path: root/.github/workflows/release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
  RUST_TOOLCHAIN_VERSION: 1.96.1

jobs:
  validate-release-source:
    if: github.repository == 'herdrdev/herdr' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    outputs:
      preview_commit: ${{ steps.source.outputs.preview_commit }}
      previous_tag: ${{ steps.source.outputs.previous_tag }}
    steps:
      - &require-release-admins
        name: Require repository admins for publishing and reruns
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          for actor in "$GITHUB_ACTOR" "$GITHUB_TRIGGERING_ACTOR"; do
            permission="$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$actor/permission" --jq .permission)"
            if [ "$permission" != "admin" ]; then
              echo "error: $actor must have repository admin permission to publish" >&2
              exit 1
            fi
          done
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Require a published preview and release-only changes
        id: source
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          git fetch origin master:refs/remotes/origin/master --tags
          python3 scripts/release.py check-tag --tag "$GITHUB_REF_NAME" --github-output "$GITHUB_OUTPUT"

  flake-check:
    needs: validate-release-source
    if: github.repository == 'herdrdev/herdr'
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Install Nix
        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
        with:
          extra_nix_config: |
            experimental-features = nix-command flakes
            always-allow-substitutes = true

      - name: Run Nix flake check
        run: |
          nix flake check --print-build-logs
          nix flake check --all-systems --no-build --print-build-logs

  build:
    needs: validate-release-source
    if: github.repository == 'herdrdev/herdr'
    permissions:
      contents: read
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            name: herdr-linux-x86_64
            libghostty_vt_optimize: ReleaseFast
            libghostty_vt_simd: 'true'
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
            name: herdr-linux-aarch64
            libghostty_vt_optimize: ReleaseFast
            libghostty_vt_simd: 'true'
          - target: x86_64-apple-darwin
            os: macos-latest
            name: herdr-macos-x86_64
            libghostty_vt_optimize: ReleaseFast
            libghostty_vt_simd: 'true'
          - target: aarch64-apple-darwin
            os: macos-latest
            name: herdr-macos-aarch64
            libghostty_vt_optimize: ReleaseFast
            libghostty_vt_simd: 'true'
          - target: x86_64-pc-windows-msvc
            os: windows-2022
            name: herdr-windows-x86_64.zip
            libghostty_vt_optimize: ReleaseFast
            libghostty_vt_simd: 'true'

    runs-on: ${{ matrix.os }}
    env:
      LIBGHOSTTY_VT_OPTIMIZE: ${{ matrix.libghostty_vt_optimize }}
      LIBGHOSTTY_VT_SIMD: ${{ matrix.libghostty_vt_simd }}

    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Verify tag matches Cargo.toml version
        shell: bash
        run: |
          CARGO_VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          if [ "$CARGO_VERSION" != "$TAG_VERSION" ]; then
            echo "error: tag $GITHUB_REF_NAME doesn't match Cargo.toml version $CARGO_VERSION"
            exit 1
          fi

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # v1
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
          targets: ${{ matrix.target }}

      - name: Install Zig
        uses: vercel-labs/setup-zig@83c1594f26b86da8a9a8ddd9b5ee5f3af0f96943 # v1.0.2
        with:
          version: 0.16.0

      - name: Prefer official Ubuntu mirrors over Azure
        if: runner.os == 'Linux'
        run: |
          if [ -f /etc/apt/apt-mirrors.txt ]; then
            sudo sed -i '/azure.archive.ubuntu.com/d' /etc/apt/apt-mirrors.txt
            echo "Using apt mirrors:"
            cat /etc/apt/apt-mirrors.txt
          fi

      - name: Install Linux build tools
        if: runner.os == 'Linux'
        run: |
          sudo find /etc/apt/sources.list.d -type f \( -iname '*microsoft*' -o -iname '*azure-cli*' \) -print -delete
          sudo apt-get update
          sudo apt-get install -y cmake ninja-build musl-tools gcc-aarch64-linux-gnu crossbuild-essential-arm64

      - name: Install macOS build tools
        if: runner.os == 'macOS'
        run: HOMEBREW_NO_AUTO_UPDATE=1 brew install cmake ninja

      - name: Set Linux aarch64 linker
        if: matrix.target == 'aarch64-unknown-linux-musl'
        run: echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV

      - name: Cache Rust artifacts
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          key: release-${{ matrix.target }}

      - name: Remove Zig caches
        shell: bash
        run: rm -rf .zig-cache vendor/libghostty-vt/.zig-cache vendor/libghostty-vt/zig-out

