release.yml

name: release

# Builds release binaries on every `v*` tag, packages them per platform,
# and publishes them to a GitHub Release. Users then install via:
#   * `cargo binstall inkhaven` (uses [package.metadata.binstall] in
#     Cargo.toml to fetch the matching prebuilt)
#   * Direct download from the Releases page
#   * `cargo install --git https://github.com/vulogov/blackInkhaven`
#     (compiles from source against vendored deps)
#
# Manual run is also possible via the Actions tab → "Run workflow".

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to release (e.g. v1.0.1)"
        required: true
        type: string

permissions:
  contents: write   # needed to create the Release and upload assets

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  # ----------------------------------------------------------------------
  # Build a release binary on each target platform. Each matrix job
  # produces one tarball / zip uploaded as a workflow artifact; the
  # `release` job below collects them and posts the GitHub Release.
  # ----------------------------------------------------------------------
  build:
    name: build (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    # Windows is soft-failure (DEFERRED — see the matrix note below). The
    # windows-gnu build currently cannot succeed: `ort-sys` (ONNX Runtime via
    # `fastembed`) has no windows-gnu prebuilt. Kept soft-fail so the Linux +
    # macOS assets still publish; Windows users fall back to `cargo install
    # --git` on an msvc toolchain. Revisit when ort ships a gnu binary or we
    # move to the windows-msvc target.
    continue-on-error: ${{ matrix.target == 'x86_64-pc-windows-gnu' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            archive: tar.gz
          - os: macos-latest
            target: aarch64-apple-darwin
            archive: tar.gz
          # Windows: DEFERRED — soft-fail, no release asset for now.
          # Root cause (confirmed 2026-07-31): the `x86_64-pc-windows-gnu`
          # build fails at `ort-sys` — the ONNX Runtime bindings pulled in by
          # `fastembed` for embeddings ship prebuilt binaries for windows-MSVC
          # but NOT windows-gnu ("ort does not provide prebuilt binaries for
          # x86_64-pc-windows-gnu"). This is upstream (pyke/ort), not our code;
          # the MSYS2 toolchain (duckdb C++, fontconfig) itself is fine.
          # DECISION: leave Windows soft-failing and push a Windows release to
          # the future, WHEN one of these unblocks it —
          #   (1) ort ships a windows-gnu prebuilt (then this just goes green), OR
          #   (2) we adopt the windows-MSVC target (ort HAS msvc prebuilts;
          #       build-time provenance, same security model as Linux/macOS —
          #       the RECOMMENDED path; needs the codebase made msvc-clean), OR
          #   (3) we bundle a build-time-verified onnxruntime.dll in the zip.
          # REJECTED: downloading + loading onnxruntime.dll at runtime/startup —
          # it executes third-party native code in-process (DLL-hijack + supply-
          # chain + tamper surface); strictly more attack surface than (1)-(3).
          # See Documentation/2.0_READINESS.md § "Known platform note".
          - os: windows-latest
            target: x86_64-pc-windows-gnu
            archive: zip
          # macOS x86_64 (Intel) stays disabled. The macos-13
          # runner pool is heavily capacity-constrained — v1.0.2's job
          # sat in `queued` for 3+ hours without picking up a runner.
          # Apple stopped selling Intel Macs in 2023; modern users are
          # on Apple Silicon (aarch64) above. Intel-Mac users can still
          # `cargo install --git`. Re-enable once GitHub-hosted macos-13
          # runner availability improves OR by adopting a self-hosted
          # Intel-Mac runner.
          # - os: macos-13
          #   target: x86_64-apple-darwin
          #   archive: tar.gz
          #
          # Windows build steps (MSYS2/mingw-w64: fontconfig via pkg-config,
          # duckdb's C++ via mingw g++) remain below so the config is ready the
          # moment the ort-sys blocker lifts — but the build stops at ort-sys
          # today, so it's kept `continue-on-error` and ships no asset. See the
          # windows-gnu matrix entry above for the root cause + the decision to
          # defer, and Documentation/2.0_READINESS.md. (binstall for Windows
          # stays disabled in Cargo.toml until a Windows asset ships.)
    steps:
      - name: Resolve tag
        id: tag
        shell: bash
        run: |
          if [ -n "${{ inputs.tag }}" ]; then
            echo "value=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
          else
            echo "value=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
          fi

      - uses: actions/checkout@v5
        with:
          ref: ${{ steps.tag.outputs.value }}

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      # Linux: install system libs that the transitive native deps
      # need. fontconfig comes in via yeslogic-fontconfig-sys; the xcb-*
      # set covers arboard's X11 clipboard backend; libssl-dev is a common
      # baseline. macOS and Windows runners use platform-native equivalents.
      - name: Install Linux build dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            pkg-config \
            libfontconfig1-dev \
            libssl-dev \
            libxcb1-dev \
            libxcb-render0-dev \
            libxcb-shape0-dev \
            libxcb-xfixes0-dev \
            libasound2-dev

