release.yml

name: release

on:
  push:
    tags: ['v*']
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: release-${{ github.repository }}
  cancel-in-progress: false

jobs:
  preflight:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Validate release tag and reject published reruns
        if: startsWith(github.ref, 'refs/tags/')
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z][0-9A-Za-z.-]*)?$ ]]; then
            echo "Invalid release tag: $RELEASE_TAG" >&2
            exit 1
          fi
          if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "A release already exists for $RELEASE_TAG; use a new tag instead of replacing published bytes." >&2
            exit 1
          fi

  build:
    needs: preflight
    name: Build ${{ matrix.rid }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - rid: win-x64
            asset_name: windows-amd64
            os: windows-latest
            ext: .exe
          - rid: win-arm64
            asset_name: windows-arm64
            os: windows-11-arm
            ext: .exe
          - rid: linux-x64
            asset_name: linux-amd64
            os: ubuntu-latest
            ext: ''
          - rid: osx-arm64
            asset_name: darwin-arm64
            os: macos-15
            ext: ''
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
      id-token: write
      attestations: write

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Install Linux AOT toolchain
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y clang zlib1g-dev

      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
        with:
          global-json-file: global.json
          cache: true
          cache-dependency-path: '**/packages.lock.json'

      - name: Determine version
        id: version
        shell: bash
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            version="${GITHUB_REF_NAME#v}"
          else
            version="0.0.0-dev"
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Restore
        run: dotnet restore --locked-mode

      - name: Build
        run: dotnet build --configuration Release --no-restore

      - name: Test
        run: dotnet test --configuration Release --no-build --verbosity normal

      - name: Publish AOT standalone binary
        shell: bash
        run: |
          dotnet publish src/SkillView.App/SkillView.App.csproj \
            -c Release -r ${{ matrix.rid }} \
            -p:PublishAot=true -p:StripSymbols=true \
            -p:RestoreLockedMode=true \
            -p:Version=${{ steps.version.outputs.version }} \
            -o dist/app

      - name: Publish AOT gh extension binary
        shell: bash
        run: |
          dotnet publish src/SkillView.GhExtension/SkillView.GhExtension.csproj \
            -c Release -r ${{ matrix.rid }} \
            -p:PublishAot=true -p:StripSymbols=true \
            -p:RestoreLockedMode=true \
            -p:Version=${{ steps.version.outputs.version }} \
            -o dist/ext

      - name: Smoke-test exact release binaries
        shell: bash
        run: |
          set -euo pipefail
          for binary in "dist/app/skillview${{ matrix.ext }}" "dist/ext/gh-skillview${{ matrix.ext }}"; do
            test -s "$binary"
            output=$("$binary" --version)
            echo "$output"
            [[ "$output" == *"${{ steps.version.outputs.version }}"* ]] || {
              echo "Release binary has an unexpected version: $output" >&2
              exit 1
            }
          done

      - name: Stage release assets
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p dist/out
          cp "dist/app/skillview${{ matrix.ext }}" \
             "dist/out/skillview-${{ matrix.asset_name }}${{ matrix.ext }}"
          cp "dist/ext/gh-skillview${{ matrix.ext }}" \
             "dist/out/gh-skillview-${{ matrix.asset_name }}${{ matrix.ext }}"

      - name: Record binary size and checksum
        shell: pwsh
        run: |
          $sumsFile = "dist/out/SHA256SUMS-${{ matrix.asset_name }}.txt"
          $lines = @()
          Get-ChildItem dist/out -File | Where-Object { $_.Name -notmatch '^SHA256SUMS' } | ForEach-Object {
            $hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
            $lines += "$hash  $($_.Name)"
            $sizeMb = [math]::Round($_.Length / 1MB, 2)
            Write-Host "$($_.Name)  ($sizeMb MB)"
          }
          # Write with explicit LF endings (not Add-Content's OS-default CRLF on Windows
          # runners) so `sha256sum -c` works when checked out on Linux/macOS too.
          $content = ($lines -join "`n") + "`n"
          [System.IO.File]::WriteAllText($sumsFile, $content, [System.Text.Encoding]::ASCII)