      - name: Build
        run: cargo build --release --locked --target ${{ matrix.target }}

      - name: Package artifact
        if: runner.os != 'Windows'
        shell: bash
        run: cp target/${{ matrix.target }}/release/herdr ${{ matrix.name }}

      - name: Package artifact
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $package = Join-Path $env:RUNNER_TEMP "Microsoft.Windows.Console.ConPTY.nupkg"
          $stage = Join-Path $env:RUNNER_TEMP "herdr-windows-x86_64"
          .\scripts\package_windows_conpty.ps1 `
            -HerdrExe target\${{ matrix.target }}\release\herdr.exe `
            -PackagePath $package `
            -StageDir $stage `
            -OutputPath ${{ matrix.name }}
          $version = (& (Join-Path $stage "herdr.exe") --version | Out-String).Trim()
          $tagVersion = $env:GITHUB_REF_NAME -replace '^v', ''
          if ($version -notmatch [regex]::Escape($tagVersion) -or $version -match "preview") {
            throw "Packaged Windows binary has unexpected version identity: $version"
          }

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ matrix.name }}
          path: ${{ matrix.name }}

  validate-release-inputs:
    needs: validate-release-source
    if: github.repository == 'herdrdev/herdr'
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.14

      - name: Validate release inputs
        run: |
          python3 scripts/changelog.py validate-product-announcement
          python3 scripts/agent_detection_manifest_check.py --require-all-published
          python3 scripts/config_reference_check.py
          node scripts/docs/versions.mjs check
          node scripts/docs/preview.mjs check
          bun test scripts/docs/*.test.ts
          test -f docs/next/README.md
          test -f docs/next/README.zh-CN.md

  release:
    needs: [build, flake-check, validate-release-inputs]
    if: github.repository == 'herdrdev/herdr' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - *require-release-admins
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Download all artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8

      - name: Extract release notes from changelog
        run: python3 scripts/changelog.py extract --version "${GITHUB_REF_NAME#v}" --output RELEASE_NOTES.md

      - name: Create release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
        with:
          files: |
            herdr-linux-x86_64/herdr-linux-x86_64
            herdr-linux-aarch64/herdr-linux-aarch64
            herdr-macos-x86_64/herdr-macos-x86_64
            herdr-macos-aarch64/herdr-macos-aarch64
            herdr-windows-x86_64.zip/herdr-windows-x86_64.zip
          body_path: RELEASE_NOTES.md

  update-nix-package:
    needs: release
    if: github.repository == 'herdrdev/herdr' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    timeout-minutes: 2
    continue-on-error: true
    permissions: {}

    steps:
      - *require-release-admins
      - name: Trigger stable Nix package update
        env:
          GH_TOKEN: ${{ secrets.HERDR_NIX_DISPATCH_TOKEN }}
          GH_HOST: github.com
        run: |
          if ! gh workflow run update-check.yml --repo herdrdev/herdr-nix --ref main; then
            echo "::warning::Nix update could not be triggered. The Herdr release is already published; run update-check manually in herdrdev/herdr-nix."
            exit 1
          fi

  close-released-issues:
    needs: [release, validate-release-source]
    if: github.repository == 'herdrdev/herdr' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    continue-on-error: true
    permissions:
      contents: read
      issues: write

    steps:
      - *require-release-admins
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Close issues referenced by released commits
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.KANGAL_GITHUB_TOKEN }}
          NEXT_RELEASE_LABEL: pending-release
          LEGACY_NEXT_RELEASE_LABEL: included-in-next-release
          PREVIEW_RELEASED_LABEL: preview-released
          PREVIOUS_TAG: ${{ needs.validate-release-source.outputs.previous_tag }}
        run: |
          set -euo pipefail

          echo "Using GitHub token for $(gh api user --jq .login)."

          VERSION="${GITHUB_REF_NAME#v}"
          CURRENT_COMMIT="$(git rev-list -n 1 "$GITHUB_REF_NAME")"
          echo "Scanning released commits in $PREVIOUS_TAG..$GITHUB_REF_NAME for refs #<issue> mentions."
          mapfile -t ISSUES < <(
            git log --format='%s%n%b' "$PREVIOUS_TAG..$CURRENT_COMMIT" \
              | perl -ne 'print "$1\n" if /\brefs\s+#([0-9]+)\b/i' \
              | sort -nu
          )

          if [ "${#ISSUES[@]}" -eq 0 ]; then
            echo "No released issue refs found."
            exit 0
          fi