      # Windows (GNU/Cygwin path): set up MSYS2's mingw-w64 toolchain so the
      # `x86_64-pc-windows-gnu` target has a GCC/G++ (for duckdb's bundled C++),
      # pkg-config, and fontconfig (which `yeslogic-fontconfig-sys` discovers via
      # pkg-config). The MINGW64 environment puts `/mingw64/lib/pkgconfig` on the
      # default PKG_CONFIG_PATH, so no manual pointer is needed. The build step
      # below runs *inside* this shell (`shell: 'msys2 {0}'`) so gcc + pkg-config
      # are on PATH; cargo/rustup come in via the inherited Windows PATH.
      - name: Set up MSYS2 (mingw-w64) for windows-gnu
        if: matrix.target == 'x86_64-pc-windows-gnu'
        uses: msys2/setup-msys2@v2
        with:
          msystem: MINGW64
          update: true
          path-type: inherit
          install: >-
            mingw-w64-x86_64-gcc
            mingw-w64-x86_64-pkg-config
            mingw-w64-x86_64-fontconfig

      # See ci.yml: the duckdb-heavy rust-cache (~3.7 GB) can overflow the
      # Linux runner disk on extract. Reclaim ~20 GB of unused tooling
      # first. Linux-only — the paths don't exist on macOS / Windows.
      - name: Free disk space
        if: runner.os == 'Linux'
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc \
            /opt/hostedtoolcache/CodeQL
          sudo docker image prune --all --force || true
          df -h /

      # Caches `~/.cargo` + `target/` between runs. Critical: bdslib
      # pulls in duckdb / tantivy / fastembed / augurs, so a cold build
      # is 10–15 minutes. The cache key includes Cargo.lock so a real
      # dep change still rebuilds.
      - name: Cache cargo
        uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}

      # Linux glibc + macOS targets — the platform compilers are picked up
      # automatically.
      - name: Build (release)
        if: matrix.target != 'x86_64-pc-windows-gnu'
        run: cargo build --release --locked --target ${{ matrix.target }}

      # windows-gnu: build inside the MSYS2 MINGW64 shell so gcc/g++ and
      # pkg-config are on PATH (duckdb's bundled C++ + fontconfig discovery);
      # cargo/rustup resolve via the inherited Windows PATH.
      - name: Build (release, windows-gnu)
        if: matrix.target == 'x86_64-pc-windows-gnu'
        shell: 'msys2 {0}'
        run: cargo build --release --locked --target x86_64-pc-windows-gnu

      # Strip & package. The on-disk layout inside the archive is
      # `inkhaven-<target>/inkhaven[.exe]` so the cargo-binstall
      # `bin-dir` in Cargo.toml ("{name}-{target}/{bin}{binary-ext}")
      # resolves cleanly.
      - name: Package (unix)
        if: matrix.os != 'windows-latest'
        shell: bash
        run: |
          set -euo pipefail
          DIR="inkhaven-${{ matrix.target }}"
          mkdir -p "$DIR"
          cp "target/${{ matrix.target }}/release/inkhaven" "$DIR/"
          cp README.md LICENSE "$DIR/" 2>/dev/null || true
          strip "$DIR/inkhaven" || true
          tar -czf "$DIR.tar.gz" "$DIR"
          ls -la "$DIR.tar.gz"

      - name: Package (windows)
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: |
          $dir = "inkhaven-${{ matrix.target }}"
          New-Item -ItemType Directory -Force -Path $dir | Out-Null
          Copy-Item "target/${{ matrix.target }}/release/inkhaven.exe" "$dir/"
          if (Test-Path README.md) { Copy-Item README.md "$dir/" }
          if (Test-Path LICENSE)   { Copy-Item LICENSE "$dir/" }
          Compress-Archive -Path $dir -DestinationPath "$dir.zip"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: inkhaven-${{ matrix.target }}
          path: |
            inkhaven-${{ matrix.target }}.tar.gz
            inkhaven-${{ matrix.target }}.zip
          if-no-files-found: ignore
          retention-days: 7

  # ----------------------------------------------------------------------
  # Collect every artifact and publish a single GitHub Release.
  # ----------------------------------------------------------------------
  release:
    name: publish release
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Resolve tag
        id: tag
        shell: bash
        run: |
          if [ -n "${{ inputs.tag }}" ]; then
            echo "value=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
          else
            echo "value=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
          fi

      - uses: actions/checkout@v5
        with:
          ref: ${{ steps.tag.outputs.value }}

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: List artifacts
        run: ls -la dist

      - name: Create / update GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.tag.outputs.value }}
          name: ${{ steps.tag.outputs.value }}
          draft: false
          prerelease: ${{ contains(steps.tag.outputs.value, '-') }}
          generate_release_notes: true
          files: |
            dist/inkhaven-*.tar.gz
            dist/inkhaven-*.zip
          body: |
            Inkhaven ${{ steps.tag.outputs.value }} — TUI literary editor.

            ## Install

            * `cargo binstall inkhaven` (downloads the prebuilt matching your host triple)
            * `cargo install --git https://github.com/vulogov/blackInkhaven --tag ${{ steps.tag.outputs.value }}` (compiles from source)
            * Or pick the right archive below and unpack it into `$PATH`.

            ## Docs

            * Quick start: [README](https://github.com/vulogov/blackInkhaven/blob/${{ steps.tag.outputs.value }}/README.md)
            * Full manual: [Documentation/](https://github.com/vulogov/blackInkhaven/tree/${{ steps.tag.outputs.value }}/Documentation)