release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  RELEASE_VERSION: ${{ github.ref_name }}

jobs:
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-14
            target: aarch64-apple-darwin
          - os: macos-15-intel
            target: x86_64-apple-darwin
          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
          - os: ubuntu-latest
            target: aarch64-unknown-linux-musl
          - os: windows-latest
            target: x86_64-pc-windows-msvc
          - os: windows-latest
            target: aarch64-pc-windows-msvc

    steps:
      - uses: actions/checkout@v5

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target
          shared-key: release-${{ matrix.target }}
          cache-workspace-crates: true

      - name: Install cross
        if: ${{ contains(matrix.target, 'unknown-linux-musl') }}
        run: cargo install cross --locked

      - name: Install musl-tools
        if: contains(matrix.target, 'unknown-linux-musl')
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools

      - name: Install qemu for Linux arm64 smoke test
        if: matrix.target == 'aarch64-unknown-linux-musl'
        run: |
          sudo apt-get update
          sudo apt-get install -y qemu-user

      - name: Configure Windows arm64 linker
        if: matrix.target == 'aarch64-pc-windows-msvc'
        shell: pwsh
        run: |
          "CARGO_TARGET_AARCH64_PC_WINDOWS_MSVC_LINKER=rust-lld" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      - name: Build (musl targets)
        if: ${{ contains(matrix.target, 'unknown-linux-musl') }}
        run: cross build --release -p bitloops-inference --target ${{ matrix.target }}

      - name: Build (non-musl targets)
        if: ${{ !contains(matrix.target, 'unknown-linux-musl') }}
        run: cargo build --release -p bitloops-inference --target ${{ matrix.target }}

      - name: Smoke test (Unix)
        if: runner.os != 'Windows' && matrix.target != 'aarch64-unknown-linux-musl'
        run: ./target/${{ matrix.target }}/release/bitloops-inference --help >/dev/null

      - name: Smoke test (Linux arm64 via qemu)
        if: matrix.target == 'aarch64-unknown-linux-musl'
        run: qemu-aarch64 ./target/${{ matrix.target }}/release/bitloops-inference --help >/dev/null

      - name: Smoke test (Windows)
        if: matrix.target == 'x86_64-pc-windows-msvc'
        shell: pwsh
        run: |
          & "target/${{ matrix.target }}/release/bitloops-inference.exe" --help | Out-Null

      - name: Validate Windows arm64 build output
        if: matrix.target == 'aarch64-pc-windows-msvc'
        shell: pwsh
        run: |
          $exe = "target/${{ matrix.target }}/release/bitloops-inference.exe"
          if (-not (Test-Path $exe)) {
            throw "Missing expected binary: $exe"
          }

      - name: Import Apple signing certificate
        if: runner.os == 'macOS'
        env:
          APPLE_CERT_P12_BASE64: ${{ secrets.APPLE_CERT_P12_BASE64 }}
          APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
        run: |
          echo "$APPLE_CERT_P12_BASE64" | base64 --decode > apple-cert.p12

          security create-keychain -p temp123 build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p temp123 build.keychain
          security set-keychain-settings -lut 21600 build.keychain

          security import apple-cert.p12 \
            -k build.keychain \
            -P "$APPLE_CERT_PASSWORD" \
            -T /usr/bin/codesign \
            -T /usr/bin/security

          security set-key-partition-list \
            -S apple-tool:,apple: \
            -s \
            -k temp123 \
            build.keychain

      - name: Sign macOS binary
        if: runner.os == 'macOS'
        env:
          APPLE_SIGNING_IDENTITY: ${{ vars.APPLE_SIGNING_IDENTITY }}
        run: |
          codesign --force --options runtime --timestamp \
            --sign "$APPLE_SIGNING_IDENTITY" \
            "target/${{ matrix.target }}/release/bitloops-inference"

      - name: Verify macOS signature
        if: runner.os == 'macOS'
        run: |
          codesign --verify --verbose=4 "target/${{ matrix.target }}/release/bitloops-inference"
          codesign --display --verbose=4 "target/${{ matrix.target }}/release/bitloops-inference"
          spctl -a -t exec -vv "target/${{ matrix.target }}/release/bitloops-inference" || true

