release.yaml

name: release

on:
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - cmd/scip/version.txt

jobs:
  setup:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.resolve.outputs.version }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: main
      - id: resolve
        run: |
          # tr strips CRLF, trailing whitespace, blank lines, etc.
          VERSION=$(tr -d '[:space:]' < cmd/scip/version.txt)
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::cmd/scip/version.txt ($VERSION) must be MAJOR.MINOR.PATCH"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

  publish:
    needs: setup
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      version: ${{ needs.setup.outputs.version }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: main

      - name: Create and push tags
        run: |
          TAG="v${{ needs.setup.outputs.version }}"
          BINDINGS_TAG="bindings/go/scip/$TAG"
          for t in "$TAG" "$BINDINGS_TAG"; do
            if git rev-parse "$t" &>/dev/null; then
              if [ "$(git rev-parse "$t"^{})" != "$(git rev-parse HEAD)" ]; then
                echo "::error::Tag $t exists but points to a different commit"
                exit 1
              fi
              echo "Tag $t already exists at HEAD, skipping"
            else
              git tag "$t"
            fi
          done
          git push origin "$TAG" "$BINDINGS_TAG" 2>/dev/null || echo "Tags already pushed"

      - name: Create draft GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="v${{ needs.setup.outputs.version }}"
          if gh release view "$TAG" &>/dev/null; then
            DRAFT=$(gh release view "$TAG" --json isDraft -q '.isDraft')
            if [ "$DRAFT" = "false" ]; then
              echo "::error::Release $TAG is already published"
              exit 1
            fi
            echo "Draft release $TAG already exists, skipping creation"
            exit 0
          fi
          {
            echo 'Download the CLI for your current platform using:'
            echo ''
            echo '```bash'
            echo 'env \'
            echo "  TAG=\"$TAG\" \\"
            echo '  OS="$(uname -s | tr '"'"'[:upper:]'"'"' '"'"'[:lower:]'"'"')" \'
            echo '  ARCH="$(uname -m | sed -e '"'"'s/x86_64/amd64/'"'"')" \'
            echo '  bash -c '"'"'curl -L "https://github.com/scip-code/scip/releases/download/$TAG/scip-$OS-$ARCH.tar.gz"'"'"' \'
            echo '| tar xzf - scip'
            echo '```'
          } | gh release create "$TAG" --title "scip $TAG" --generate-notes --draft --notes-file -

  release-crate:
    needs: publish
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: v${{ needs.publish.outputs.version }}
      - uses: DeterminateSystems/nix-installer-action@v23
      - uses: DeterminateSystems/magic-nix-cache-action@v15
        with:
          use-flakehub: "disabled"
      - name: Publish crate
        run: |
          OUTPUT=$(nix develop -c cargo publish --token '${{ secrets.CRATES_TOKEN }}' 2>&1) && exit 0
          if echo "$OUTPUT" | grep -q "already uploaded"; then
            echo "Crate version already published, skipping"
          else
            echo "$OUTPUT"
            exit 1
          fi
        working-directory: bindings/rust

  publish-dotnet-bindings:
    needs: publish
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # NuGet trusted-publishing OIDC
    steps:
      - uses: actions/checkout@v7
        with:
          ref: v${{ needs.publish.outputs.version }}
      - uses: DeterminateSystems/nix-installer-action@v23
      - uses: DeterminateSystems/magic-nix-cache-action@v15
        with:
          use-flakehub: "disabled"
      # LICENSE and README.md are packed into the nupkg; LICENSE is a symlink
      # in-tree (matches bindings/{haskell,rust,typescript}) and dotnet pack
      # follows it, so no materialization step is needed.
      - name: Pack
        working-directory: bindings/dotnet
        run: nix develop -c dotnet pack -c Release
      # Trusted publishing: exchange this job's GitHub OIDC token for a
      # short-lived nuget.org API key, so no long-lived secret exists. The
      # trust policy on nuget.org must name this repository and this workflow
      # file (`release.yaml`, no environment); `user` is the nuget.org account
      # that owns the policy - a profile name, not an email. The key expires
      # after an hour, so this step stays immediately before the push.
      # See docs/Development.md for the nuget.org side of the setup.
      - uses: NuGet/login@v1
        id: nuget-login
        with:
          user: ${{ secrets.NUGET_USER }}
      - name: Publish to NuGet
        working-directory: bindings/dotnet
        # --skip-duplicate keeps re-runs of a partially failed release green;
        # NuGet publications are irreversible, like the other registries here.
        run: |
          nix develop -c dotnet nuget push \
            'bin/Release/Scip.${{ needs.publish.outputs.version }}.nupkg' \
            --source https://api.nuget.org/v3/index.json \
            --api-key '${{ steps.nuget-login.outputs.NUGET_API_KEY }}' \
            --skip-duplicate

