release-cli.yml

name: Release CLI

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag/version to package for manual artifact builds; manual runs do not publish."
        required: false
        type: string

permissions:
  contents: write

jobs:
  build-cli:
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux-x64
            runs-on: ubuntu-24.04
            platform: linux
            asset-arch: x86_64
            build-arch: ""
            static-swift-stdlib: true
          - name: linux-arm64
            runs-on: ubuntu-24.04-arm
            platform: linux
            asset-arch: aarch64
            build-arch: ""
            static-swift-stdlib: true
          - name: macos-arm64
            runs-on: macos-15
            platform: macos
            asset-arch: arm64
            build-arch: arm64
            static-swift-stdlib: false
          - name: macos-x86_64
            runs-on: macos-15-intel
            platform: macos
            asset-arch: x86_64
            build-arch: x86_64
            static-swift-stdlib: false
    runs-on: ${{ matrix.runs-on }}
    env:
      RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
    steps:
      - uses: actions/checkout@v6

      - name: Select Xcode 26.1.1 (if present) or fallback to default
        if: matrix.platform == 'macos'
        run: |
          set -euo pipefail
          for candidate in /Applications/Xcode_26.1.1.app /Applications/Xcode_26.1.app /Applications/Xcode.app; do
            if [[ -d "$candidate" ]]; then
              sudo xcode-select -s "${candidate}/Contents/Developer"
              echo "DEVELOPER_DIR=${candidate}/Contents/Developer" >> "$GITHUB_ENV"
              break
            fi
          done
          /usr/bin/xcodebuild -version

      - name: Runner info
        run: |
          set -euo pipefail
          uname -a
          uname -m
          swift --version

      - name: Validate release tag
        if: github.event_name == 'release' || inputs.tag != ''
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "$RELEASE_TAG" ]]; then
            echo "Missing release tag." >&2
            exit 1
          fi
          if [[ ! "$RELEASE_TAG" =~ ^v[0-9A-Za-z._-]+$ ]]; then
            echo "Invalid release tag: $RELEASE_TAG" >&2
            exit 1
          fi

      - name: Install Swift 6.2.1 via swiftly
        if: matrix.platform == 'linux'
        shell: bash
        run: |
          set -euo pipefail

          if ! command -v gpg >/dev/null 2>&1; then
            sudo apt-get update
            sudo apt-get install -y ca-certificates gpg
          fi

          SWIFTLY_ARCH="$(uname -m)"
          SWIFTLY_HOME_DIR="$HOME/.local/share/swiftly"
          SWIFTLY_BIN_DIR="$HOME/.local/bin"
          POST_INSTALL_SCRIPT="$(mktemp)"

          mkdir -p "$SWIFTLY_BIN_DIR"
          curl -fsSL "https://download.swift.org/swiftly/linux/swiftly-${SWIFTLY_ARCH}.tar.gz" -o /tmp/swiftly.tar.gz
          tar -xzf /tmp/swiftly.tar.gz -C /tmp
          /tmp/swiftly init --assume-yes --skip-install

          . "$SWIFTLY_HOME_DIR/env.sh"
          echo "$SWIFTLY_BIN_DIR" >> "$GITHUB_PATH"
          echo "SWIFTLY_HOME_DIR=$SWIFTLY_HOME_DIR" >> "$GITHUB_ENV"
          echo "SWIFTLY_BIN_DIR=$SWIFTLY_BIN_DIR" >> "$GITHUB_ENV"

          swiftly install 6.2.1 --use --assume-yes --post-install-file "$POST_INSTALL_SCRIPT"
          if [[ -s "$POST_INSTALL_SCRIPT" ]]; then
            sudo apt-get update
            sudo bash "$POST_INSTALL_SCRIPT"
          fi

          hash -r
          swift --version

      - name: Build CodexBarCLI (release)
        id: build
        shell: bash
        run: |
          set -euo pipefail

