moq-cli.yml

name: moq-cli

on:
  push:
    tags:
      - "moq-cli-v*"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  build:
    name: Build (${{ matrix.target }})
    runs-on: ${{ matrix.runs-on }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            runs-on: ubuntu-22.04
            deb-arch: amd64
            rpm-arch: x86_64
          - target: aarch64-unknown-linux-gnu
            runs-on: ubuntu-22.04-arm
            deb-arch: arm64
            rpm-arch: aarch64

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          targets: ${{ matrix.target }}

      - name: Parse version
        id: parse
        shell: bash
        run: .github/scripts/release.sh parse-version moq-cli

      - name: Set up packaging tools
        uses: ./.github/actions/setup-packaging

      - name: Build (release, glibc 2.34)
        shell: bash
        # Pin to glibc 2.34 so one binary covers Ubuntu 22.04+ (.deb)
        # and AlmaLinux/RHEL/Rocky 9+ (.rpm).
        run: cargo zigbuild --release --target ${{ matrix.target }}.2.34 -p moq-cli

      - name: Package bare binary
        shell: bash
        run: |
          # The crate is named moq-cli but its `[[bin]]` ships as `moq`.
          version="${{ steps.parse.outputs.version }}"
          target="${{ matrix.target }}"
          name="moq-cli-v${version}-${target}"
          mkdir -p dist
          cp "target/${target}/release/moq" "dist/${name}"

      - name: Package tarball (Homebrew)
        shell: bash
        env:
          VERSION: ${{ steps.parse.outputs.version }}
          TARGET: ${{ matrix.target }}
        run: |
          name="moq-cli-${VERSION}-${TARGET}"
          mkdir -p "dist/${name}/bin"
          cp "target/${TARGET}/release/moq" "dist/${name}/bin/moq"
          cp LICENSE-MIT LICENSE-APACHE "dist/${name}/"
          if [[ -f rs/moq-cli/README.md ]]; then
            cp rs/moq-cli/README.md "dist/${name}/"
          fi
          (cd dist && tar -czvf "${name}.tar.gz" "${name}" && rm -rf "${name}")

      - name: Package .deb (Ubuntu 22.04 toolchain)
        shell: bash
        env:
          VERSION: ${{ steps.parse.outputs.version }}
          ARCH: ${{ matrix.deb-arch }}
          BINARY_PATH: target/${{ matrix.target }}/release/moq
        run: |
          # nfpm doesn't expand ${VAR} in contents[].src or templating
          # there either, so render the env vars in ourselves.
          # shellcheck disable=SC2016  # envsubst varlist must be single-quoted
          envsubst '$VERSION $ARCH $BINARY_PATH' \
            < packaging/moq-cli/nfpm.yaml > /tmp/nfpm.yaml
          nfpm pkg --packager deb --config /tmp/nfpm.yaml --target dist/

      - name: Package .rpm
        shell: bash
        env:
          VERSION: ${{ steps.parse.outputs.version }}
          ARCH: ${{ matrix.rpm-arch }}
          BINARY_PATH: target/${{ matrix.target }}/release/moq
        run: |
          # shellcheck disable=SC2016  # envsubst varlist must be single-quoted
          envsubst '$VERSION $ARCH $BINARY_PATH' \
            < packaging/moq-cli/nfpm.yaml > /tmp/nfpm.yaml
          nfpm pkg --packager rpm --config /tmp/nfpm.yaml --target dist/

      - name: Upload artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: moq-cli-${{ matrix.target }}
          path: dist/*

  build-tarball-macos:
    name: Build macOS tarball (${{ matrix.target }})
    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        include:
          # Both Apple targets build on the Apple Silicon runner. The
          # Determinate Nix installer dropped Intel macOS, so x86_64 is
          # cross-compiled (Apple clang is multi-arch) and its smoke test
          # runs under Rosetta. See rs/scripts/package-binary.sh.
          - target: x86_64-apple-darwin
            os: macos-latest
          - target: aarch64-apple-darwin
            os: macos-latest

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
        with:
          determinate: false

      # The cross build links system libs only, but its dyld smoke test must
      # actually run the x86_64 binary on this arm host. Idempotent no-op when
      # Rosetta is already present.
      - name: Install Rosetta (x86_64 smoke test)
        if: matrix.target == 'x86_64-apple-darwin'
        run: softwareupdate --install-rosetta --agree-to-license

      - name: Parse version
        id: parse
        shell: bash
        run: .github/scripts/release.sh parse-version moq-cli

      - name: Build and package tarball
        shell: bash
        run: |
          ./rs/scripts/package-binary.sh \
            --crate moq-cli \
            --bin moq \
            --target ${{ matrix.target }} \
            --version ${{ steps.parse.outputs.version }} \
            --output dist

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: moq-cli-${{ matrix.target }}
          path: dist/*

  build-windows:
    name: Build Windows zip (${{ matrix.target }})
    runs-on: windows-latest

    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-pc-windows-msvc

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          targets: ${{ matrix.target }}

      # aws-lc-rs assembles its x86_64 crypto with NASM on Windows.
      - name: Install NASM
        shell: pwsh
        run: |
          choco install nasm -y --no-progress
          "C:\Program Files\NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

      - name: Parse version
        id: parse
        shell: bash
        run: .github/scripts/release.sh parse-version moq-cli

      - name: Build and package zip
        shell: bash
        run: |
          ./rs/scripts/package-windows.sh \
            --crate moq-cli \
            --bin moq \
            --target ${{ matrix.target }} \
            --version ${{ steps.parse.outputs.version }} \
            --output dist

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: moq-cli-${{ matrix.target }}
          path: dist/*

  release:
    name: Release
    needs: [build, build-tarball-macos, build-windows]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      actions: write

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Parse version
        id: parse
        run: .github/scripts/release.sh parse-version moq-cli

      - name: Find previous tag
        id: prev_tag
        run: .github/scripts/release.sh prev-tag moq-cli

      - name: Download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: artifacts
          merge-multiple: true

      - name: Create or update release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.ref_name }}
          RELEASE_TITLE: "moq-cli v${{ steps.parse.outputs.version }}"
          RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
        run: .github/scripts/release.sh create artifacts

      - name: Trigger apt/rpm repo publish
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: .github/scripts/trigger-repo-publish.sh