release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  actions: write

env:
  CARGO_TERM_COLOR: always

jobs:
  # ── Tests must pass before release ─────────────────────────────
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      A3S_DEPS_STUB: "1"
    steps:
      - uses: actions/checkout@v4
      - name: Init submodules
        run: git -c http.extraheader= submodule update --init --recursive
      - uses: dtolnay/rust-toolchain@stable
      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
      - name: Create stub libkrun for linking
        run: |
          echo "void krun_stub(void) {}" > /tmp/krun_stub.c
          gcc -shared -o /tmp/libkrun.so /tmp/krun_stub.c
          sudo cp /tmp/libkrun.so /usr/lib/
          sudo ldconfig
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src
      - run: cd src && cargo test --workspace --lib

  # ── Build matrix ───────────────────────────────────────────────
  build:
    name: Build (${{ matrix.target }})
    needs: test
    strategy:
      matrix:
        include:
          - target: linux-x86_64
            os: ubuntu-latest
            rust_target: x86_64-unknown-linux-musl
            guest_target: x86_64-unknown-linux-musl
            build_cri: true
          - target: linux-arm64
            os: ubuntu-24.04-arm
            rust_target: aarch64-unknown-linux-musl
            guest_target: aarch64-unknown-linux-musl
            build_cri: true
          - target: macos-arm64
            os: macos-14
            rust_target: ""
            guest_target: aarch64-unknown-linux-musl
            build_cri: false

    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      - name: Init submodules
        run: |
          git -c http.extraheader= submodule update --init --recursive

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.guest_target }}

      - name: Install dependencies (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            build-essential pkg-config libssl-dev \
            musl-tools libclang-dev patchelf protobuf-compiler

      - name: Install dependencies (macOS)
        if: runner.os == 'macOS'
        run: |
          brew install lld llvm protobuf
          pip3 install --break-system-packages ziglang
          cargo install cargo-zigbuild

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src
          key: release-${{ matrix.target }}

      - name: Build host binaries
        run: |
          cd src
          cargo build --release -p a3s-box-cli -p a3s-box-shim
          if [ "${{ matrix.build_cri }}" = "true" ]; then
            cargo build --release -p a3s-box-cri
          fi

      - name: Build guest binaries
        run: |
          cd src
          if [ "${{ runner.os }}" = "macOS" ]; then
            cargo zigbuild --release \
              -p a3s-box-guest-init \
              --target ${{ matrix.guest_target }}
          else
            cargo build --release \
              -p a3s-box-guest-init \
              --target ${{ matrix.guest_target }}
          fi

      - name: Package release
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          DIR="a3s-box-${TAG}-${{ matrix.target }}"
          mkdir -p "$DIR/lib"

          cp src/target/release/a3s-box "$DIR/"
          cp src/target/release/a3s-box-shim "$DIR/"

          if [ "${{ matrix.build_cri }}" = "true" ]; then
            cp src/target/release/a3s-box-cri "$DIR/"
          fi

          cp "src/target/${{ matrix.guest_target }}/release/a3s-box-guest-init" "$DIR/"

          # Find and copy libkrun/libkrunfw shared libraries from build output
          BUILD_DIR=$(find src/target/release/build -name "out" -path "*libkrun*" -type d | head -1)
          if [ -n "$BUILD_DIR" ]; then
            find "$BUILD_DIR" -name "libkrun*" \( -name "*.dylib" -o -name "*.so*" \) -exec cp {} "$DIR/lib/" \;
            find "$BUILD_DIR" -name "libkrunfw*" \( -name "*.dylib" -o -name "*.so*" \) -exec cp {} "$DIR/lib/" \;
          fi

          # Fix rpath for macOS binaries to look in ../lib relative to bin
          if [ "${{ runner.os }}" = "macOS" ]; then
            for bin in "$DIR/a3s-box" "$DIR/a3s-box-shim"; do
              install_name_tool -add_rpath @executable_path/../lib "$bin" 2>/dev/null || true
              install_name_tool -add_rpath @executable_path/lib "$bin" 2>/dev/null || true
            done
          fi

          # Fix rpath for Linux binaries
          if [ "${{ runner.os }}" = "Linux" ]; then
            for bin in "$DIR/a3s-box" "$DIR/a3s-box-shim"; do
              patchelf --set-rpath '$ORIGIN/lib' "$bin" 2>/dev/null || true
            done
            if [ "${{ matrix.build_cri }}" = "true" ]; then
              patchelf --set-rpath '$ORIGIN/lib' "$DIR/a3s-box-cri" 2>/dev/null || true
            fi
          fi

          cp README.md "$DIR/" 2>/dev/null || true
          cp LICENSE "$DIR/" 2>/dev/null || true

