release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

permissions: {}

jobs:
  release-source:
    name: Verify release source
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Require a release from main history
        shell: bash
        env:
          RELEASE_REF: ${{ github.ref }}
        run: |
          set -euo pipefail
          [[ "$RELEASE_REF" == refs/heads/main || "$RELEASE_REF" == refs/tags/v* ]]
          git merge-base --is-ancestor HEAD origin/main

  validate-crates:
    needs: release-source
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
      - name: Test crates without publication credentials
        run: cargo test --workspace --lib --bins --tests --examples

  publish-crates:
    environment: release
    needs: validate-crates
    name: Publish Rust crates
    runs-on: ubuntu-26.04
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30

      - name: Authenticate to crates.io
        id: crates_io_auth
        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5

      - name: Publish srcmap-codec
        run: .github/scripts/publish-crate-if-needed.sh srcmap-codec
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates_io_auth.outputs.token }}

      - name: Wait for crates.io index
        run: sleep 30

      - name: Publish srcmap-scopes
        run: .github/scripts/publish-crate-if-needed.sh srcmap-scopes
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates_io_auth.outputs.token }}

      - name: Wait for crates.io index
        run: sleep 30

      - name: Publish srcmap-sourcemap
        run: .github/scripts/publish-crate-if-needed.sh srcmap-sourcemap
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates_io_auth.outputs.token }}

      - name: Wait for crates.io index
        run: sleep 30

      - name: Publish srcmap-symbolicate
        run: .github/scripts/publish-crate-if-needed.sh srcmap-symbolicate
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates_io_auth.outputs.token }}

      - name: Publish srcmap-generator
        run: .github/scripts/publish-crate-if-needed.sh srcmap-generator
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates_io_auth.outputs.token }}

      - name: Wait for crates.io index
        run: sleep 30

      - name: Publish srcmap-hermes
        run: .github/scripts/publish-crate-if-needed.sh srcmap-hermes
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates_io_auth.outputs.token }}

      - name: Publish srcmap-ram-bundle
        run: .github/scripts/publish-crate-if-needed.sh srcmap-ram-bundle
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates_io_auth.outputs.token }}

      - name: Publish srcmap-remapping
        run: .github/scripts/publish-crate-if-needed.sh srcmap-remapping
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates_io_auth.outputs.token }}

      - name: Publish srcmap-cli
        run: .github/scripts/publish-crate-if-needed.sh srcmap-cli
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates_io_auth.outputs.token }}

  build-napi:
    needs: release-source
    name: Build NAPI - ${{ matrix.settings.target }}
    runs-on: ${{ matrix.settings.host }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        settings:
          - host: macos-latest
            target: x86_64-apple-darwin
          - host: macos-latest
            target: aarch64-apple-darwin
          # Preserve the existing libc baseline for host-linked GNU artifacts.
          - host: ubuntu-24.04
            target: x86_64-unknown-linux-gnu
          - host: ubuntu-26.04
            target: x86_64-unknown-linux-musl
          - host: ubuntu-24.04
            target: aarch64-unknown-linux-gnu
            linker: aarch64-linux-gnu-gcc
          - host: ubuntu-26.04
            target: aarch64-unknown-linux-musl
            linker: aarch64-linux-gnu-gcc
          - host: windows-latest
            target: x86_64-pc-windows-msvc

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          package-manager-cache: false
          node-version: 24
          registry-url: https://registry.npmjs.org/

      - name: Enable Corepack
        run: corepack enable

      - name: Install JS dependencies
        run: corepack pnpm install --ignore-scripts --frozen-lockfile

      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
        with:
          targets: ${{ matrix.settings.target }}

      - name: Install musl tools
        if: contains(matrix.settings.target, 'musl')
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools

      - name: Install aarch64 cross-compilation tools
        if: matrix.settings.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu

      - name: Install aarch64 musl cross-compilation tools
        if: matrix.settings.target == 'aarch64-unknown-linux-musl'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu musl-tools

