release.yml

name: Release

on:
  push:
    tags:
      - "v*"

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Fetch tags and remote branches
        run: git fetch --force --tags origin '+refs/heads/*:refs/remotes/origin/*'

      - name: Setup tools
        uses: jdx/mise-action@v4

      - name: Validate release tag
        id: tagsmith
        run: bunx tagsmith@latest validate --tag "$GITHUB_REF_NAME" --github-output

      - name: Install dependencies
        run: bun install

      - name: Build for macOS ARM64
        working-directory: apps/cli
        run: |
          bun run build --target bun-darwin-arm64
          test -f dist/ai-git || { echo "ERROR: dist/ai-git not found after build"; exit 1; }
          cd dist
          tar -czf ai-git-darwin-arm64.tar.gz ai-git

      - name: Build for macOS x64
        working-directory: apps/cli
        run: |
          rm -f dist/ai-git
          bun run build --target bun-darwin-x64
          test -f dist/ai-git || { echo "ERROR: dist/ai-git not found after build"; exit 1; }
          cd dist
          tar -czf ai-git-darwin-x64.tar.gz ai-git

      - name: Build for Linux x64
        working-directory: apps/cli
        run: |
          rm -f dist/ai-git
          bun run build --target bun-linux-x64
          test -f dist/ai-git || { echo "ERROR: dist/ai-git not found after build"; exit 1; }
          cd dist
          tar -czf ai-git-linux-x64.tar.gz ai-git

      - name: Build for Linux ARM64
        working-directory: apps/cli
        run: |
          rm -f dist/ai-git
          bun run build --target bun-linux-arm64
          test -f dist/ai-git || { echo "ERROR: dist/ai-git not found after build"; exit 1; }
          cd dist
          tar -czf ai-git-linux-arm64.tar.gz ai-git

      - name: Build for Windows x64
        working-directory: apps/cli
        run: |
          rm -f dist/ai-git.exe
          bun run build --target bun-windows-x64
          test -f dist/ai-git.exe || { echo "ERROR: dist/ai-git.exe not found after build"; exit 1; }
          cd dist
          zip ai-git-windows-x64.zip ai-git.exe

      - name: Build for Windows ARM64
        working-directory: apps/cli
        run: |
          rm -f dist/ai-git.exe
          bun run build --target bun-windows-arm64
          test -f dist/ai-git.exe || { echo "ERROR: dist/ai-git.exe not found after build"; exit 1; }
          cd dist
          zip ai-git-windows-arm64.zip ai-git.exe

      - name: Upload macOS ARM64 artifact
        uses: actions/upload-artifact@v7
        with:
          name: build-darwin-arm64
          path: apps/cli/dist/ai-git-darwin-arm64.tar.gz
          if-no-files-found: error
          retention-days: 1

      - name: Upload macOS x64 artifact
        uses: actions/upload-artifact@v7
        with:
          name: build-darwin-x64
          path: apps/cli/dist/ai-git-darwin-x64.tar.gz
          if-no-files-found: error
          retention-days: 1

      - name: Upload Linux x64 artifact
        uses: actions/upload-artifact@v7
        with:
          name: build-linux-x64
          path: apps/cli/dist/ai-git-linux-x64.tar.gz
          if-no-files-found: error
          retention-days: 1

      - name: Upload Linux ARM64 artifact
        uses: actions/upload-artifact@v7
        with:
          name: build-linux-arm64
          path: apps/cli/dist/ai-git-linux-arm64.tar.gz
          if-no-files-found: error
          retention-days: 1

      - name: Upload Windows x64 artifact
        uses: actions/upload-artifact@v7
        with:
          name: build-windows-x64
          path: apps/cli/dist/ai-git-windows-x64.zip
          if-no-files-found: error
          retention-days: 1

      - name: Upload Windows ARM64 artifact
        uses: actions/upload-artifact@v7
        with:
          name: build-windows-arm64
          path: apps/cli/dist/ai-git-windows-arm64.zip
          if-no-files-found: error
          retention-days: 1

  verify-unix:
    needs: build
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: darwin-arm64
            runner: macos-15
            runner_arch: arm64
            file_arch: arm64
            macos: true
          - platform: darwin-x64
            runner: macos-15-intel
            runner_arch: x86_64
            file_arch: x86_64
            macos: true
          - platform: linux-arm64
            runner: ubuntu-24.04-arm
            runner_arch: aarch64
            file_arch: AArch64
            macos: false
          - platform: linux-x64
            runner: ubuntu-24.04
            runner_arch: x86_64
            file_arch: Advanced Micro Devices X86-64
            macos: false
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    env:
      PLATFORM: ${{ matrix.platform }}
      EXPECTED_RUNNER_ARCH: ${{ matrix.runner_arch }}
      FILE_ARCH: ${{ matrix.file_arch }}

    steps:
      - name: Download ${{ matrix.platform }} artifact
        uses: actions/download-artifact@v8
        with:
          name: build-${{ matrix.platform }}
          path: artifacts