  publish-haskell-bindings:
    needs: publish
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: v${{ needs.publish.outputs.version }}
      - uses: DeterminateSystems/nix-installer-action@v23
      - uses: DeterminateSystems/magic-nix-cache-action@v15
        with:
          use-flakehub: "disabled"
      - name: Build sdist
        working-directory: bindings/haskell
        run: |
          nix develop -c cabal check
          nix develop -c cabal sdist
      - name: Publish to Hackage
        uses: haskell-actions/hackage-publish@v1.1
        with:
          hackageServer: https://hackage.haskell.org
          hackageToken: ${{ secrets.HACKAGE_TOKEN }}
          packagesPath: bindings/haskell/dist-newstyle/sdist
          publish: true

  publish-jvm-bindings:
    needs: publish
    runs-on: ubuntu-latest
    # Maven Central publication with waitUntil=published can block for
    # 10-30 min per module while Sonatype mirrors propagate. Two
    # sequential deploys (Java then Kotlin, which resolves Java from
    # Central) means worst-case ~60 min.
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v7
        with:
          ref: v${{ needs.publish.outputs.version }}

      - uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 25.0.4+101.0.LTS
          cache: maven
          server-id: central
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}

      # scip-kotlin-bindings depends on scip-java-bindings at the same
      # version and resolves it from Central, not from this runner. The
      # release profile sets waitUntil=published, so the Java step
      # blocks until the artifact is live on repo1.maven.org before the
      # Kotlin step runs.
      - name: Deploy scip-java-bindings to Maven Central
        run: mvn -B -ntp -Prelease -f bindings/java/pom.xml deploy
        env:
          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}

      - name: Deploy scip-kotlin-bindings to Maven Central
        run: mvn -B -ntp -Prelease -f bindings/kotlin/pom.xml deploy
        env:
          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}

  publish-npm:
    needs: publish
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # npm trusted-publishing OIDC
    steps:
      - uses: actions/checkout@v7
        with:
          ref: v${{ needs.publish.outputs.version }}
      - uses: actions/setup-node@v7
        with:
          # Trusted publishing needs npm >=11.5.1; Node 22 LTS ships npm 10.x.
          node-version: 24
          cache: npm
          cache-dependency-path: bindings/typescript/package-lock.json
      - name: Install dependencies
        run: npm ci
        working-directory: bindings/typescript
      - name: Build
        run: npm run build
        working-directory: bindings/typescript
      # LICENSE is a symlink in-tree (matches bindings/{haskell,rust}); npm-pack drops symlinks.
      - name: Materialize LICENSE for npm pack
        run: |
          rm -f bindings/typescript/LICENSE
          cp LICENSE bindings/typescript/LICENSE
      - uses: JS-DevTools/npm-publish@v4
        with:
          package: bindings/typescript
          access: public
          provenance: true

  build-go-binaries:
    needs: publish
    permissions:
      contents: write
    strategy:
      matrix:
        include:
          - runner: ubuntu-latest
            goos: linux
            goarch: amd64
            asset_name: scip-linux-amd64
          - runner: ubuntu-latest
            goos: linux
            goarch: arm64
            asset_name: scip-linux-arm64
          - runner: macos-latest
            goos: darwin
            goarch: arm64
            asset_name: scip-darwin-arm64
          - runner: macos-latest
            goos: darwin
            goarch: amd64
            asset_name: scip-darwin-amd64

    runs-on: ${{ matrix.runner }}

    steps:
      - uses: actions/checkout@v7
        with:
          ref: v${{ needs.publish.outputs.version }}
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
      - name: Build
        env:
          CGO_ENABLED: '0'
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          GOWORK: 'off'
        run: go build -ldflags '-X main.Reproducible=true' -o scip ./cmd/scip
      - name: Package
        env:
          ASSET: ${{ matrix.asset_name }}
        run: |
          tar czf "$ASSET.tar.gz" scip LICENSE
          sha256sum "$ASSET.tar.gz" > "$ASSET.tar.gz.sha256" 2>/dev/null || \
            shasum -a 256 "$ASSET.tar.gz" > "$ASSET.tar.gz.sha256"
      - name: Upload release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ASSET: ${{ matrix.asset_name }}
        run: |
          TAG="v${{ needs.publish.outputs.version }}"
          DRAFT=$(gh release view "$TAG" --json isDraft -q '.isDraft')
          if [ "$DRAFT" = "false" ]; then
            echo "::error::Release $TAG is already published, refusing to upload"
            exit 1
          fi
          gh release upload "$TAG" "$ASSET.tar.gz" "$ASSET.tar.gz.sha256" --clobber

  finalize-release:
    needs: [publish, release-crate, publish-dotnet-bindings, publish-haskell-bindings, build-go-binaries, publish-jvm-bindings, publish-npm]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
      - name: Mark release as non-draft
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release edit "v${{ needs.publish.outputs.version }}" --draft=false