release.yml

name: Release

on:
  push:
    tags:
      - 'v[0-9]+.*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version string — must end in -test (e.g. v0.1.0-test)'
        required: true
        default: 'v0.0.0-test'

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"
  SQLX_OFFLINE: "true"
  VERSION: ${{ inputs.version || github.ref_name }}

jobs:
  build-dashboard:
    name: Build dashboard
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Enforce -test suffix on dispatch
        if: github.event_name == 'workflow_dispatch'
        run: |
          if [[ "${{ inputs.version }}" != *-test ]]; then
            echo "::error::Dispatch version must end in -test (got: ${{ inputs.version }})"
            exit 1
          fi
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: "24"
          cache: npm
          cache-dependency-path: dashboard/package-lock.json
      - name: Install dependencies
        working-directory: dashboard
        run: npm ci
      - name: Build static SPA
        working-directory: dashboard
        run: npm run build:strict:static
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: dashboard-build
          path: dashboard/build/
          retention-days: 1

  build:
    name: Build ${{ matrix.target }}
    needs: build-dashboard
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # `features`: sql_policy (D42) builds vendored libpg_query — enabled
          # where the C build is known-good. Windows stays without it for now
          # (libpg_query gained MSVC support but the pg_query.rs bindgen build
          # is unverified on the runner; without the feature the binary fails
          # closed — SQL-annotated actions always route to approval). See
          # TECH_DEBT.md.
          - target: x86_64-unknown-linux-gnu
            runner: ubuntu-24.04
            archive_ext: tar.gz
            features: embed-dashboard,sql_policy
          - target: aarch64-unknown-linux-gnu
            runner: ubuntu-24.04-arm
            archive_ext: tar.gz
            features: embed-dashboard,sql_policy
          - target: aarch64-apple-darwin
            runner: macos-latest
            archive_ext: tar.gz
            features: embed-dashboard,sql_policy
          - target: x86_64-pc-windows-msvc
            runner: windows-latest
            archive_ext: zip
            features: embed-dashboard
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable branch
        with:
          # Pinned explicitly rather than left to the action's `stable` default:
          # keep in sync with rust-toolchain.toml, or the action installs one
          # toolchain and cargo silently downloads another on the first build.
          toolchain: "1.98"
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: ${{ matrix.target }}
          cache-on-failure: true
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: dashboard-build
          path: dashboard/build
      - name: Build
        shell: bash
        # OVERSLASH_VERSION (tag without the `v` prefix) overrides the crate
        # version reported by `--version`, the startup banner, and DCR.
        # OVERSLASH_GIT_SHA pins the commit reported by /health and
        # GET /v1/version; actions/checkout leaves a repo behind so build.rs
        # could find it itself, but the tag build should name the *released*
        # commit explicitly rather than whatever HEAD happens to be.
        run: OVERSLASH_VERSION="${VERSION#v}" OVERSLASH_GIT_SHA="$GITHUB_SHA" cargo build --release --package overslash-cli --features "${{ matrix.features }}" --locked
      - name: Strip binary
        if: runner.os != 'Windows'
        run: strip target/release/overslash
      - name: Package (Linux/macOS)
        if: runner.os != 'Windows'
        run: >-
          tar czf
          "overslash-${{ env.VERSION }}-${{ matrix.target }}.tar.gz"
          -C target/release overslash
      - name: Package (Windows)
        if: runner.os == 'Windows'
        shell: bash
        run: |
          cp target/release/overslash.exe overslash.exe
          7z a "overslash-${{ env.VERSION }}-${{ matrix.target }}.zip" overslash.exe
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: artifacts-${{ matrix.target }}
          path: overslash-${{ env.VERSION }}-${{ matrix.target }}.${{ matrix.archive_ext }}
          if-no-files-found: error
          retention-days: 1

  checksums:
    name: Checksums
    needs: build
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: artifacts-*
          merge-multiple: true
      - name: Generate SHA256SUMS.txt
        run: sha256sum overslash-* | sort > SHA256SUMS.txt
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: checksums
          path: SHA256SUMS.txt
          retention-days: 1

  release:
    name: Publish release
    needs: [build, checksums]
    # Dispatch runs validate the build but don't publish — download artifacts from the run instead.
    if: github.event_name == 'push'
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: artifacts-*
          merge-multiple: true
          path: dist/
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: checksums
          path: dist/
      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          files: dist/**
          generate_release_notes: true
          fail_on_unmatched_files: true