    inputs:
      version:
        description: Expected apps/cli version (without leading v)
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: release-cli-${{ github.ref }}
  cancel-in-progress: false

jobs:
  check-version:
    name: Check CLI Version Change
    runs-on: ubuntu-latest
    outputs:
      release-needed: ${{ steps.check.outputs.release_needed }}
      new-version: ${{ steps.check.outputs.version }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Validate releasable version
        id: check
        env:
          BEFORE_SHA: ${{ github.event.before }}
          EVENT_NAME: ${{ github.event_name }}
          REQUESTED_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail

          if [ "$GITHUB_REF" != "refs/heads/main" ]; then
            echo "::error::CLI releases must run from the main branch (got ${GITHUB_REF})."
            exit 1
          fi

          CURRENT=$(node -p "require('./apps/cli/package.json').version")
          echo "version=$CURRENT" >> "$GITHUB_OUTPUT"

          if [[ ! "$CURRENT" =~ ^[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?$ ]] || [ "$CURRENT" = "0.0.0" ]; then
            echo "::error::apps/cli/package.json has invalid release version '${CURRENT}'."
            exit 1
          fi

          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            if [ "$REQUESTED_VERSION" != "$CURRENT" ]; then
              echo "::error::Requested version '${REQUESTED_VERSION}' does not match package version '${CURRENT}'."
              exit 1
            fi
          else
            if PREVIOUS_JSON=$(git show "${BEFORE_SHA}:apps/cli/package.json" 2>/dev/null); then
              PREVIOUS=$(node -p "JSON.parse(process.argv[1]).version" "$PREVIOUS_JSON")
            else
              echo "release_needed=false" >> "$GITHUB_OUTPUT"
              echo "::warning::Could not read apps/cli/package.json from before SHA ${BEFORE_SHA}; skipping automatic release. Use workflow_dispatch for an intentional first release."
              exit 0
            fi

            if [ "$CURRENT" = "$PREVIOUS" ]; then
              echo "release_needed=false" >> "$GITHUB_OUTPUT"
              echo "CLI version remains ${CURRENT}; no release requested." >> "$GITHUB_STEP_SUMMARY"
              exit 0
            fi
          fi

          set +e
          TAG_LOOKUP=$(git ls-remote --exit-code --refs --tags origin "refs/tags/v${CURRENT}" 2>&1)
          TAG_STATUS=$?
          set -e
          case "$TAG_STATUS" in
            0)
              echo "::error::Tag v${CURRENT} already exists; bump apps/cli/package.json instead of replacing a release."
              exit 1
              ;;
            2)
              ;;
            *)
              echo "::error::Could not check whether tag v${CURRENT} exists: ${TAG_LOOKUP}"
              exit "$TAG_STATUS"
              ;;
          esac

          echo "release_needed=true" >> "$GITHUB_OUTPUT"
          {
            echo "### CLI release candidate"
            echo "- Version: \`v${CURRENT}\`"
            echo "- Commit: \`${GITHUB_SHA}\`"
          } >> "$GITHUB_STEP_SUMMARY"

  build-cli:
    name: Build CLI (${{ matrix.platform }})
    needs: check-version
    if: needs.check-version.outputs.release-needed == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            platform: darwin-arm64
            target: bun-darwin-arm64
            archive: wrapper-darwin-arm64.tar.gz
            helper: wrapper-pty-helper-aarch64-macos-none
          - os: macos-latest
            platform: darwin-x64
            target: bun-darwin-x64
            archive: wrapper-darwin-x86_64.tar.gz
            helper: wrapper-pty-helper-x86_64-macos-none
          - os: ubuntu-latest
            platform: linux-x64
            target: bun-linux-x64
            archive: wrapper-linux-x86_64.tar.gz
            helper: wrapper-pty-helper-x86_64-linux-musl
          - os: ubuntu-latest
            platform: linux-arm64
            target: bun-linux-arm64
            archive: wrapper-linux-arm64.tar.gz
            helper: wrapper-pty-helper-aarch64-linux-musl
    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v5

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.5"

      - name: Install dependencies
        run: bun install --frozen-lockfile --ignore-scripts

      - name: Build standalone binary
        run: |
          mkdir -p dist
          bun build \
            --compile \
            --env=disable \
            --no-compile-autoload-dotenv \
            --no-compile-autoload-bunfig \
            --target="${{ matrix.target }}" \
            apps/cli/index.ts \
            --outfile dist/wrapper

      - name: Verify native release version
        if: matrix.platform == 'linux-x64'
        run: |
          dist/wrapper --version
          test "$(dist/wrapper --version)" = "$(node -p "require('./apps/cli/package.json').version")"

