release.yml

name: Release binaries

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version string to stamp into the binary (e.g. 0.2.9)'
        required: false

permissions:
  contents: write

jobs:
  build:
    name: ${{ matrix.asset }}
    runs-on: ${{ matrix.os }}
    # A label with no runner behind it waits forever rather than failing, so
    # give every job a ceiling: an image that has been retired should cost
    # twenty minutes, not an afternoon.
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            asset: diffuse-linux-x86_64
            native: true
          - os: ubuntu-22.04-arm
            target: aarch64-unknown-linux-gnu
            asset: diffuse-linux-aarch64
            native: true
          # Both macOS binaries are built on Apple Silicon. Intel runner images
          # are retired, and Apple's own toolchain cross-compiles to x86_64
          # without anything extra, so this needs no Intel machine to exist.
          - os: macos-latest
            target: x86_64-apple-darwin
            asset: diffuse-macos-x86_64
            native: false
          - os: macos-latest
            target: aarch64-apple-darwin
            asset: diffuse-macos-aarch64
            native: true
          - os: windows-2022
            target: x86_64-pc-windows-msvc
            asset: diffuse-windows-x86_64.exe
            native: true

    steps:
      - uses: actions/checkout@v4
        with:
          # The version the binary reports comes from `git describe`, which
          # needs the tags, and a shallow clone has none of them.
          fetch-depth: 0

      - name: Install protobuf compiler
        uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}

      - name: Build
        shell: bash
        run: |
          if [ -n "${{ inputs.version }}" ]; then
            export DIFFUSE_VERSION="${{ inputs.version }}"
          fi
          cargo build --release --locked --bin diffuse --target ${{ matrix.target }}

      - name: Package
        shell: bash
        run: |
          mkdir -p dist
          if [ "${{ runner.os }}" = "Windows" ]; then
            cp "target/${{ matrix.target }}/release/diffuse.exe" "dist/${{ matrix.asset }}"
          else
            cp "target/${{ matrix.target }}/release/diffuse" "dist/${{ matrix.asset }}"
            chmod +x "dist/${{ matrix.asset }}"
          fi
          cd dist
          if command -v sha256sum > /dev/null; then
            sha256sum "${{ matrix.asset }}" > "${{ matrix.asset }}.sha256"
          else
            shasum -a 256 "${{ matrix.asset }}" > "${{ matrix.asset }}.sha256"
          fi

      - name: Check the binary runs
        # Only where the runner can execute what was just built. The Intel
        # macOS binary is cross-compiled and has no host here to try it on.
        if: matrix.native
        shell: bash
        run: ./dist/${{ matrix.asset }} --version

      - name: Check the cross-built binary is for the right machine
        if: ${{ !matrix.native }}
        run: file "dist/${{ matrix.asset }}" | grep -q "x86_64"

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.asset }}
          path: dist/*

  publish:
    needs: build
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: Take this tag's section out of the changelog
        # The release notes are the changelog entry for this version, so there
        # is nothing to paste by hand and the two cannot drift apart. A tag
        # with no section fails here rather than publishing an empty release.
        run: |
          version="${GITHUB_REF_NAME#v}"
          awk -v want="## v${version}" '
            $0 == want { found = 1; next }
            /^## / { if (found) exit }
            found
          ' CHANGELOG.md | sed '/^---$/d' > notes.md
          if [ ! -s notes.md ]; then
            echo "CHANGELOG.md has no '## v${version}' section"
            exit 1
          fi
          head -3 notes.md

      - name: Upload to release
        uses: softprops/action-gh-release@v2
        with:
          body_path: notes.md
          files: dist/*
          fail_on_unmatched_files: true