release.yml

name: release

on:
  push:
    tags: ["v[0-9]+.[0-9]+.[0-9]+"]

permissions:
  contents: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          # Native runners only — no cross-linking risk. Linux is musl/static
          # so one binary runs on any distro, matching how pgbot ships.
          - runner: ubuntu-latest
            target: x86_64-unknown-linux-musl
            os: linux
            arch: amd64
          - runner: ubuntu-24.04-arm
            target: aarch64-unknown-linux-musl
            os: linux
            arch: arm64
          - runner: macos-latest
            target: aarch64-apple-darwin
            os: darwin
            arch: arm64
          - runner: macos-latest
            target: x86_64-apple-darwin
            os: darwin
            arch: amd64
          # The test suite already runs on Windows in CI (tests/bin/fake_pgbot.rs),
          # so shipping a binary is one matrix entry.
          - runner: windows-latest
            target: x86_64-pc-windows-msvc
            os: windows
            arch: amd64
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable (no patch tag published)
        with:
          targets: ${{ matrix.target }}
      - name: musl toolchain
        if: matrix.os == 'linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools
      - name: build
        env:
          CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER: musl-gcc
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER: musl-gcc
        run: cargo build --release --locked --target ${{ matrix.target }}
      - name: package
        shell: bash
        run: |
          set -eu
          VERSION="${GITHUB_REF_NAME#v}"
          staging="pgterm_${VERSION}_${{ matrix.os }}_${{ matrix.arch }}"
          mkdir "$staging"
          if [ "${{ matrix.os }}" = "windows" ]; then
            cp "target/${{ matrix.target }}/release/pgterm.exe" README.md LICENSE "$staging/"
            7z a -tzip "$staging.zip" "$staging" > /dev/null
          else
            cp "target/${{ matrix.target }}/release/pgterm" README.md LICENSE "$staging/"
            tar -czf "$staging.tar.gz" "$staging"
          fi
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: archive-${{ matrix.os }}-${{ matrix.arch }}
          path: |
            pgterm_*.tar.gz
            pgterm_*.zip
          if-no-files-found: error

  publish:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          path: dist
          merge-multiple: true
      - name: checksums
        run: |
          set -eu
          cd dist
          sha256sum pgterm_*.tar.gz pgterm_*.zip > checksums.txt
          cat checksums.txt
      - name: create release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "$GITHUB_REF_NAME" \
            --repo "$GITHUB_REPOSITORY" \
            --title "pgterm $GITHUB_REF_NAME" \
            --generate-notes \
            dist/pgterm_*.tar.gz dist/pgterm_*.zip dist/checksums.txt

  smoke:
    needs: publish
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - name: download, verify, run --version
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -eu
          VERSION="${GITHUB_REF_NAME#v}"
          case "$(uname -s)" in Darwin) os=darwin;; *) os=linux;; esac
          case "$(uname -m)" in arm64|aarch64) arch=arm64;; *) arch=amd64;; esac
          gh release download "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" \
            --pattern "pgterm_${VERSION}_${os}_${arch}.tar.gz" --pattern checksums.txt
          if command -v sha256sum >/dev/null; then
            grep "pgterm_${VERSION}_${os}_${arch}.tar.gz" checksums.txt | sha256sum -c -
          else
            grep "pgterm_${VERSION}_${os}_${arch}.tar.gz" checksums.txt | shasum -a 256 -c -
          fi
          tar -xzf "pgterm_${VERSION}_${os}_${arch}.tar.gz"
          out="$("pgterm_${VERSION}_${os}_${arch}/pgterm" --version)"
          echo "$out"
          [ "$out" = "pgterm ${VERSION}" ] || { echo "version mismatch"; exit 1; }