          BUILD_ARGS=(swift build -c release --product CodexBarCLI)
          if [[ -n "${{ matrix.build-arch }}" ]]; then
            BUILD_ARGS+=(--arch "${{ matrix.build-arch }}")
          fi
          if [[ "${{ matrix.static-swift-stdlib }}" == "true" ]]; then
            BUILD_ARGS+=(--static-swift-stdlib)
          fi
          "${BUILD_ARGS[@]}"

          SHOW_BIN_ARGS=(swift build -c release --product CodexBarCLI --show-bin-path)
          if [[ -n "${{ matrix.build-arch }}" ]]; then
            SHOW_BIN_ARGS+=(--arch "${{ matrix.build-arch }}")
          fi
          if [[ "${{ matrix.static-swift-stdlib }}" == "true" ]]; then
            SHOW_BIN_ARGS+=(--static-swift-stdlib)
          fi

          echo "bin_dir=$("${SHOW_BIN_ARGS[@]}")" >> "$GITHUB_OUTPUT"

      - name: Smoke test CodexBarCLI
        timeout-minutes: 5
        shell: bash
        run: |
          set -euo pipefail

          BIN_DIR="${{ steps.build.outputs.bin_dir }}"
          BIN="$BIN_DIR/CodexBarCLI"
          run_with_timeout() {
            local output="$1"
            shift
            "$@" > "$output" &
            local pid=$!
            local run_status=
            for _ in {1..20}; do
              if ! kill -0 "$pid" 2>/dev/null; then
                set +e
                wait "$pid"
                run_status=$?
                set -e
                break
              fi
              sleep 1
            done
            if [[ -z "$run_status" ]]; then
              kill "$pid" 2>/dev/null || true
              wait "$pid" 2>/dev/null || true
              echo "$* timed out." >&2
              exit 124
            fi
            if [[ "$run_status" -ne 0 ]]; then
              cat "$output" >&2 || true
              exit "$run_status"
            fi
          }

          echo "BIN=$BIN"
          file "$BIN"
          if [[ "${{ matrix.platform }}" == "macos" ]]; then
            lipo -archs "$BIN" | tr ' ' '\n' | grep -Fx "${{ matrix.asset-arch }}"
            run_with_timeout "$RUNNER_TEMP/codexbar-cli-smoke-${{ matrix.name }}.txt" "$BIN" config validate --format json
          else
            run_with_timeout "$RUNNER_TEMP/codexbar-cli-help-${{ matrix.name }}.txt" "$BIN" --help
            file "$BIN" | grep -q "${{ matrix.asset-arch }}"
          fi
          printf '%s\n' "${RELEASE_TAG#v}" > "$BIN_DIR/VERSION"
          VERSION_OUTPUT="$RUNNER_TEMP/codexbar-cli-version-${{ matrix.name }}.txt"
          run_with_timeout "$VERSION_OUTPUT" "$BIN" --version
          grep -Fx "CodexBar ${RELEASE_TAG#v}" "$VERSION_OUTPUT"
          rm "$BIN_DIR/VERSION"

      - name: Package
        id: pkg
        shell: bash
        run: |
          set -euo pipefail

          REF_NAME="${RELEASE_TAG}"
          if [[ -z "$REF_NAME" ]]; then
            echo "Missing release tag." >&2
            exit 1
          fi
          SAFE_REF_NAME="${REF_NAME//\//-}"

          BIN_DIR="${{ steps.build.outputs.bin_dir }}"
          OUT_DIR="$(mktemp -d)"
          install -m 0755 "$BIN_DIR/CodexBarCLI" "$OUT_DIR/CodexBarCLI"
          ln -s "CodexBarCLI" "$OUT_DIR/codexbar"
          printf '%s\n' "${SAFE_REF_NAME#v}" > "$OUT_DIR/VERSION"