      - name: Package archive
        run: |
          test -x "apps/cli/bin/${{ matrix.helper }}"
          mkdir -p staging/bin
          cp dist/wrapper staging/bin/wrapper
          chmod +x staging/bin/wrapper
          cp "apps/cli/bin/${{ matrix.helper }}" "staging/bin/${{ matrix.helper }}"
          COPYFILE_DISABLE=1 tar -czf "dist/${{ matrix.archive }}" -C staging .
          python3 apps/cli/scripts/verify-release-archive.py \
            "dist/${{ matrix.archive }}" \
            "${{ matrix.helper }}"

      - name: Smoke native bundled helper
        if: matrix.platform == 'linux-x64'
        run: python3 apps/cli/scripts/smoke-release-binary.py staging/bin/wrapper

      - name: Upload archive artifact
        uses: actions/upload-artifact@v4
        with:
          name: cli-${{ matrix.platform }}
          path: dist/${{ matrix.archive }}
          if-no-files-found: error

  release:
    name: Create GitHub Release
    needs: [check-version, build-cli]
    if: needs.check-version.outputs.release-needed == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      sha_darwin_arm64: ${{ steps.shas.outputs.sha_darwin_arm64 }}
      sha_darwin_x64: ${{ steps.shas.outputs.sha_darwin_x64 }}
      sha_linux_arm64: ${{ steps.shas.outputs.sha_linux_arm64 }}
      sha_linux_x64: ${{ steps.shas.outputs.sha_linux_x64 }}
    env:
      VERSION: ${{ needs.check-version.outputs.new-version }}

    steps:
      - uses: actions/checkout@v5

      - name: Download archives
        uses: actions/download-artifact@v4
        with:
          pattern: cli-*
          path: dist
          merge-multiple: true

      - name: Compute checksums
        id: shas
        run: |
          python3 apps/cli/scripts/verify-release-archive.py \
            dist/wrapper-darwin-arm64.tar.gz \
            wrapper-pty-helper-aarch64-macos-none
          python3 apps/cli/scripts/verify-release-archive.py \
            dist/wrapper-darwin-x86_64.tar.gz \
            wrapper-pty-helper-x86_64-macos-none
          python3 apps/cli/scripts/verify-release-archive.py \
            dist/wrapper-linux-arm64.tar.gz \
            wrapper-pty-helper-aarch64-linux-musl
          python3 apps/cli/scripts/verify-release-archive.py \
            dist/wrapper-linux-x86_64.tar.gz \
            wrapper-pty-helper-x86_64-linux-musl
          {
            echo "sha_darwin_arm64=$(sha256sum dist/wrapper-darwin-arm64.tar.gz | cut -d' ' -f1)"
            echo "sha_darwin_x64=$(sha256sum dist/wrapper-darwin-x86_64.tar.gz | cut -d' ' -f1)"
            echo "sha_linux_arm64=$(sha256sum dist/wrapper-linux-arm64.tar.gz | cut -d' ' -f1)"
            echo "sha_linux_x64=$(sha256sum dist/wrapper-linux-x86_64.tar.gz | cut -d' ' -f1)"
          } >> "$GITHUB_OUTPUT"

      - name: Write checksums file
        run: |
          cd dist
          sha256sum \
            wrapper-darwin-arm64.tar.gz \
            wrapper-darwin-x86_64.tar.gz \
            wrapper-linux-arm64.tar.gz \
            wrapper-linux-x86_64.tar.gz > checksums.txt
          sha256sum --check checksums.txt
          cat checksums.txt

      - name: Create GitHub release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ env.VERSION }}
          name: Wrapper v${{ env.VERSION }}
          generate_release_notes: true
          files: |
            dist/wrapper-darwin-arm64.tar.gz
            dist/wrapper-darwin-x86_64.tar.gz
            dist/wrapper-linux-arm64.tar.gz
            dist/wrapper-linux-x86_64.tar.gz
            dist/checksums.txt
          fail_on_unmatched_files: true

  update-homebrew:
    name: Update Homebrew Tap
    needs: [check-version, release]
    if: needs.check-version.outputs.release-needed == 'true'
    uses: ./.github/workflows/update-homebrew-tap.yml
    with:
      version: ${{ needs.check-version.outputs.new-version }}
      sha_darwin_arm64: ${{ needs.release.outputs.sha_darwin_arm64 }}
      sha_darwin_x64: ${{ needs.release.outputs.sha_darwin_x64 }}
      sha_linux_arm64: ${{ needs.release.outputs.sha_linux_arm64 }}
      sha_linux_x64: ${{ needs.release.outputs.sha_linux_x64 }}
    secrets:
      HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}