      - name: Build codec NAPI binary
        run: |
          cd packages/codec
          corepack pnpm exec napi build --release --platform --target ${{ matrix.settings.target }}
        shell: bash
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: ${{ matrix.settings.linker || '' }}
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER: ${{ matrix.settings.linker || '' }}

      - name: Build sourcemap NAPI binary
        run: |
          cd packages/sourcemap
          corepack pnpm exec napi build --release --platform --target ${{ matrix.settings.target }}
        shell: bash
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: ${{ matrix.settings.linker || '' }}
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER: ${{ matrix.settings.linker || '' }}

      - name: Upload codec artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: codec-bindings-${{ matrix.settings.target }}
          path: packages/codec/*.node
          if-no-files-found: error

      - name: Upload sourcemap artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: sourcemap-bindings-${{ matrix.settings.target }}
          path: packages/sourcemap/*.node
          if-no-files-found: error

  build-wasm:
    needs: release-source
    name: Build WASM
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
        with:
          targets: wasm32-unknown-unknown

      - name: Install wasm-pack
        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
        with:
          tool: wasm-pack@0.13.1

      - name: Build sourcemap-wasm (nodejs)
        run: wasm-pack build --target nodejs --out-dir pkg --release
        working-directory: packages/sourcemap-wasm

      - name: Build sourcemap-wasm (web)
        run: wasm-pack build --target web --out-dir web --release
        working-directory: packages/sourcemap-wasm

      - name: Build generator-wasm (nodejs)
        run: wasm-pack build --target nodejs --out-dir pkg --release
        working-directory: packages/generator-wasm

      - name: Build generator-wasm (web)
        run: wasm-pack build --target web --out-dir web --release
        working-directory: packages/generator-wasm

      - name: Build remapping-wasm (nodejs)
        run: wasm-pack build --target nodejs --out-dir pkg --release
        working-directory: packages/remapping-wasm

      - name: Build remapping-wasm (web)
        run: wasm-pack build --target web --out-dir web --release
        working-directory: packages/remapping-wasm

      - name: Build symbolicate-wasm (nodejs)
        run: wasm-pack build --target nodejs --out-dir pkg --release
        working-directory: packages/symbolicate-wasm

      - name: Build symbolicate-wasm (web)
        run: wasm-pack build --target web --out-dir web --release
        working-directory: packages/symbolicate-wasm

      - name: Remove wasm-pack .gitignore files
        run: |
          rm -f packages/sourcemap-wasm/pkg/.gitignore packages/sourcemap-wasm/web/.gitignore
          rm -f packages/generator-wasm/pkg/.gitignore packages/generator-wasm/web/.gitignore
          rm -f packages/remapping-wasm/pkg/.gitignore packages/remapping-wasm/web/.gitignore
          rm -f packages/symbolicate-wasm/pkg/.gitignore packages/symbolicate-wasm/web/.gitignore

      - name: Upload sourcemap-wasm pkg artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: wasm-sourcemap-package
          path: packages/sourcemap-wasm/pkg/
          if-no-files-found: error

      - name: Upload sourcemap-wasm web artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: wasm-sourcemap-web
          path: packages/sourcemap-wasm/web/
          if-no-files-found: error

      - name: Upload generator-wasm pkg artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: wasm-generator-package
          path: packages/generator-wasm/pkg/
          if-no-files-found: error

      - name: Upload generator-wasm web artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: wasm-generator-web
          path: packages/generator-wasm/web/
          if-no-files-found: error

      - name: Upload remapping-wasm pkg artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: wasm-remapping-package
          path: packages/remapping-wasm/pkg/
          if-no-files-found: error

      - name: Upload remapping-wasm web artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: wasm-remapping-web
          path: packages/remapping-wasm/web/
          if-no-files-found: error

      - name: Upload symbolicate-wasm pkg artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: wasm-symbolicate-package
          path: packages/symbolicate-wasm/pkg/
          if-no-files-found: error

