# Publishes the client as a release of the `knotless` package
# (docs/design/packages.md): when main's version, in Cargo.toml, has no
# release yet and this commit's checks all pass, it builds every target
# deploy/build-client.sh builds and publishes them with `knotless release publish`,
# as the repository's owner, with the version's CHANGELOG.md section as its
# notes, and tags its commit `v<version>`. `knope release` bumps the
# version in a pull; once that lands, this publishes it. A version
# published already is left alone, so the run passes at once.
#
# RELEASE_PASSWORD is an app password of the owner's, granted to pushes to
# main alone in the runner's secrets file. Asked for on any other branch,
# `knotless run rerun <repo> --ref refs/heads/<branch> --workflow release`, it
# builds everything and publishes nothing, to try the build.

# Its secrets are on ci.knotless.dev alone, the runner that runs no one
# else's code (deploy/runner-host/README.md, The trusted runner).
runners: [ci.knotless.dev]
on:
  push: {refs: [refs/heads/main], paths: [Cargo.toml]}
  asked: {refs: [refs/heads/*]}
after: [check, test, web, lexicons, shots, docs, e2e]
superseded: finish
image: rust:1.98
cache: [target, /usr/local/cargo/registry, /usr/local/rustup, /opt/tools]
secrets: [RELEASE_PASSWORD]
env:
  REPO: knotless://chadtmiller.com/knotless
  KNOTLESS_APPVIEW: https://knotless.dev
  ZIG_VERSION: 0.16.0
  ZIGBUILD_VERSION: 0.23.4
steps:
  - name: version
    run: |
      cargo build --release --locked -p knotless
      cp target/release/knotless /usr/local/bin/
      version=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)
      echo "$version" > ~/.version
      if knotless release list "$REPO" knotless | cut -f2 | grep -qxF "$version"; then
        echo "knotless $version is published already"
        touch ~/.done
      elif [ "$KNOTLESS_RUN_REF" != refs/heads/main ]; then
        echo "on $KNOTLESS_RUN_REF: building $version, publishing nothing"
      fi
  - name: tools
    run: |
      [ ! -e ~/.done ] || exit 0
      if [ "$(cat /opt/tools/.zig 2>/dev/null)" != "$ZIG_VERSION $ZIGBUILD_VERSION" ]; then
        find /opt/tools -mindepth 1 -delete
        mkdir -p /opt/tools/zig
        curl -fsSL "https://ziglang.org/download/$ZIG_VERSION/zig-x86_64-linux-$ZIG_VERSION.tar.xz" | tar -xJ -C /opt/tools/zig --strip-components 1
        cargo install --locked --root /opt/tools cargo-zigbuild --version "$ZIGBUILD_VERSION"
        echo "$ZIG_VERSION $ZIGBUILD_VERSION" > /opt/tools/.zig
      fi
      ln -sf /opt/tools/zig/zig /usr/local/bin/zig
      ln -sf /opt/tools/bin/cargo-zigbuild /usr/local/cargo/bin/cargo-zigbuild
  # A target a step: from cold caches each takes some 13 minutes, and the
  # four in one step outran the runner's 30-minute step timeout.
  - name: build aarch64-apple-darwin
    run: |
      [ ! -e ~/.done ] || exit 0
      rm -rf target/client
      TOOLCHAIN= deploy/build-client.sh target/client aarch64-apple-darwin
  - name: build x86_64-apple-darwin
    run: |
      [ ! -e ~/.done ] || exit 0
      TOOLCHAIN= deploy/build-client.sh target/client x86_64-apple-darwin
  - name: build x86_64-unknown-linux-musl
    run: |
      [ ! -e ~/.done ] || exit 0
      TOOLCHAIN= deploy/build-client.sh target/client x86_64-unknown-linux-musl
  - name: build aarch64-unknown-linux-musl
    run: |
      [ ! -e ~/.done ] || exit 0
      TOOLCHAIN= deploy/build-client.sh target/client aarch64-unknown-linux-musl
      ls -l target/client
  - name: publish
    on: {refs: [refs/heads/main]}
    run: |
      [ ! -e ~/.done ] || exit 0
      version=$(cat ~/.version)
      # The version's section of the changelog, less its heading.
      awk -v v="$version" '/^## / { on = ($2 == v); next } on' CHANGELOG.md > ~/.notes
      KNOTLESS_PASSWORD="$RELEASE_PASSWORD" knotless release publish "$REPO" knotless "$version" target/client/knotless-"$version"-*.tar.gz --notes - < ~/.notes
      # Tagged once published, at the commit it was built from, as the
      # owner, so a git checkout finds the version by name.
      owner=${REPO#knotless://}
      KNOTLESS_IDENTIFIER=${owner%%/*} KNOTLESS_PASSWORD="$RELEASE_PASSWORD" knotless tag create "$REPO" "v$version" "$KNOTLESS_RUN_SHA"