      - name: Extract artifact
        shell: bash
        run: |
          set -euo pipefail
          actual_arch="$(uname -m)"
          if [ "$actual_arch" != "$EXPECTED_RUNNER_ARCH" ]; then
            echo "::error::Expected runner architecture $EXPECTED_RUNNER_ARCH, got $actual_arch"
            exit 1
          fi
          mkdir extracted
          tar -xzf "artifacts/ai-git-${PLATFORM}.tar.gz" -C extracted
          test -x extracted/ai-git

      - name: Sign and package macOS artifact
        if: matrix.macos
        shell: bash
        run: |
          set -euo pipefail
          codesign --force --sign - --preserve-metadata=entitlements,flags,runtime extracted/ai-git
          COPYFILE_DISABLE=1 tar --no-xattrs --no-mac-metadata \
            -czf "artifacts/ai-git-${PLATFORM}.tar.gz" -C extracted ai-git

      - name: Verify final artifact
        shell: bash
        run: |
          set -euo pipefail
          archive="artifacts/ai-git-${PLATFORM}.tar.gz"
          python3 -c 'import sys, tarfile; names = tarfile.open(sys.argv[1]).getnames(); assert names == ["ai-git"], f"unexpected archive members: {names}"' "$archive"
          rm -rf verified
          mkdir verified
          tar -xzf "$archive" -C verified
          test -x verified/ai-git

          if [ "${{ matrix.macos }}" = "true" ]; then
            test "$(lipo -archs verified/ai-git)" = "$FILE_ARCH"
            codesign --verify --strict --verbose=2 verified/ai-git
          else
            actual_arch="$(readelf -h verified/ai-git | sed -n 's/^[[:space:]]*Machine:[[:space:]]*//p')"
            test "$actual_arch" = "$FILE_ARCH"
          fi

          expected="${GITHUB_REF_NAME#v}"
          actual="$(verified/ai-git --version)"
          test "$actual" = "$expected"

      - name: Upload verified ${{ matrix.platform }} artifact
        uses: actions/upload-artifact@v7
        with:
          name: verified-${{ matrix.platform }}
          path: artifacts/ai-git-${{ matrix.platform }}.tar.gz
          if-no-files-found: error
          retention-days: 1

  verify-windows:
    needs: build
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: windows-arm64
            runner: windows-11-arm
            runner_arch: Arm64
            pe_machine: 43620
          - platform: windows-x64
            runner: windows-2025
            runner_arch: X64
            pe_machine: 34404
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    env:
      PLATFORM: ${{ matrix.platform }}
      EXPECTED_RUNNER_ARCH: ${{ matrix.runner_arch }}
      PE_MACHINE: ${{ matrix.pe_machine }}

    steps:
      - name: Download ${{ matrix.platform }} artifact
        uses: actions/download-artifact@v8
        with:
          name: build-${{ matrix.platform }}
          path: artifacts

      - name: Inspect and run artifact
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $osArchitecture = [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString()
          if ($osArchitecture -ne $env:EXPECTED_RUNNER_ARCH) {
            throw "Expected runner architecture $env:EXPECTED_RUNNER_ARCH, got $osArchitecture"
          }

          $archive = Join-Path $PWD "artifacts/ai-git-$env:PLATFORM.zip"
          $extract = Join-Path $PWD "extracted"
          Expand-Archive -Path $archive -DestinationPath $extract

          $executable = Join-Path $extract "ai-git.exe"
          if (-not (Test-Path $executable -PathType Leaf)) {
            throw "ai-git.exe was not found in $archive"
          }

          $bytes = [System.IO.File]::ReadAllBytes($executable)
          if ([System.Text.Encoding]::ASCII.GetString($bytes, 0, 2) -ne "MZ") {
            throw "ai-git.exe is not a PE executable"
          }
          $peOffset = [System.BitConverter]::ToInt32($bytes, 0x3c)
          $machine = [System.BitConverter]::ToUInt16($bytes, $peOffset + 4)
          if ($machine -ne [int]$env:PE_MACHINE) {
            throw "Expected PE machine $env:PE_MACHINE, got $machine"
          }

          $expected = $env:GITHUB_REF_NAME -replace '^v', ''
          $actual = (& $executable --version | Out-String).Trim()
          if ($LASTEXITCODE -ne 0) {
            throw "ai-git.exe exited with code $LASTEXITCODE"
          }
          if ($actual -ne $expected) {
            throw "Expected version $expected, got $actual"
          }

