release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            runner: ubuntu-latest
            archive: tar.gz
            use-cross: false
          - target: aarch64-unknown-linux-gnu
            runner: ubuntu-latest
            archive: tar.gz
            use-cross: true
          - target: x86_64-apple-darwin
            runner: macos-14
            archive: tar.gz
            use-cross: false
          - target: aarch64-apple-darwin
            runner: macos-14
            archive: tar.gz
            use-cross: false
          - target: x86_64-pc-windows-msvc
            runner: windows-latest
            archive: zip
            use-cross: false

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        run: |
          rustup update stable
          rustup default stable
          rustup target add ${{ matrix.target }}

      - name: Install cross
        if: matrix.use-cross
        run: cargo install cross --locked

      - name: Build
        run: |
          if [ "${{ matrix.use-cross }}" = "true" ]; then
            cross build --release --target ${{ matrix.target }}
          else
            cargo build --release --target ${{ matrix.target }}
          fi
        shell: bash

      - name: Package (Unix)
        if: matrix.archive == 'tar.gz'
        run: |
          cd target/${{ matrix.target }}/release
          tar czf ../../../authy-${{ matrix.target }}.tar.gz authy
        shell: bash

      - name: Package (Windows)
        if: matrix.archive == 'zip'
        run: |
          cd target/${{ matrix.target }}/release
          7z a ../../../authy-${{ matrix.target }}.zip authy.exe
        shell: bash

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: authy-${{ matrix.target }}
          path: authy-${{ matrix.target }}.${{ matrix.archive }}

  release:
    name: GitHub Release
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: artifacts/**/*

  # ── Node.js native binding (napi-rs) ────────────────────────────

  node-build:
    name: Node.js ${{ matrix.node-arch }}
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            runner: ubuntu-latest
            node-arch: linux-x64-gnu
          - target: aarch64-unknown-linux-gnu
            runner: ubuntu-latest
            node-arch: linux-arm64-gnu
            use-napi-cross: true
          - target: x86_64-apple-darwin
            runner: macos-14
            node-arch: darwin-x64
          - target: aarch64-apple-darwin
            runner: macos-14
            node-arch: darwin-arm64
          - target: x86_64-pc-windows-msvc
            runner: windows-latest
            node-arch: win32-x64-msvc

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        run: |
          rustup update stable
          rustup default stable
          rustup target add ${{ matrix.target }}

      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install napi-rs CLI
        run: npm install -g @napi-rs/cli

      - name: Install aarch64 cross-compilation toolchain
        if: matrix.use-napi-cross
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu

      - name: Build native module
        working-directory: bindings/node
        run: napi build --release --target ${{ matrix.target }} --platform
        shell: bash
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: ${{ matrix.use-napi-cross && 'aarch64-linux-gnu-gcc' || '' }}

      - name: Upload native artifact
        uses: actions/upload-artifact@v4
        with:
          name: node-${{ matrix.node-arch }}
          path: bindings/node/*.node
          if-no-files-found: error

  # ── Publish unified npm package (native binding + CLI binary) ───

  npm-publish:
    name: Publish npm package
    needs: [build, node-build, release]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: https://registry.npmjs.org

      # Collect napi-rs .node files
      - name: Download native binding artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: node-*
          path: bindings/node
          merge-multiple: true

      # Collect prebuilt CLI binaries
      - name: Download CLI binary artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Place CLI binaries into package
        run: |
          # Linux x64
          tar xzf artifacts/authy-x86_64-unknown-linux-gnu/authy-x86_64-unknown-linux-gnu.tar.gz -C /tmp
          mv /tmp/authy bindings/node/bin/authy-linux-x64

          # Linux arm64
          tar xzf artifacts/authy-aarch64-unknown-linux-gnu/authy-aarch64-unknown-linux-gnu.tar.gz -C /tmp
          mv /tmp/authy bindings/node/bin/authy-linux-arm64

          # macOS x64
          tar xzf artifacts/authy-x86_64-apple-darwin/authy-x86_64-apple-darwin.tar.gz -C /tmp
          mv /tmp/authy bindings/node/bin/authy-darwin-x64

          # macOS arm64
          tar xzf artifacts/authy-aarch64-apple-darwin/authy-aarch64-apple-darwin.tar.gz -C /tmp
          mv /tmp/authy bindings/node/bin/authy-darwin-arm64

          # Windows x64
          cd artifacts/authy-x86_64-pc-windows-msvc
          7z x authy-x86_64-pc-windows-msvc.zip -o/tmp/win
          cd ../..
          mv /tmp/win/authy.exe bindings/node/bin/authy-win32-x64.exe

          # Make all binaries executable
          chmod +x bindings/node/bin/authy-*

      - name: List package contents
        run: |
          echo "=== Native modules ==="
          ls -la bindings/node/*.node
          echo "=== CLI binaries ==="
          ls -la bindings/node/bin/

      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Update package version
        working-directory: bindings/node
        run: npm version "${{ steps.version.outputs.version }}" --no-git-tag-version --allow-same-version

      - name: Publish
        working-directory: bindings/node
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish --access public

  # ── Python native binding (PyO3 + maturin) ─────────────────────

  python-build:
    name: Python ${{ matrix.target }}
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            runner: ubuntu-latest
          - target: aarch64-unknown-linux-gnu
            runner: ubuntu-latest
          - target: x86_64-apple-darwin
            runner: macos-14
          - target: aarch64-apple-darwin
            runner: macos-14
          - target: x86_64-pc-windows-msvc
            runner: windows-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist -i 3.9 3.10 3.11 3.12 3.13
          manylinux: auto
          working-directory: bindings/python

      - name: Upload wheel artifacts
        uses: actions/upload-artifact@v4
        with:
          name: python-wheel-${{ matrix.target }}
          path: bindings/python/dist/*.whl

  python-sdist:
    name: Python sdist
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist
          working-directory: bindings/python

      - name: Upload sdist artifact
        uses: actions/upload-artifact@v4
        with:
          name: python-sdist
          path: bindings/python/dist/*.tar.gz

  pypi-publish:
    name: Publish to PyPI
    needs: [python-build, python-sdist, release]
    runs-on: ubuntu-latest
    steps:
      - name: Download wheel artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: python-wheel-*
          path: dist
          merge-multiple: true

      - name: Download sdist artifact
        uses: actions/download-artifact@v4
        with:
          name: python-sdist
          path: dist

      - name: List distributions
        run: ls -la dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_TOKEN }}

  # ── Go module tag ──────────────────────────────────────────────

  go-tag:
    name: Tag Go module
    needs: release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"

      - name: Create Go subdirectory tag
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          TAG="packages/go/${{ steps.version.outputs.version }}"
          if git ls-remote --tags origin "$TAG" | grep -q "$TAG"; then
            echo "Tag $TAG already exists, skipping"
          else
            git tag "$TAG"
            git push origin "$TAG"
          fi