          # List package contents
          echo "Package contents:"
          ls -lhR "$DIR/"

          tar czf "${DIR}.tar.gz" "$DIR"
          echo "ASSET=${DIR}.tar.gz" >> "$GITHUB_ENV"

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.target }}
          path: ${{ env.ASSET }}

  # ── Create GitHub Release ──────────────────────────────────────

  # ── Windows native WHPX build ──────────────────────────────────
  build-windows:
    name: Build Windows (WHPX Backend)
    needs: [test, build]
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - name: Init submodules
        run: git -c http.extraheader= submodule update --init --recursive
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-pc-windows-msvc
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src
          key: release-windows

      - name: Build Windows native binaries
        run: |
          cd src
          cargo build --release -p a3s-box-cli -p a3s-box-shim --target x86_64-pc-windows-msvc

      - name: Download Linux guest init artifact
        uses: actions/download-artifact@v4
        with:
          name: linux-x86_64
          path: linux-x86_64

      - name: Package Windows release
        shell: bash
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          DIR="a3s-box-${TAG}-windows-x86_64"
          mkdir -p "$DIR/lib"

          cp src/target/x86_64-pc-windows-msvc/release/a3s-box.exe "$DIR/"
          cp src/target/x86_64-pc-windows-msvc/release/a3s-box-shim.exe "$DIR/"

          tar -xzf "linux-x86_64/a3s-box-${TAG}-linux-x86_64.tar.gz" -C linux-x86_64
          cp "linux-x86_64/a3s-box-${TAG}-linux-x86_64/a3s-box-guest-init" "$DIR/"

          if [ -f "src/target/x86_64-pc-windows-msvc/release/krun.dll" ]; then
            cp src/target/x86_64-pc-windows-msvc/release/krun.dll "$DIR/lib/"
          elif [ -f "src/deps/libkrun-sys/prebuilt/x86_64-pc-windows-msvc/krun.dll" ]; then
            cp src/deps/libkrun-sys/prebuilt/x86_64-pc-windows-msvc/krun.dll "$DIR/lib/"
          else
            echo "krun.dll is required for the native WHPX package" >&2
            exit 1
          fi

          # Copy README and LICENSE
          cp README.md "$DIR/" 2>/dev/null || true
          cp LICENSE "$DIR/" 2>/dev/null || true

          # List package contents
          echo "Package contents:"
          ls -lhR "$DIR/"

          # Create zip archive (Windows-friendly)
          powershell Compress-Archive -Path "$DIR" -DestinationPath "${DIR}.zip"
          echo "ASSET=${DIR}.zip" >> "$GITHUB_ENV"

      - uses: actions/upload-artifact@v4
        with:
          name: windows-x86_64
          path: ${{ env.ASSET }}

  release:
    name: GitHub Release
    needs: [build, build-windows]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: List artifacts
        run: find artifacts -type f

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          name: ${{ github.ref_name }}
          generate_release_notes: true
          files: |
            artifacts/**/*.tar.gz
            artifacts/**/*.zip

  # ── Publish to crates.io ───────────────────────────────────────
  publish-crates:
    name: Publish to crates.io
    needs: release
    runs-on: ubuntu-latest
    env:
      A3S_DEPS_STUB: "1"
    steps:
      - uses: actions/checkout@v4
      - name: Init submodules
        run: git -c http.extraheader= submodule update --init --recursive
      - uses: dtolnay/rust-toolchain@stable
      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
      - name: Create stub libkrun for linking
        run: |
          echo "void krun_stub(void) {}" > /tmp/krun_stub.c
          gcc -shared -o /tmp/libkrun.so /tmp/krun_stub.c
          sudo cp /tmp/libkrun.so /usr/lib/
          sudo ldconfig
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src
      - name: Publish crates
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        # NOTE: crates.io is NOT the primary distribution channel — the GitHub
        # Release tarballs + Homebrew + winget are. This step is best-effort but
        # MUST NOT silently report success on a real failure (it used to:
        # `cargo publish || echo "Skipped"` masked 403s / version-requirement
        # errors as "may already be published"). Now an already-published
        # version is skipped truthfully and a genuine failure is a ::warning::.
        run: |
          cd src
          VERSION="${GITHUB_REF_NAME#v}"
          echo "Publishing version $VERSION (in dependency order)"
          FAILED=""
          # Order matters: a dependent is published AFTER its internal deps so
          # the index has them. runtime depends on core + netproxy + libkrun-sys;
          # a3s-box-sdk is dependency-free (a thin CLI wrapper) so its position is free.
          for crate in a3s-libkrun-sys a3s-box-core a3s-box-netproxy a3s-box-runtime a3s-box-sdk; do
            code=$(curl -s -o /dev/null -w '%{http_code}' "https://crates.io/api/v1/crates/$crate/$VERSION")
            if [ "$code" = "200" ]; then
              echo "✓ $crate@$VERSION already on crates.io — skipping"
              continue
            fi
            echo "Publishing $crate@$VERSION..."
            if cargo publish -p "$crate" --allow-dirty; then
              echo "✓ published $crate@$VERSION"
              sleep 30   # let the sparse index update before dependents publish
            else
              echo "::warning title=crates.io publish failed::$crate@$VERSION failed (token/auth or version requirement). GitHub Release + Homebrew + winget are unaffected."
              FAILED="$FAILED $crate"
            fi
          done
          if [ -n "$FAILED" ]; then
            echo "::warning::crates.io publish incomplete for:$FAILED — does NOT block the release; rotate CARGO_REGISTRY_TOKEN / fix version requirements to resolve."
          fi