          RELEASE_URL="https://github.com/${GITHUB_REPOSITORY}/releases/tag/v${VERSION}"
          RELEASE_COMMENT_MARKER="<!-- herdr:released:v${VERSION} -->"
          RELEASE_COMMENT="${RELEASE_COMMENT_MARKER}"$'\n'"Released in [v${VERSION}](${RELEASE_URL})."

          issue_has_comment_marker() {
            local issue="$1"
            local marker="$2"
            local comments
            if ! comments="$(gh api --paginate "repos/${GITHUB_REPOSITORY}/issues/${issue}/comments?per_page=100" --jq '.[].body')"; then
              echo "::warning::Could not read comments for issue #$issue."
              return 2
            fi
            grep -F -- "$marker" >/dev/null <<<"$comments"
          }

          for issue in "${ISSUES[@]}"; do
            echo "Checking #$issue"
            if ! data="$(gh api "repos/${GITHUB_REPOSITORY}/issues/${issue}")"; then
              echo "::warning::Could not read issue #$issue; skipping."
              continue
            fi

            if jq -e 'has("pull_request")' <<<"$data" >/dev/null; then
              echo "Skipping #$issue because it is a pull request."
              continue
            fi

            HAS_NEXT_RELEASE_LABEL="$(jq -r --arg label "$NEXT_RELEASE_LABEL" 'any(.labels[].name; . == $label)' <<<"$data")"
            HAS_LEGACY_NEXT_RELEASE_LABEL="$(jq -r --arg label "$LEGACY_NEXT_RELEASE_LABEL" 'any(.labels[].name; . == $label)' <<<"$data")"
            HAS_PREVIEW_RELEASED_LABEL="$(jq -r --arg label "$PREVIEW_RELEASED_LABEL" 'any(.labels[].name; . == $label)' <<<"$data")"
            HAS_RELEASE_TRACKING_LABEL="false"
            if [ "$HAS_NEXT_RELEASE_LABEL" = "true" ] || [ "$HAS_LEGACY_NEXT_RELEASE_LABEL" = "true" ] || [ "$HAS_PREVIEW_RELEASED_LABEL" = "true" ]; then
              HAS_RELEASE_TRACKING_LABEL="true"
            fi
            MARKER_STATUS=0
            issue_has_comment_marker "$issue" "$RELEASE_COMMENT_MARKER" || MARKER_STATUS="$?"
            if [ "$MARKER_STATUS" -eq 2 ]; then
              continue
            fi
            HAS_RELEASE_COMMENT="false"
            if [ "$MARKER_STATUS" -eq 0 ]; then
              HAS_RELEASE_COMMENT="true"
            fi

            if [ "$(jq -r '.state' <<<"$data")" = "open" ]; then
              if [ "$HAS_RELEASE_COMMENT" = "true" ]; then
                if ! gh issue close "$issue" --repo "$GITHUB_REPOSITORY" --reason completed; then
                  echo "::warning::Could not close issue #$issue."
                  continue
                fi
              elif ! gh issue close "$issue" --repo "$GITHUB_REPOSITORY" --reason completed --comment "$RELEASE_COMMENT"; then
                echo "::warning::Could not close issue #$issue."
                continue
              fi
            elif [ "$HAS_RELEASE_TRACKING_LABEL" = "true" ]; then
              if [ "$HAS_RELEASE_COMMENT" != "true" ]; then
                if ! gh issue comment "$issue" --repo "$GITHUB_REPOSITORY" --body "$RELEASE_COMMENT"; then
                  echo "::warning::Could not comment on issue #$issue."
                  continue
                fi
              else
                echo "Skipping release comment for #$issue because it already exists."
              fi
            else
              echo "Skipping release comment for #$issue because it is closed and has no release tracking label."
            fi

            if [ "$HAS_NEXT_RELEASE_LABEL" = "true" ]; then
              if ! gh issue edit "$issue" --repo "$GITHUB_REPOSITORY" --remove-label "$NEXT_RELEASE_LABEL"; then
                echo "::warning::Could not remove $NEXT_RELEASE_LABEL from issue #$issue."
                continue
              fi
            fi

            if [ "$HAS_LEGACY_NEXT_RELEASE_LABEL" = "true" ]; then
              if ! gh issue edit "$issue" --repo "$GITHUB_REPOSITORY" --remove-label "$LEGACY_NEXT_RELEASE_LABEL"; then
                echo "::warning::Could not remove $LEGACY_NEXT_RELEASE_LABEL from issue #$issue."
                continue
              fi
            fi