          ASSET="CodexBarCLI-${SAFE_REF_NAME}-${{ matrix.platform }}-${{ matrix.asset-arch }}.tar.gz"
          (cd "$OUT_DIR" && tar czf "$ASSET" CodexBarCLI codexbar VERSION)
          if command -v sha256sum >/dev/null 2>&1; then
            sha256sum "$OUT_DIR/$ASSET" > "$OUT_DIR/$ASSET.sha256"
          else
            shasum -a 256 "$OUT_DIR/$ASSET" > "$OUT_DIR/$ASSET.sha256"
          fi

          echo "out_dir=$OUT_DIR" >> "$GITHUB_OUTPUT"
          echo "asset=$ASSET" >> "$GITHUB_OUTPUT"

      - name: Upload release assets
        if: github.event_name == 'release'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          TAG="${RELEASE_TAG}"
          OUT_DIR="${{ steps.pkg.outputs.out_dir }}"
          ASSET="${{ steps.pkg.outputs.asset }}"
          gh release upload "$TAG" "$OUT_DIR/$ASSET" "$OUT_DIR/$ASSET.sha256" --clobber

      - name: Upload workflow artifact (manual runs)
        if: github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v6
        with:
          name: codexbar-cli-${{ matrix.name }}
          path: |
            ${{ steps.pkg.outputs.out_dir }}/${{ steps.pkg.outputs.asset }}
            ${{ steps.pkg.outputs.out_dir }}/${{ steps.pkg.outputs.asset }}.sha256

  update-homebrew-tap:
    runs-on: ubuntu-latest
    needs: build-cli
    if: github.event_name == 'release'
    steps:
      - name: Resolve release tag
        id: release
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        shell: bash
        run: |
          set -euo pipefail
          tag="${RELEASE_TAG}"
          if [[ -z "$tag" ]]; then
            echo "Missing release tag." >&2
            exit 1
          fi
          if [[ ! "$tag" =~ ^v[0-9A-Za-z._-]+$ ]]; then
            echo "Invalid release tag: $tag" >&2
            exit 1
          fi
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          echo "request_id=codexbar-${tag}-${GITHUB_RUN_ID}" >> "$GITHUB_OUTPUT"

      - name: Dispatch tap update
        env:
          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          RELEASE_TAG: ${{ steps.release.outputs.tag }}
          REQUEST_ID: ${{ steps.release.outputs.request_id }}
        shell: bash
        run: |
          set -euo pipefail
          test -n "$GH_TOKEN"
          for attempt in {1..6}; do
            if gh workflow run update-formula.yml \
              --repo steipete/homebrew-tap \
              -f formula=codexbar \
              -f tag="$RELEASE_TAG" \
              -f repository=steipete/CodexBar \
              -f artifact_template='CodexBarCLI-{tag}-{target}.tar.gz' \
              -f target_aliases='darwin_arm64=macos-arm64,darwin_amd64=macos-x86_64,linux_arm64=linux-aarch64,linux_amd64=linux-x86_64' \
              -f cask=codexbar \
              -f cask_artifact='CodexBar-macos-universal-{version}.zip' \
              -f request_id="$REQUEST_ID"; then
              exit 0
            fi
            if [[ "$attempt" -eq 6 ]]; then
              echo "Failed to dispatch tap update after ${attempt} attempts." >&2
              exit 1
            fi
            sleep $((attempt * 30))
          done

      - name: Wait for tap update
        env:
          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          REQUEST_ID: ${{ steps.release.outputs.request_id }}
        shell: bash
        run: |
          set -euo pipefail
          for _ in {1..20}; do
            run_id="$(
              gh run list \
                --repo steipete/homebrew-tap \
                --workflow update-formula.yml \
                --json databaseId,displayTitle \
                --jq '.[] | select(.displayTitle | contains(env.REQUEST_ID)) | .databaseId' 2>/tmp/codexbar-tap-run-list.err \
                | head -n1 || true
            )"
            if [[ -n "$run_id" ]]; then
              gh run watch "$run_id" --repo steipete/homebrew-tap --exit-status
              exit 0
            fi
            cat /tmp/codexbar-tap-run-list.err >&2 || true
            sleep 5
          done
          echo "Timed out waiting for tap workflow to appear." >&2
          exit 1