release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (e.g., v0.1.0)'
        required: false
  push:
    tags:
      - "v*"

jobs:
  create-release:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      contents: write
    outputs:
      version: ${{ steps.version.outputs.version }}
      tag: ${{ steps.version.outputs.tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Bun
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: "1.3.9"
      - name: Resolve version
        id: version
        run: |
          TARGET_TAG="${{ github.event.inputs.tag }}"
          if [ -z "$TARGET_TAG" ]; then
            TARGET_TAG="$GITHUB_REF_NAME"
          fi
          if [ -z "$TARGET_TAG" ]; then
            echo "Missing tag. Provide workflow input 'tag' or run on a tag ref."
            exit 1
          fi
          VERSION="$(bun -e "const pkg = await Bun.file('package.json').json(); console.log(pkg.version)")"
          if [ "v$VERSION" != "$TARGET_TAG" ]; then
            echo "Tag $TARGET_TAG does not match package.json version $VERSION."
            exit 1
          fi
          echo "tag=$TARGET_TAG" >> "$GITHUB_OUTPUT"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
      - name: Create GitHub release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: "${{ steps.version.outputs.tag }}"
          generate_release_notes: true

  build:
    needs: create-release
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            upload_install: true
            skip_tests: true
          - os: macos-15
            upload_install: false
            skip_tests: true
          - os: blacksmith-6vcpu-macos-15
            upload_install: false
            skip_tests: true
          - os: macos-15-intel
            upload_install: false
            skip_tests: true
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Setup Bun
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: "1.3.9"
      - name: Install dependencies
        run: bun install
      - name: Build release artifacts
        if: ${{ !matrix.skip_tests }}
        run: bun run build:release --version="${{ needs.create-release.outputs.version }}"
      - name: Build release artifacts (skip tests)
        if: ${{ matrix.skip_tests }}
        run: bun run build:release --version="${{ needs.create-release.outputs.version }}" --skip-tests
      - name: Upload tarball
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ needs.create-release.outputs.tag }}
          RELEASE_VERSION: ${{ needs.create-release.outputs.version }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          files=(dist/release/hack-"${RELEASE_VERSION}"-*.tar.gz)
          if [ "${#files[@]}" -eq 0 ]; then
            echo "No tarballs matched dist/release/hack-${RELEASE_VERSION}-*.tar.gz"
            exit 1
          fi
          for file in "${files[@]}"; do
            for attempt in 1 2 3; do
              if gh release upload "${RELEASE_TAG}" "${file}" --clobber; then
                echo "Uploaded ${file}"
                break
              fi
              if [ "${attempt}" -eq 3 ]; then
                echo "Failed uploading ${file} after ${attempt} attempts"
                exit 1
              fi
              sleep $((attempt * 5))
            done
          done
      - name: Upload install scripts
        if: ${{ matrix.upload_install }}
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ needs.create-release.outputs.tag }}
          RELEASE_VERSION: ${{ needs.create-release.outputs.version }}
        run: |
          set -euo pipefail
          files=(
            "dist/release/hack-${RELEASE_VERSION}-install.sh"
            "dist/release/hack-install.sh"
            "dist/release/hack-${RELEASE_VERSION}-codex-install.sh"
            "dist/release/hack-codex-install.sh"
          )
          for file in "${files[@]}"; do
            if [ ! -f "${file}" ]; then
              echo "Missing expected install script: ${file}"
              exit 1
            fi
            for attempt in 1 2 3; do
              if gh release upload "${RELEASE_TAG}" "${file}" --clobber; then
                echo "Uploaded ${file}"
                break
              fi
              if [ "${attempt}" -eq 3 ]; then
                echo "Failed uploading ${file} after ${attempt} attempts"
                exit 1
              fi
              sleep $((attempt * 5))
            done
          done

  macos-app:
    needs: [create-release, build]
    permissions:
      contents: write
    uses: ./.github/workflows/release-macos-app.yml
    with:
      tag: ${{ needs.create-release.outputs.tag }}
    secrets: inherit

  update-homebrew-tap:
    needs: [create-release, build]
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      contents: read
    steps:
      - name: Require tap push token
        env:
          TAP_TOKEN: ${{ secrets.RELEASE_PAT }}
        run: |
          if [ -z "$TAP_TOKEN" ]; then
            echo "Missing secret RELEASE_PAT"
            exit 1
          fi
      - name: Checkout hack
        uses: actions/checkout@v4
      - name: Checkout tap repo
        uses: actions/checkout@v4
        with:
          repository: hack-dance/homebrew-tap
          token: ${{ secrets.RELEASE_PAT }}
          ref: main
          path: homebrew-tap
      - name: Setup Bun
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: "1.3.9"
      - name: Render formula
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          bun run scripts/update-homebrew-tap.ts \
            --tag="${{ needs.create-release.outputs.tag }}" \
            --version="${{ needs.create-release.outputs.version }}" \
            --tap-dir=homebrew-tap
      - name: Commit and push tap update
        working-directory: homebrew-tap
        run: |
          set -euo pipefail
          git add Formula/hack.rb
          if git diff --cached --quiet; then
            echo "No Homebrew tap changes to push."
            exit 0
          fi
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git commit -m "build(hack): update formula to ${{ needs.create-release.outputs.tag }}"
          git push origin HEAD:main