            if [ "$HAS_PREVIEW_RELEASED_LABEL" = "true" ]; then
              if ! gh issue edit "$issue" --repo "$GITHUB_REPOSITORY" --remove-label "$PREVIEW_RELEASED_LABEL"; then
                echo "::warning::Could not remove $PREVIEW_RELEASED_LABEL from issue #$issue."
                continue
              fi
            fi
          done

  update-latest-json:
    needs: [release, validate-release-source]
    if: github.repository == 'herdrdev/herdr' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    concurrency:
      group: docs-publish-master
      cancel-in-progress: false
    permissions:
      contents: write

    steps:
      - *require-release-admins
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          ref: master
          fetch-depth: 0
          ssh-key: ${{ secrets.RELEASE_DEPLOY_KEY }}

      - name: Publish tagged documentation and update distribution manifest
        env:
          GH_TOKEN: ${{ github.token }}
          PREVIEW_COMMIT: ${{ needs.validate-release-source.outputs.preview_commit }}
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          node scripts/docs/versions.mjs publish "$GITHUB_REF_NAME"
          ANNOUNCEMENT_PATH="$RUNNER_TEMP/product-announcement.json"
          ANNOUNCEMENT_ORIGINAL_PATH="$RUNNER_TEMP/product-announcement-original.json"
          git show "${GITHUB_REF_NAME}:docs/next/product-announcement.json" > "$ANNOUNCEMENT_PATH"
          cp "$ANNOUNCEMENT_PATH" "$ANNOUNCEMENT_ORIGINAL_PATH"
          python3 scripts/changelog.py validate-product-announcement --path "$ANNOUNCEMENT_PATH"
          RELEASE_PROTOCOL=$(git show "${GITHUB_REF_NAME}:src/protocol/wire.rs" | python3 -c 'import re, sys; match = re.search(r"pub const PROTOCOL_VERSION: u32 = (\d+);", sys.stdin.read()); sys.exit(1) if match is None else print(match.group(1))')
          RELEASE_ENDPOINT_GENERATION=$(git show "${GITHUB_REF_NAME}:src/protocol/endpoint.rs" | python3 -c 'import re, sys; match = re.search(r"pub const ENDPOINT_PROTOCOL_GENERATION: u32 = (\d+);", sys.stdin.read()); sys.exit(1) if match is None else print(match.group(1))')

          DOCS_CURRENT=$(node scripts/docs/versions.mjs current)
          if [ "$DOCS_CURRENT" != "$VERSION" ]; then
            echo "Archived v$VERSION documentation without moving current docs backward from v$DOCS_CURRENT"
            exit 0
          fi
          CURRENT_VERSION=$(python3 -c 'import json; print(json.load(open("distribution/latest.json")).get("version", ""))')
          if [ "$CURRENT_VERSION" = "$VERSION" ]; then
            echo "distribution/latest.json is already at v$VERSION"
            exit 0
          fi
          # Apply only release preparation, never the hotfix implementation or newer master code.
          git diff --binary "$PREVIEW_COMMIT" "$GITHUB_REF_NAME" > "$RUNNER_TEMP/release-preparation.patch"
          if [ -s "$RUNNER_TEMP/release-preparation.patch" ]; then
            git apply --3way --index "$RUNNER_TEMP/release-preparation.patch"
          fi
          python3 scripts/changelog.py sync-latest-json --version "$VERSION" --output distribution/latest.json --announcement "$ANNOUNCEMENT_PATH" --protocol "$RELEASE_PROTOCOL" --endpoint-generation "$RELEASE_ENDPOINT_GENERATION"
          if cmp -s "$ANNOUNCEMENT_ORIGINAL_PATH" docs/next/product-announcement.json; then
            printf 'null\n' > docs/next/product-announcement.json
          else
            echo "::warning::docs/next/product-announcement.json changed after $GITHUB_REF_NAME; leaving it unchanged."
          fi

      - name: Commit release distribution
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add -A README.md README.zh-CN.md docs/versions distribution/latest.json docs/next/product-announcement.json
          # Release-only changes applied above are already staged by git apply --index.
          git diff --cached --quiet || git commit -m "release: synchronize metadata for v$VERSION"
          for attempt in 1 2 3; do
            git pull --rebase origin master
            node scripts/docs/versions.mjs check
            node scripts/docs/preview.mjs check
            if git push origin master; then
              exit 0
            fi
            if [ "$attempt" -lt 3 ]; then
              echo "master changed during release publishing; retrying ($attempt/3)"
              sleep $((attempt * 2))
            fi
          done
          echo "failed to publish release documentation after 3 attempts" >&2
          exit 1