release.yml

name: release

on:
  push:
    tags: ['v*']
  workflow_dispatch:

# a half-uploaded release must never be clobbered by a second run of the same
# tag, so runs queue rather than cancel each other.
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always

jobs:
  # resolves the version once and opens the draft, so the twelve build jobs
  # below attach to an existing release instead of racing to create one.
  prepare:
    name: prepare
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      is_release: ${{ steps.meta.outputs.is_release }}
      version: ${{ steps.meta.outputs.version }}
      prerelease: ${{ steps.meta.outputs.prerelease }}
    steps:
      - uses: actions/checkout@v7

      # refuses a tag that disagrees with Cargo.toml, before anything builds.
      # runnable locally: scripts/release-version.sh tag v0.6.0
      - name: resolve version
        id: meta
        run: ./scripts/release-version.sh | tee -a "$GITHUB_OUTPUT"

      # opened as a draft: the release only becomes visible once publish has
      # confirmed every tarball landed. notes are the boilerplate below plus
      # github's generated changelog, which it appends.
      - name: open draft release
        uses: softprops/action-gh-release@v3
        if: steps.meta.outputs.is_release == 'true'
        with:
          draft: true
          prerelease: ${{ steps.meta.outputs.prerelease }}
          generate_release_notes: true
          body: |
            ## setup

            - download and extract the tarball
            - `cp .env.example .env`
            - `$EDITOR .env`

            ## run a workflow

            - `./flow-cli ./workflows/uuid-echo.json`

            ## launch the webui

            - `./flow-server`

  build-macos:
    name: build macos (${{ matrix.arch }}, ${{ matrix.python }})
    needs: prepare
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        arch: [arm64]
        python: ['3.11', '3.12', '3.13', 'nopy']
        include:
          - arch: arm64
            runner: macos-latest
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v7

      - uses: dtolnay/rust-toolchain@stable

      - uses: actions/setup-node@v7
        with:
          node-version: '20'
          cache: npm
          cache-dependency-path: ui/package-lock.json

      - uses: actions/setup-python@v7
        if: matrix.python != 'nopy'
        with:
          python-version: ${{ matrix.python }}

      - name: install ui deps
        run: cd ui && npm ci

      - name: bundle
        run: |
          set -- --platform darwin --arch "${{ matrix.arch }}"
          if [ "${{ matrix.python }}" = "nopy" ]; then set -- "$@" --no-python; fi
          ./scripts/bundle-release.sh "$@"

      - uses: actions/upload-artifact@v7
        with:
          name: flow-macos-${{ matrix.arch }}-${{ matrix.python }}
          path: dist/*.tgz

      - name: attach to draft
        uses: softprops/action-gh-release@v3
        if: needs.prepare.outputs.is_release == 'true'
        with:
          draft: true
          files: dist/*.tgz

  build-linux:
    name: build linux (${{ matrix.arch }}, ${{ matrix.python }})
    needs: prepare
    runs-on: ${{ matrix.runner }}
    container: ${{ matrix.python == 'nopy' && 'debian:trixie' || format('python:{0}-trixie', matrix.python) }}
    # a container job gets `sh`, not bash, whatever the image ships. saying so
    # is what makes shellcheck hold the steps below to POSIX -- a bash array
    # here is a syntax error that only shows up once a tag is already pushed.
    defaults:
      run:
        shell: sh
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        arch: [x86_64, arm64]
        python: ['3.11', '3.12', '3.13', 'nopy']
        include:
          - arch: x86_64
            runner: ubuntu-latest
          - arch: arm64
            runner: ubuntu-24.04-arm
    steps:
      - name: install system deps
        run: |
          apt-get update
          apt-get install -y --no-install-recommends \
            curl build-essential pkg-config git ca-certificates \
            libssl-dev nodejs npm

      - uses: actions/checkout@v7

      - name: mark workspace safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - uses: dtolnay/rust-toolchain@stable

      - name: install ui deps
        run: cd ui && npm ci

      - name: bundle
        run: |
          set -- --platform linux --arch "${{ matrix.arch }}"
          if [ "${{ matrix.python }}" = "nopy" ]; then set -- "$@" --no-python; fi
          ./scripts/bundle-release.sh "$@"

      - uses: actions/upload-artifact@v7
        with:
          name: flow-linux-${{ matrix.arch }}-${{ matrix.python }}
          path: dist/*.tgz

      - name: attach to draft
        uses: softprops/action-gh-release@v3
        if: needs.prepare.outputs.is_release == 'true'
        with:
          draft: true
          files: dist/*.tgz

  # the draft stays a draft unless every tarball built, so a partial matrix
  # leaves something to fix and re-run rather than a broken public release.
  publish:
    name: publish
    needs: [prepare, build-macos, build-linux]
    if: needs.prepare.outputs.is_release == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      # naming permissions at all drops every scope not listed, and
      # download-artifact needs this one to read the matrix's uploads
      actions: read
    steps:
      - uses: actions/download-artifact@v8
        with:
          path: dist
          merge-multiple: true

      - name: checksum the tarballs
        run: |
          cd dist
          sha256sum -- *.tgz > SHA256SUMS
          cat SHA256SUMS

      - name: publish release
        uses: softprops/action-gh-release@v3
        with:
          draft: false
          prerelease: ${{ needs.prepare.outputs.prerelease }}
          make_latest: ${{ needs.prepare.outputs.prerelease == 'true' && 'false' || 'true' }}
          files: dist/SHA256SUMS