      - name: Package (Linux)
        if: runner.os == 'Linux'
        run: |
          mkdir -p dist/package
          cp "target/${{ matrix.target }}/release/bitloops-inference" dist/package/bitloops-inference
          tar -C dist/package -czf "dist/bitloops-inference-${{ env.RELEASE_VERSION }}-${{ matrix.target }}.tar.gz" bitloops-inference

      - name: Package (macOS)
        if: runner.os == 'macOS'
        run: |
          mkdir -p dist/package
          cp "target/${{ matrix.target }}/release/bitloops-inference" dist/package/bitloops-inference
          ditto -c -k --keepParent dist/package "dist/bitloops-inference-${{ env.RELEASE_VERSION }}-${{ matrix.target }}.zip"

      - name: Restore App Store Connect key
        if: runner.os == 'macOS'
        env:
          APPSTORE_CONNECT_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_CONNECT_API_KEY_P8_BASE64 }}
        run: |
          echo "$APPSTORE_CONNECT_API_KEY_P8_BASE64" | base64 --decode > AuthKey.p8

      - name: Notarise macOS archive
        if: runner.os == 'macOS'
        env:
          APPSTORE_CONNECT_KEY_ID: ${{ vars.APPSTORE_CONNECT_KEY_ID }}
          APPSTORE_CONNECT_ISSUER_ID: ${{ vars.APPSTORE_CONNECT_ISSUER_ID }}
        run: |
          xcrun notarytool submit "dist/bitloops-inference-${{ env.RELEASE_VERSION }}-${{ matrix.target }}.zip" \
            --key AuthKey.p8 \
            --key-id "$APPSTORE_CONNECT_KEY_ID" \
            --issuer "$APPSTORE_CONNECT_ISSUER_ID" \
            --wait

      - name: Package (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Path dist/package -Force | Out-Null
          Copy-Item "target/${{ matrix.target }}/release/bitloops-inference.exe" "dist/package/bitloops-inference.exe" -Force
          Compress-Archive -Path dist/package/* -DestinationPath "dist/bitloops-inference-${{ env.RELEASE_VERSION }}-${{ matrix.target }}.zip"

      - name: Upload build artefact
        uses: actions/upload-artifact@v6
        with:
          name: release-${{ matrix.target }}
          path: dist/bitloops-inference-${{ env.RELEASE_VERSION }}-${{ matrix.target }}.*

  publish:
    name: Publish release
    runs-on: ubuntu-latest
    needs: build
    permissions:
      contents: write
    env:
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
    steps:
      - name: Download packaged artefacts
        uses: actions/download-artifact@v7
        with:
          path: dist
          merge-multiple: true

      - name: Generate checksums
        run: |
          cd dist
          sha256sum bitloops-inference-${{ env.RELEASE_VERSION }}-* > checksums-sha256.txt

      - name: Remove stale release assets
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if ! gh release view "${{ github.ref_name }}" >/dev/null 2>&1; then
            exit 0
          fi

          gh release view "${{ github.ref_name }}" --json assets --jq '.assets[].name' |
            while IFS= read -r asset; do
              case "$asset" in
                bitloops-inference-${{ env.RELEASE_VERSION }}-*)
                  ;;
                bitloops-inference-*)
                  gh release delete-asset "${{ github.ref_name }}" "$asset" --yes
                  ;;
              esac
            done

      - name: Publish to GitHub Releases
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          overwrite_files: true
          files: |
            dist/bitloops-inference-${{ env.RELEASE_VERSION }}-*
            dist/checksums-sha256.txt

      - name: Send Slack notification
        if: env.SLACK_WEBHOOK_URL != ''
        uses: slackapi/slack-github-action@v3.0.1
        with:
          webhook: ${{ env.SLACK_WEBHOOK_URL }}
          webhook-type: incoming-webhook
          payload: |
            text: "🚀 bitloops-inference ${{ github.ref_name }} has been released!"