      - name: Attest build provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
        with:
          subject-path: |
            dist/out/skillview-${{ matrix.asset_name }}${{ matrix.ext }}
            dist/out/gh-skillview-${{ matrix.asset_name }}${{ matrix.ext }}

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: dist-${{ matrix.rid }}
          path: dist/out/*
          retention-days: 30

  release:
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Download all artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          pattern: dist-*
          path: artifacts/
          merge-multiple: true

      - name: Verify the complete asset set and checksums
        shell: bash
        run: |
          set -euo pipefail
          expected=(
            skillview-windows-amd64.exe skillview-windows-arm64.exe
            skillview-linux-amd64 skillview-darwin-arm64
            gh-skillview-windows-amd64.exe gh-skillview-windows-arm64.exe
            gh-skillview-linux-amd64 gh-skillview-darwin-arm64
            SHA256SUMS-windows-amd64.txt SHA256SUMS-windows-arm64.txt
            SHA256SUMS-linux-amd64.txt SHA256SUMS-darwin-arm64.txt
          )
          mapfile -t actual < <(find artifacts -maxdepth 1 -type f -printf '%f\n' | sort)
          mapfile -t wanted < <(printf '%s\n' "${expected[@]}" | sort)
          if [[ "${actual[*]}" != "${wanted[*]}" ]]; then
            printf 'Expected:\n%s\nActual:\n%s\n' "${wanted[*]}" "${actual[*]}" >&2
            exit 1
          fi
          for file in "${expected[@]}"; do test -s "artifacts/$file"; done
          (cd artifacts && for sums in SHA256SUMS-*.txt; do sha256sum --check "$sums"; done)

      - name: Compose release notes
        env:
          RELEASE_REF: ${{ github.ref_name }}
          RELEASE_REPO: ${{ github.repository }}
        run: |
          cat > release-notes.md <<EOF
          > SkillView is a Native AOT standalone build. Download the binary for your machine, mark it executable on macOS/Linux, and run \`skillview\`.
          >
          > Asset names use Go's OS/arch vocabulary (\`windows\`/\`linux\`/\`darwin\`, \`amd64\`/\`arm64\`) for both the standalone binary and the \`gh\` extension binary, matching the naming \`gh extension install\` requires.

          ## Downloads

          | File | Target |
          |------|--------|
          | \`skillview-windows-amd64.exe\` | Windows x64 standalone |
          | \`skillview-windows-arm64.exe\` | Windows ARM64 standalone |
          | \`skillview-linux-amd64\` | Linux x64 standalone |
          | \`skillview-darwin-arm64\` | macOS Apple Silicon standalone |
          | \`gh-skillview-*\` | \`gh\` extension binaries (same platform set) — installed automatically by \`gh extension install\`, not downloaded directly |
          | \`SHA256SUMS-*.txt\` | Per-platform checksums (standalone + extension binary) |

          ## Quick start

          \`\`\`bash
          chmod +x skillview-darwin-arm64
          mv skillview-darwin-arm64 /usr/local/bin/skillview
          skillview
          \`\`\`

          ## GitHub CLI extension

          \`\`\`bash
          gh extension install harder/gh-skillview
          gh skillview
          \`\`\`

          ## Homebrew

          On Apple Silicon macOS or x86_64 Linux, install the standalone app with:

          \`\`\`bash
          brew install harder/tap/skillview
          \`\`\`
          EOF

      - name: Publish release
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
        with:
          files: |
            artifacts/skillview-*
            artifacts/gh-skillview-*
            artifacts/SHA256SUMS-*.txt
          body_path: release-notes.md
          generate_release_notes: true
          append_body: true
          fail_on_unmatched_files: true
          overwrite_files: false
          draft: true
          prerelease: ${{ contains(github.ref_name, '-') }}

