papercraft/.github/workflows/release.yml

# Builds Windows, macOS and Linux on GitHub's runners when a v* tag is pushed, then publishes a
# GitHub release with the files once the full test suite (test.yml) passes, then refreshes the
# landing page (site.yml). Gitea reads .github/workflows too, so every job is gated on the
# server URL: this pipeline only ever runs on github.com.
name: release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      tag:
        description: Existing tag to build and release (e.g. v0.8.4)
        required: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  TAG: ${{ inputs.tag || github.ref_name }}

jobs:
  test:
    uses: ./.github/workflows/test.yml
    with: { ref: "${{ inputs.tag || github.ref }}" }

  windows:
    if: github.server_url == 'https://github.com'
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with: { ref: "${{ inputs.tag || github.ref }}" }
      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master; toolchain stable
        with: { toolchain: stable }
      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
        with:
          shared-key: papercraft-release
          save-if: false
      - name: Install WiX Toolset
        shell: pwsh
        run: |
          $wixPath = Join-Path $env:RUNNER_TEMP 'wix'
          dotnet tool install --tool-path $wixPath wix --version 5.0.2
          $wixPath | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
      - name: Build Windows packages
        shell: pwsh
        run: |
          $env:PAPERCRAFT_VERSION = $env:TAG.TrimStart('v')
          ./packaging/windows/package.ps1 -Arch x64
          Copy-Item target/windows-package/x64/papercraft.exe "dist/release/papercraft-$env:PAPERCRAFT_VERSION-windows-x64-portable.exe"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with: { name: windows, path: dist/release/* }

  macos:
    if: github.server_url == 'https://github.com'
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with: { ref: "${{ inputs.tag || github.ref }}" }
      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master; toolchain stable
        with: { toolchain: stable, targets: aarch64-apple-darwin }
      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
        with:
          shared-key: papercraft-release
          save-if: false
      - name: Package (Apple silicon, ad-hoc signed, not notarized)
        run: packaging/macos/package.sh --arch aarch64
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with: { name: macos, path: dist/release/* }

  linux:
    if: github.server_url == 'https://github.com'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with: { ref: "${{ inputs.tag || github.ref }}" }
      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master; toolchain stable
        with: { toolchain: stable }
      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
        with:
          shared-key: papercraft-release
          save-if: false
      - name: Build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y pkg-config libssl-dev libxkbcommon-x11-dev libxcb-xkb-dev libx11-xcb-dev libwayland-dev libvulkan-dev libdbus-1-dev
      - name: Build and tar
        run: |
          cargo build --release --locked --bins
          v="${TAG#v}"
          mkdir -p dist stage
          cp target/release/papercraft target/release/papercraft-cli target/release/papercraft-mcp target/release/papercraft-relay stage/
          tar -C stage -czf "dist/papercraft-$v-linux-x86_64.tar.gz" .
          tar -C stage -czf "dist/papercraft-cli-$v-linux-x86_64.tar.gz" papercraft-cli papercraft-mcp
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with: { name: linux, path: dist/* }

  publish:
    if: github.server_url == 'https://github.com'
    needs: [test, windows, macos, linux]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with: { path: files, merge-multiple: true }
      - name: Create the release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "Release $TAG already exists; refusing to overwrite its assets." >&2
            exit 1
          fi
          gh release create "$TAG" files/* --repo "$GITHUB_REPOSITORY" --title "PaperCraft ${TAG#v}" \
            --generate-notes --verify-tag

  site:
    if: github.server_url == 'https://github.com'
    needs: publish
    permissions:
      contents: write
    uses: ./.github/workflows/site.yml