  # The Windows artifact gets the same download-verify-run treatment as the
  # Unix ones: a packaging break is invisible to the test suite.
  smoke-windows:
    needs: publish
    runs-on: windows-latest
    steps:
      - name: download, verify, run --version
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          $ErrorActionPreference = "Stop"
          $version = $env:GITHUB_REF_NAME.TrimStart("v")
          $zip = "pgterm_${version}_windows_amd64.zip"
          gh release download $env:GITHUB_REF_NAME --repo $env:GITHUB_REPOSITORY --pattern $zip --pattern checksums.txt
          $want = (Select-String -Path checksums.txt -Pattern ([regex]::Escape($zip))).Line.Split(" ")[0]
          $got = (Get-FileHash $zip -Algorithm SHA256).Hash.ToLower()
          if ($want -ne $got) { throw "checksum mismatch: published $want, downloaded $got" }
          Expand-Archive $zip -DestinationPath .
          $out = & ".\pgterm_${version}_windows_amd64\pgterm.exe" --version
          Write-Host $out
          if ($out -ne "pgterm $version") { throw "version mismatch: $out" }

  # Homebrew: render Formula/pgterm.rb from the checksums just published and
  # push it to pgrundev/homebrew-tap. GITHUB_TOKEN cannot write to another
  # repository, so the push authenticates with a write deploy key registered
  # on the tap (secret HOMEBREW_TAP_DEPLOY_KEY on this repo — see
  # docs/releasing.md → Homebrew). No key → this job fails loudly rather than
  # letting `brew install pgrundev/tap/pgterm` silently lag behind.
  homebrew:
    needs: publish
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
      - name: render the formula from the published checksums
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -eu
          VERSION="${GITHUB_REF_NAME#v}"
          gh release download "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --pattern checksums.txt
          sh packaging/homebrew/formula.sh "$VERSION" checksums.txt > pgterm.rb
          cat pgterm.rb
      - name: push it to pgrundev/homebrew-tap
        env:
          HOMEBREW_TAP_DEPLOY_KEY: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
        run: |
          set -eu
          if [ -z "$HOMEBREW_TAP_DEPLOY_KEY" ]; then
            echo "::error::HOMEBREW_TAP_DEPLOY_KEY is not set — the Homebrew formula was NOT published for this release (brew install pgrundev/tap/pgterm will lag behind). See docs/releasing.md → Homebrew."
            exit 1
          fi
          mkdir -p ~/.ssh
          printf '%s\n' "$HOMEBREW_TAP_DEPLOY_KEY" > ~/.ssh/tap_key
          chmod 600 ~/.ssh/tap_key
          # GitHub's published SSH host key (docs.github.com → "GitHub's SSH
          # key fingerprints"), pinned instead of trusting a keyscan.
          echo "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl" >> ~/.ssh/known_hosts
          export GIT_SSH_COMMAND="ssh -i ~/.ssh/tap_key -o IdentitiesOnly=yes"
          git clone --depth 1 git@github.com:pgrundev/homebrew-tap.git tap
          cp pgterm.rb tap/Formula/pgterm.rb
          cd tap
          git config user.name pgterm-release
          git config user.email hello@pgrun.dev
          git add Formula/pgterm.rb
          git commit -m "pgterm $GITHUB_REF_NAME"
          git push origin HEAD:main

  # Prove the published formula installs THIS tag on a fresh mac, the way a
  # user does it. Both formulae are named on the command line: Homebrew 6
  # trusts exactly the third-party formulae you name, so the README's
  # one-liner installs pgterm and pgbot together without a `brew trust` step.
  brew-smoke:
    needs: homebrew
    name: brew install pgrundev/tap/pgterm
    runs-on: macos-latest
    steps:
      - name: brew install the tap formula and check the version
        run: |
          set -eu
          VERSION="${GITHUB_REF_NAME#v}"
          export HOMEBREW_NO_AUTO_UPDATE=1 HOMEBREW_NO_INSTALL_CLEANUP=1
          for i in $(seq 1 10); do
            brew untap pgrundev/tap >/dev/null 2>&1 || true
            if brew install pgrundev/tap/pgterm pgrundev/tap/pgbot && [ "$(pgterm --version)" = "pgterm ${VERSION}" ]; then
              echo "brew install pgrundev/tap/pgterm pgrundev/tap/pgbot → $(pgterm --version) / $(pgbot --version) ✓"
              brew test pgterm
              exit 0
            fi
            echo "tap formula not at ${VERSION} yet (attempt $i) — waiting"
            sleep 20
          done
          echo "FAILED: brew install pgrundev/tap/pgterm never yielded pgterm ${VERSION}"
          exit 1