      - name: Upload verified ${{ matrix.platform }} artifact
        uses: actions/upload-artifact@v7
        with:
          name: verified-${{ matrix.platform }}
          path: artifacts/ai-git-${{ matrix.platform }}.zip
          if-no-files-found: error
          retention-days: 1

  assemble:
    needs:
      - verify-unix
      - verify-windows
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Download verified artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: verified-*
          path: apps/cli/dist
          merge-multiple: true

      - name: Generate checksums
        working-directory: apps/cli/dist
        run: |
          set -euo pipefail
          for archive in \
            ai-git-darwin-arm64.tar.gz \
            ai-git-darwin-x64.tar.gz \
            ai-git-linux-arm64.tar.gz \
            ai-git-linux-x64.tar.gz \
            ai-git-windows-arm64.zip \
            ai-git-windows-x64.zip; do
            test -f "$archive"
          done
          shasum -a 256 ./*.tar.gz ./*.zip > checksums.txt

      - name: Upload release artifacts
        uses: actions/upload-artifact@v7
        with:
          name: release-artifacts
          path: |
            apps/cli/dist/ai-git-darwin-arm64.tar.gz
            apps/cli/dist/ai-git-darwin-x64.tar.gz
            apps/cli/dist/ai-git-linux-x64.tar.gz
            apps/cli/dist/ai-git-linux-arm64.tar.gz
            apps/cli/dist/ai-git-windows-x64.zip
            apps/cli/dist/ai-git-windows-arm64.zip
            apps/cli/dist/checksums.txt
          if-no-files-found: error
          retention-days: 1

  release:
    needs: assemble
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Fetch tags and remote branches
        run: git fetch --force --tags origin '+refs/heads/*:refs/remotes/origin/*'

      - name: Download release artifacts
        uses: actions/download-artifact@v8
        with:
          name: release-artifacts
          path: apps/cli/dist

      - name: Ensure release does not already exist
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "::error::Release $GITHUB_REF_NAME already exists; refusing to overwrite verified assets."
            exit 1
          fi

      - name: Generate Changelog
        uses: orhun/git-cliff-action@v4
        id: changelog
        with:
          config: cliff.toml
          args: --latest --strip header --github-repo ${{ github.repository }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Release
        uses: softprops/action-gh-release@v3
        with:
          body: ${{ steps.changelog.outputs.content }}
          generate_release_notes: false
          overwrite_files: false
          fail_on_unmatched_files: true
          files: |
            apps/cli/dist/ai-git-darwin-arm64.tar.gz
            apps/cli/dist/ai-git-darwin-x64.tar.gz
            apps/cli/dist/ai-git-linux-x64.tar.gz
            apps/cli/dist/ai-git-linux-arm64.tar.gz
            apps/cli/dist/ai-git-windows-x64.zip
            apps/cli/dist/ai-git-windows-arm64.zip
            apps/cli/dist/checksums.txt
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout Homebrew Tap
        uses: actions/checkout@v7
        with:
          repository: sadiksaifi/homebrew-tap
          token: ${{ secrets.TAP_PAT }}
          path: homebrew-tap

      - name: Update Homebrew Formula
        run: |
          VERSION="${{ github.ref_name }}"

          URL_ARM64="https://github.com/${{ github.repository }}/releases/download/${VERSION}/ai-git-darwin-arm64.tar.gz"
          SHA256_ARM64=$(shasum -a 256 apps/cli/dist/ai-git-darwin-arm64.tar.gz | awk '{print $1}')

          URL_X64="https://github.com/${{ github.repository }}/releases/download/${VERSION}/ai-git-darwin-x64.tar.gz"
          SHA256_X64=$(shasum -a 256 apps/cli/dist/ai-git-darwin-x64.tar.gz | awk '{print $1}')

          echo "Updating Formula for version $VERSION..."

          cd homebrew-tap/Formula

          # Update Version
          sed -i "s|version \".*\"|version \"${VERSION#v}\"|" ai-git.rb

          # Update ARM64 (range: if arm? ... else)
          sed -i "/if Hardware::CPU.arm?/,/else/s|url \".*\"|url \"${URL_ARM64}\"|" ai-git.rb
          sed -i "/if Hardware::CPU.arm?/,/else/s|sha256 \".*\"|sha256 \"${SHA256_ARM64}\"|" ai-git.rb

