release.yml

name: release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        target: [x86_64-unknown-linux-musl, aarch64-unknown-linux-musl]
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - run: cargo install --locked cross
      - run: cross build --release --locked --target ${{ matrix.target }}
      # install.sh downloads exactly this name; changing it breaks every
      # install command the hub issues.
      - run: cp "target/${{ matrix.target }}/release/monitor-agent" "monitor-agent-${{ matrix.target }}"
      - uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.target }}
          path: monitor-agent-${{ matrix.target }}

  release:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v8
        with:
          merge-multiple: true
      # A manual dispatch builds and collects the binaries; only a tag publishes,
      # so the path can be exercised without cutting a release. gh ships on the
      # runner, keeping a third-party action out of the contents:write step.
      # sha256sums.txt is generated from a directory holding only the binaries,
      # so the names in it are bare. The hub relays these through an
      # operator-configured GitHub proxy and install.sh executes what arrives,
      # so a published digest is the only material available to verify them.
      - if: startsWith(github.ref, 'refs/tags/')
        run: |
          mkdir -p bin && mv monitor-agent-* bin/
          (cd bin && sha256sum monitor-agent-* > sha256sums.txt)
          gh release create "$GITHUB_REF_NAME" bin/monitor-agent-* bin/sha256sums.txt \
            --generate-notes --repo "$GITHUB_REPOSITORY"
        env:
          GH_TOKEN: ${{ github.token }}