      - name: Publish completed draft
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          count=$(gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --json assets --jq '.assets | length')
          if [ "$count" -ne 12 ]; then
            echo "Expected 12 published assets, found $count" >&2
            exit 1
          fi
          gh release edit "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --draft=false

  # Generate a verified formula artifact for the tap's automatic release watcher.
  # The tap independently validates new releases on both supported platforms.
  publish-homebrew:
    needs: [build, release]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    if: ${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') }}
    env:
      RELEASE_REF: ${{ github.ref_name }}
      RELEASE_REPO: ${{ github.repository }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Download and verify published release assets
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          mkdir -p artifacts
          gh release download "$RELEASE_REF" --repo "$RELEASE_REPO" --dir artifacts
          (cd artifacts && for sums in SHA256SUMS-*.txt; do sha256sum --check "$sums"; done)

      - name: Generate formula
        shell: bash
        run: |
          set -euo pipefail
          python3 packaging/homebrew/render_formula.py \
            --tag "$RELEASE_REF" \
            --assets-dir artifacts \
            --output generated/homebrew/skillview.rb
          printf 'Generated verified Homebrew formula for %s\n' "$RELEASE_REF"

      - name: Upload generated formula
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: homebrew-formula-${{ github.ref_name }}
          path: generated/homebrew/skillview.rb
          retention-days: 30

  # Dark-launch scaffold only. Generates WinGet manifests from release assets
  # but does not submit them to microsoft/winget-pkgs yet.
  publish-winget:
    needs: [build, release]
    runs-on: windows-latest
    timeout-minutes: 10
    if: ${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') && vars.WINGET_ENABLED == 'true' }}
    env:
      RELEASE_REF: ${{ github.ref_name }}
      RELEASE_REPO: ${{ github.repository }}
      WINGET_PACKAGE_ID: harder.SkillView
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Download published Windows assets
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          New-Item -ItemType Directory -Force -Path artifacts | Out-Null
          gh release download $env:RELEASE_REF --repo $env:RELEASE_REPO --pattern '*windows*' --dir artifacts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Verify release assets and generate submission manifests
        shell: pwsh
        run: |
          ./packaging/winget/New-WinGetManifest.ps1 `
            -ReleaseRef $env:RELEASE_REF `
            -AssetsDir artifacts `
            -OutputDir generated/winget `
            -Repository $env:RELEASE_REPO

          Write-Host "Dark-launch only: generated WinGet manifests for $env:WINGET_PACKAGE_ID $env:RELEASE_REF"

      - name: Upload generated WinGet manifests
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: winget-manifests-${{ github.ref_name }}
          path: generated/winget/manifests/
          retention-days: 30

  notify-failure:
    needs: [preflight, build, release, publish-homebrew, publish-winget]
    if: failure()
    runs-on: ubuntu-latest
    permissions:
      issues: write
    env:
      RELEASE_REF: ${{ github.ref_name }}
    steps:
      - name: Create failure issue
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
        with:
          script: |
            const title = `Release workflow failed on ${process.env.RELEASE_REF}`;
            const owner = context.repo.owner;
            const repo = context.repo.repo;

            const { data: openIssues } = await github.rest.issues.listForRepo({
              owner,
              repo,
              state: 'open',
              per_page: 100
            });

            const existing = openIssues.find(issue => issue.title === title);
            if (existing) {
              core.info(`Open failure issue already exists: #${existing.number}`);
              return;
            }

            await github.rest.issues.create({
              owner,
              repo,
              title,
              body: [
                `The release workflow failed for \`${process.env.RELEASE_REF}\`.`,
                '',
                `- Workflow run: ${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`,
                '- Workflow guide: `.github/workflows/README.md`',
                '- Rollback runbook: `docs/runbooks/release-rollback.md`'
              ].join('\n')
            });