release.yml

name: Release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag_name:
        description: "Existing release tag to attach assets to, e.g. v0.5.2"
        required: true

permissions:
  contents: write

env:
  CARGO_INCREMENTAL: "0"

jobs:
  release-meta:
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    outputs:
      tag_name: ${{ steps.meta.outputs.tag_name }}
      release_name: ${{ steps.meta.outputs.release_name }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - id: meta
        name: Resolve release tag
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
          RELEASE_NAME: ${{ github.event.release.name }}
          INPUT_TAG: ${{ inputs.tag_name }}
        run: |
          set -euo pipefail
          if [[ "${EVENT_NAME}" == "release" ]]; then
            tag="${RELEASE_TAG}"
            release_name="${RELEASE_NAME}"
          else
            tag="${INPUT_TAG}"
            if [[ -z "$tag" ]]; then
              echo "::error::tag_name is required for manual releases"
              exit 1
            fi
            release_name="synapse-rmcp ${tag}"
          fi
          [[ "${tag}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]] || {
            echo "::error::invalid release tag: ${tag}"; exit 1;
          }
          echo "tag_name=${tag}" >> "$GITHUB_OUTPUT"
          echo "release_name=${release_name}" >> "$GITHUB_OUTPUT"

  build:
    needs: release-meta
    permissions:
      contents: write
      id-token: write
      attestations: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            artifact: synapse-linux-x86_64
            archive: synapse-x86_64.tar.gz
            ext: ""
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ needs.release-meta.outputs.tag_name }}

      - name: Install Rust and kache
        uses: ./.github/actions/setup-rust-kache
        with:
          toolchain: 1.97.1
          targets: ${{ matrix.target }}

      - name: Build web assets
        shell: bash
        run: |
          set -euo pipefail
          if [[ -f apps/web/package.json ]]; then
            cd apps/web
            npm install -g "$(node -p "require('./package.json').packageManager")"
            pnpm install --frozen-lockfile
            pnpm build
          fi

      - name: Build (linux)
        if: matrix.target == 'x86_64-unknown-linux-gnu'
        run: cargo build --release --locked --target ${{ matrix.target }} --bin synapse

      - name: Stage artifact + checksum
        run: |
          cp "target/${{ matrix.target }}/release/synapse${{ matrix.ext }}" "${{ matrix.artifact }}"
          sha256sum "${{ matrix.artifact }}" > "${{ matrix.artifact }}.sha256"
          mkdir -p archive
          cp "${{ matrix.artifact }}" "archive/synapse${{ matrix.ext }}"
          tar -C archive -czf "${{ matrix.archive }}" "synapse${{ matrix.ext }}"
          sha256sum "${{ matrix.archive }}" > "${{ matrix.archive }}.sha256"

      - name: Attest distributed archive provenance
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4
        with:
          subject-path: ${{ matrix.archive }}

      - name: Upload as workflow artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
        with:
          name: ${{ matrix.artifact }}
          path: |
            ${{ matrix.artifact }}
            ${{ matrix.artifact }}.sha256
            ${{ matrix.archive }}
            ${{ matrix.archive }}.sha256

  publish-release:
    needs: [release-meta, build]
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - name: Download release assets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.0
        with:
          path: dist/release-assets
          merge-multiple: true

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
        with:
          tag_name: ${{ needs.release-meta.outputs.tag_name }}
          name: ${{ needs.release-meta.outputs.release_name }}
          target_commitish: ${{ github.sha }}
          files: dist/release-assets/*

  npm:
    needs: [release-meta, publish-release]
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ needs.release-meta.outputs.tag_name }}
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org

      - name: Validate npm publication identity
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm whoami >/dev/null

      - name: Verify npm package version matches release tag
        id: npm-version
        shell: bash
        run: |
          set -euo pipefail
          tag="${{ needs.release-meta.outputs.tag_name }}"
          version="$(node -p "require('./packages/synapse-rmcp/package.json').version")"
          if node -e "process.exit(Object.hasOwn(require('./packages/synapse-rmcp/package.json'), 'binaryVersion') ? 0 : 1)"; then
            echo "::error::remove binaryVersion; the launcher must derive its binary tag from package version"
            exit 1
          fi
          if [[ "$tag" != "v${version}" ]]; then
            echo "::error::release tag ${tag} does not match packages/synapse-rmcp/package.json version ${version}"
            exit 1
          fi
          echo "version=${version}" >> "$GITHUB_OUTPUT"

      - name: Test npm launcher
        run: npm test --prefix packages/synapse-rmcp
      - name: Check npm launcher syntax
        run: npm run check --prefix packages/synapse-rmcp
      - name: Dry-run npm package
        run: npm pack --dry-run --json ./packages/synapse-rmcp

      - name: Check whether npm version is already published
        id: published
        shell: bash
        run: |
          set -euo pipefail
          if npm view "@dinglebear/synapse@${{ steps.npm-version.outputs.version }}" version >/dev/null 2>&1; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish npm package
        if: steps.published.outputs.exists == 'false'
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish --provenance --access public ./packages/synapse-rmcp

      - name: Smoke published npm launcher
        shell: bash
        run: |
          set -euo pipefail
          cache="$(mktemp -d)"
          trap 'rm -rf "$cache"' EXIT
          for attempt in {1..12}; do
            if npm view "@dinglebear/synapse@${{ steps.npm-version.outputs.version }}" version >/dev/null 2>&1; then
              break
            fi
            if [[ "$attempt" == 12 ]]; then
              npm view "@dinglebear/synapse@${{ steps.npm-version.outputs.version }}" version
            fi
            sleep 5
          done
          npm_config_cache="$cache" npx -y "@dinglebear/synapse@${{ steps.npm-version.outputs.version }}" --version