      - name: Upload symbolicate-wasm web artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: wasm-symbolicate-web
          path: packages/symbolicate-wasm/web/
          if-no-files-found: error

  prepare-npm:
    name: Prepare npm packages
    runs-on: ubuntu-26.04
    needs: [build-napi, build-wasm]
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          package-manager-cache: false
          node-version: 24
          registry-url: https://registry.npmjs.org/

      - name: Enable Corepack
        run: corepack enable

      - name: Install JS dependencies
        run: corepack pnpm install --ignore-scripts --frozen-lockfile

      - name: Configure npm registry
        run: npm config set registry https://registry.npmjs.org/

      - name: Download all codec NAPI artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          path: packages/codec/artifacts
          pattern: codec-bindings-*
          merge-multiple: false

      - name: Download all sourcemap NAPI artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          path: packages/sourcemap/artifacts
          pattern: sourcemap-bindings-*
          merge-multiple: false

      - name: Download sourcemap-wasm pkg artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: wasm-sourcemap-package
          path: packages/sourcemap-wasm/pkg

      - name: Download sourcemap-wasm web artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: wasm-sourcemap-web
          path: packages/sourcemap-wasm/web

      - name: Download generator-wasm pkg artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: wasm-generator-package
          path: packages/generator-wasm/pkg

      - name: Download generator-wasm web artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: wasm-generator-web
          path: packages/generator-wasm/web

      - name: Download remapping-wasm pkg artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: wasm-remapping-package
          path: packages/remapping-wasm/pkg

      - name: Download remapping-wasm web artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: wasm-remapping-web
          path: packages/remapping-wasm/web

      - name: Download symbolicate-wasm pkg artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: wasm-symbolicate-package
          path: packages/symbolicate-wasm/pkg

      - name: Download symbolicate-wasm web artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: wasm-symbolicate-web
          path: packages/symbolicate-wasm/web

      - name: Move codec artifacts
        run: corepack pnpm exec napi artifacts -d artifacts
        working-directory: packages/codec

      - name: Move sourcemap artifacts
        run: corepack pnpm exec napi artifacts -d artifacts
        working-directory: packages/sourcemap

      - name: Pack prepared release artifacts without lifecycle scripts
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/npm-release"
          for dir in ./packages/codec/npm/*/ ./packages/sourcemap/npm/*/ ./packages/codec ./packages/sourcemap ./packages/sourcemap-wasm ./packages/generator-wasm ./packages/source-map ./packages/gen-mapping ./packages/remapping-wasm ./packages/remapping ./packages/symbolicate-wasm ./packages/trace-mapping; do
            npm pack "$dir" --ignore-scripts --json --pack-destination "$RUNNER_TEMP/npm-release" |
              jq -er '.[0].filename' >> "$RUNNER_TEMP/npm-release/PUBLISH_ORDER"
          done
          cd "$RUNNER_TEMP/npm-release"
          sha256sum ./*.tgz PUBLISH_ORDER > SHA256SUMS

      - name: Upload prepared npm tarballs
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: npm-release-ready
          path: ${{ runner.temp }}/npm-release/
          if-no-files-found: error

  publish-npm:
    name: Publish prepared npm tarballs
    needs: prepare-npm
    environment: release
    runs-on: ubuntu-26.04
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          package-manager-cache: false
          node-version: 24
          registry-url: https://registry.npmjs.org
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: npm-release-ready
          path: tarballs
      - name: Verify and publish prepared tarballs
        shell: bash
        run: |
          set -euo pipefail
          cd tarballs
          sha256sum --check --strict SHA256SUMS
          while IFS= read -r file; do
            [[ "$file" == *.tgz && "$file" != */* ]]
            file="./$file"
            manifest=$(tar -xOf "$file" package/package.json)
            name=$(jq -er .name <<< "$manifest")
            version=$(jq -er .version <<< "$manifest")
            if npm view "$name@$version" version >/dev/null 2>&1; then
              echo "Skipping $name@$version; already present on npm"
              continue
            fi
            npm publish "$file" --access public --provenance --ignore-scripts
          done < PUBLISH_ORDER