  # ── Update Homebrew Formula ────────────────────────────────────
  publish-homebrew:
    name: Update Homebrew
    needs: release
    runs-on: ubuntu-latest
    steps:
      - name: Wait for release assets
        run: sleep 15

      - name: Extract version
        id: version
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          VERSION="${TAG#v}"
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Download release tarballs and compute SHA256
        run: |
          TAG="${{ steps.version.outputs.tag }}"
          BASE="https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}"

          for target in linux-x86_64 linux-arm64 macos-arm64; do
            FILE="a3s-box-${TAG}-${target}.tar.gz"
            curl -sL "${BASE}/${FILE}" -o "${FILE}"
            SHA=$(shasum -a 256 "${FILE}" | awk '{print $1}')
            echo "SHA_${target//-/_}=${SHA}" >> "$GITHUB_ENV"
            echo "${target}: ${SHA}"
          done

      - name: Checkout homebrew-tap
        uses: actions/checkout@v4
        with:
          repository: A3S-Lab/homebrew-tap
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: homebrew-tap

      - name: Update formula
        run: |
          TAG="${{ steps.version.outputs.tag }}"
          VERSION="${{ steps.version.outputs.version }}"
          REPO="${GITHUB_REPOSITORY}"
          cat > homebrew-tap/Formula/a3s-box.rb <<FORMULA
          class A3sBox < Formula
            desc "MicroVM sandbox runtime with TEE support"
            homepage "https://github.com/${REPO}"
            version "${VERSION}"
            license "MIT"

            on_macos do
              on_arm do
                url "https://github.com/${REPO}/releases/download/${TAG}/a3s-box-${TAG}-macos-arm64.tar.gz"
                sha256 "${SHA_macos_arm64}"
              end
            end

            on_linux do
              on_arm do
                url "https://github.com/${REPO}/releases/download/${TAG}/a3s-box-${TAG}-linux-arm64.tar.gz"
                sha256 "${SHA_linux_arm64}"
              end
              on_intel do
                url "https://github.com/${REPO}/releases/download/${TAG}/a3s-box-${TAG}-linux-x86_64.tar.gz"
                sha256 "${SHA_linux_x86_64}"
              end
            end

            def install
              bin.install "a3s-box"
              bin.install "a3s-box-shim"
              bin.install "a3s-box-guest-init"
              bin.install "a3s-box-cri" if File.exist?("a3s-box-cri")
              lib.install Dir["lib/*"] if Dir.exist?("lib")
            end

            test do
              assert_match "a3s-box", shell_output("#{bin}/a3s-box --version")
            end
          end
          FORMULA
          # Remove leading whitespace from heredoc
          sed -i 's/^          //' homebrew-tap/Formula/a3s-box.rb

      - name: Push formula
        run: |
          cd homebrew-tap
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Formula/a3s-box.rb
          git commit -m "chore: update a3s-box to ${{ steps.version.outputs.tag }}"
          git push

  # ── Trigger winget publishing ───────────────────────────────────
  trigger-winget:
    name: Trigger winget Publishing
    needs: release
    runs-on: ubuntu-latest
    steps:
      - name: Trigger winget workflow
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const tag = context.ref.replace('refs/tags/', '');
            const version = tag.replace('v', '');

            await github.rest.actions.createWorkflowDispatch({
              owner: context.repo.owner,
              repo: context.repo.repo,
              workflow_id: 'publish-winget.yml',
              ref: 'main',
              inputs: {
                version: version
              }
            });

            console.log(`Triggered winget publishing for version ${version}`);