          # Update X64 (range: else ... end)
          sed -i "/else/,/end/s|url \".*\"|url \"${URL_X64}\"|" ai-git.rb
          sed -i "/else/,/end/s|sha256 \".*\"|sha256 \"${SHA256_X64}\"|" ai-git.rb

          git config --global user.name "GitHub Actions"
          git config --global user.email "actions@github.com"
          git add ai-git.rb

          if git diff --staged --quiet; then
            echo "No changes to commit."
          else
            git commit -m "release: ai-git version ${VERSION}" -m "Release: https://github.com/${{ github.repository }}/releases/tag/${VERSION}"
            git push origin main
          fi

  publish-npm:
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Install latest npm
        run: npm install -g npm@latest

      - name: Download verified release artifacts
        uses: actions/download-artifact@v8
        with:
          name: release-artifacts
          path: /tmp/artifacts

      - name: Verify release artifact checksums
        working-directory: /tmp/artifacts
        run: shasum -a 256 -c checksums.txt

      - name: Place binaries in platform packages
        run: |
          VERSION="${{ github.ref_name }}"
          VERSION="${VERSION#v}"

          # Extract and place each platform binary
          for platform in darwin-arm64 darwin-x64 linux-arm64 linux-x64; do
            mkdir -p "packages/npm/${platform}/bin"
            tar -xzf "/tmp/artifacts/ai-git-${platform}.tar.gz" -C "packages/npm/${platform}/bin"
            chmod +x "packages/npm/${platform}/bin/ai-git"
          done

          # Windows — verify binary is named ai-git.exe after extraction
          mkdir -p packages/npm/win32-x64/bin
          unzip -o /tmp/artifacts/ai-git-windows-x64.zip -d packages/npm/win32-x64/bin
          test -f packages/npm/win32-x64/bin/ai-git.exe || { echo "ERROR: ai-git.exe not found after extraction"; exit 1; }

          # Windows ARM64
          mkdir -p packages/npm/win32-arm64/bin
          unzip -o /tmp/artifacts/ai-git-windows-arm64.zip -d packages/npm/win32-arm64/bin
          test -f packages/npm/win32-arm64/bin/ai-git.exe || { echo "ERROR: ai-git.exe not found after extraction"; exit 1; }

          # Update all 0.0.0 versions (package version + optionalDependencies)
          for pkg in packages/npm/*/package.json; do
            sed -i "s/\"0.0.0\"/\"${VERSION}\"/g" "$pkg"
          done

      - name: Resolve README symlinks
        run: |
          # npm doesn't follow symlinks pointing outside the package directory
          for readme in packages/npm/*/README.md; do
            if [ -L "$readme" ]; then
              cp --remove-destination "$(readlink -f "$readme")" "$readme"
            fi
          done

      - name: Validate all packages (dry-run)
        run: |
          VERSION="${{ github.ref_name }}"
          VERSION="${VERSION#v}"

          for pkg in darwin-arm64 darwin-x64 linux-arm64 linux-x64 win32-arm64 win32-x64; do
            echo "Validating @ai-git/${pkg}..."
            if npm view "@ai-git/${pkg}@${VERSION}" version >/dev/null 2>&1; then
              echo "@ai-git/${pkg}@${VERSION} already published; skipping dry-run validation."
              continue
            fi
            cd "packages/npm/${pkg}"
            npm publish --provenance --access public --dry-run
            cd "${{ github.workspace }}"
          done

          echo "Validating @ai-git/cli..."
          if npm view "@ai-git/cli@${VERSION}" version >/dev/null 2>&1; then
            echo "@ai-git/cli@${VERSION} already published; skipping dry-run validation."
            exit 0
          fi
          cd packages/npm/ai-git
          npm publish --provenance --access public --dry-run

      - name: Publish platform packages
        run: |
          VERSION="${{ github.ref_name }}"
          VERSION="${VERSION#v}"

          for pkg in darwin-arm64 darwin-x64 linux-arm64 linux-x64 win32-arm64 win32-x64; do
            echo "Publishing @ai-git/${pkg}..."
            if npm view "@ai-git/${pkg}@${VERSION}" version >/dev/null 2>&1; then
              echo "@ai-git/${pkg}@${VERSION} already published; skipping."
              continue
            fi
            cd "packages/npm/${pkg}"
            npm publish --provenance --access public
            cd "${{ github.workspace }}"
          done

      - name: Publish main package (@ai-git/cli)
        working-directory: packages/npm/ai-git
        run: |
          VERSION="${{ github.ref_name }}"
          VERSION="${VERSION#v}"

          if npm view "@ai-git/cli@${VERSION}" version >/dev/null 2>&1; then
            echo "@ai-git/cli@${VERSION} already published; skipping."
            exit 0
          fi

          npm publish --provenance --access public