release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

env:
  RUST_VERSION: 1.91.1

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: true

jobs:
  benchmark-gate:
    name: Blocking benchmark gate
    runs-on: ubuntu-22.04
    timeout-minutes: 20
    env:
      TERM: xterm-256color
      LANG: C.UTF-8
      LC_ALL: C.UTF-8
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_VERSION }}

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri
          key: release-benchmark-gate

      - name: Build release binary
        working-directory: src-tauri
        run: cargo build --release

      - name: Run blocking benchmarks
        run: |
          python3 scripts/benchmark_cc_switch.py \
            --binary src-tauri/target/release/cc-switch \
            --operation-set ci-blocking \
            --iterations 5 \
            --warmup 1 \
            --providers-per-app 12 \
            --usage-rows 500 \
            --sessions-per-app 8 \
            --mcp-rows 4 \
            --skill-rows 4 \
            --redact-paths \
            --fail-fast \
            --json-output benchmark-results.json

      - name: Check benchmark thresholds
        run: |
          python3 scripts/check_benchmark_thresholds.py \
            benchmark-results.json \
            --summary-output benchmark-summary.md

      - name: Upload benchmark artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: release-benchmark-results
          path: |
            benchmark-results.json
            benchmark-summary.md
          if-no-files-found: warn

  build:
    name: Build ${{ matrix.platform }}
    runs-on: ${{ matrix.os }}
    needs: benchmark-gate
    strategy:
      fail-fast: false
      matrix:
        include:
          # macOS ARM64
          - os: macos-14
            platform: darwin-arm64
            target: aarch64-apple-darwin
            binary: cc-switch
          # macOS x86_64
          - os: macos-14
            platform: darwin-x64
            target: x86_64-apple-darwin
            binary: cc-switch
          # Windows x86_64
          - os: windows-2022
            platform: windows-x64
            target: x86_64-pc-windows-msvc
            binary: cc-switch.exe
          # Linux x86_64 - MUSL (recommended)
          - os: ubuntu-22.04
            platform: linux-x64-musl
            target: x86_64-unknown-linux-musl
            binary: cc-switch
            use_cross: true
          # Linux x86_64 - GLIBC (fallback)
          - os: ubuntu-22.04
            platform: linux-x64
            target: x86_64-unknown-linux-gnu
            binary: cc-switch
            use_cross: false
          # Linux ARM64 - MUSL (recommended)
          - os: ubuntu-22.04
            platform: linux-arm64-musl
            target: aarch64-unknown-linux-musl
            binary: cc-switch
            use_cross: true
          # Linux ARM64 - GLIBC (fallback)
          - os: ubuntu-22.04
            platform: linux-arm64
            target: aarch64-unknown-linux-gnu
            binary: cc-switch
            use_cross: true

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_VERSION }}
          targets: ${{ matrix.target }}

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri
          key: ${{ matrix.target }}

      - name: Install cross
        if: matrix.use_cross == true
        run: cargo install cross --git https://github.com/cross-rs/cross

      - name: Install Linux dependencies (GLIBC x64)
        if: runner.os == 'Linux' && matrix.target == 'x86_64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            build-essential \
            pkg-config \
            libssl-dev

      - name: Build with cross
        if: matrix.use_cross == true
        working-directory: src-tauri
        run: cross build --release --target ${{ matrix.target }}

      - name: Build with cargo
        if: matrix.use_cross != true
        working-directory: src-tauri
        run: cargo build --release --target ${{ matrix.target }}

      - name: Prepare binary
        shell: bash
        run: |
          mkdir -p dist
          cp src-tauri/target/${{ matrix.target }}/release/${{ matrix.binary }} dist/

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: cc-switch-cli-${{ matrix.platform }}
          path: dist/${{ matrix.binary }}
          if-no-files-found: error

  # Create macOS universal binary
  universal-macos:
    name: Universal macOS Binary
    runs-on: macos-14
    needs: build
    steps:
      - name: Download ARM64 binary
        uses: actions/download-artifact@v4
        with:
          name: cc-switch-cli-darwin-arm64
          path: arm64

      - name: Download x64 binary
        uses: actions/download-artifact@v4
        with:
          name: cc-switch-cli-darwin-x64
          path: x64

      - name: Create universal binary
        run: |
          mkdir -p universal
          lipo -create -output universal/cc-switch arm64/cc-switch x64/cc-switch
          chmod +x universal/cc-switch
          file universal/cc-switch

      - name: Upload universal artifact
        uses: actions/upload-artifact@v4
        with:
          name: cc-switch-cli-darwin-universal
          path: universal/cc-switch
          if-no-files-found: error

  release:
    name: Create Release
    runs-on: ubuntu-22.04
    needs: [build, universal-macos]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          pattern: cc-switch-cli-*

      - name: Display structure
        run: |
          ls -R artifacts/

      - name: Install minisign
        shell: bash
        run: |
          set -euxo pipefail
          MINISIGN_VERSION="0.12"
          case "$(uname -m)" in
            x86_64|amd64) MINISIGN_ARCH="x86_64" ;;
            aarch64|arm64) MINISIGN_ARCH="aarch64" ;;
            *)
              echo "Unsupported minisign architecture: $(uname -m)" >&2
              exit 1
              ;;
          esac

          curl -fsSL \
            "https://github.com/jedisct1/minisign/releases/download/${MINISIGN_VERSION}/minisign-${MINISIGN_VERSION}-linux.tar.gz" \
            -o /tmp/minisign.tar.gz
          tar -xzf /tmp/minisign.tar.gz -C /tmp
          sudo install -m 0755 \
            "/tmp/minisign-linux/${MINISIGN_ARCH}/minisign" \
            /usr/local/bin/minisign
          minisign -v

      - name: Prepare release assets
        run: |
          set -euxo pipefail
          mkdir -p release-assets
          VERSION="${GITHUB_REF_NAME}"

          # macOS Universal
          if [ -f "artifacts/cc-switch-cli-darwin-universal/cc-switch" ]; then
            tar -czf release-assets/cc-switch-cli-${VERSION}-darwin-universal.tar.gz \
              -C artifacts/cc-switch-cli-darwin-universal cc-switch
            cp release-assets/cc-switch-cli-${VERSION}-darwin-universal.tar.gz \
              release-assets/cc-switch-cli-darwin-universal.tar.gz
          fi

          # macOS ARM64
          if [ -f "artifacts/cc-switch-cli-darwin-arm64/cc-switch" ]; then
            tar -czf release-assets/cc-switch-cli-${VERSION}-darwin-arm64.tar.gz \
              -C artifacts/cc-switch-cli-darwin-arm64 cc-switch
            cp release-assets/cc-switch-cli-${VERSION}-darwin-arm64.tar.gz \
              release-assets/cc-switch-cli-darwin-arm64.tar.gz
          fi

          # macOS x64
          if [ -f "artifacts/cc-switch-cli-darwin-x64/cc-switch" ]; then
            tar -czf release-assets/cc-switch-cli-${VERSION}-darwin-x64.tar.gz \
              -C artifacts/cc-switch-cli-darwin-x64 cc-switch
            cp release-assets/cc-switch-cli-${VERSION}-darwin-x64.tar.gz \
              release-assets/cc-switch-cli-darwin-x64.tar.gz
          fi

          # Windows
          if [ -f "artifacts/cc-switch-cli-windows-x64/cc-switch.exe" ]; then
            cd artifacts/cc-switch-cli-windows-x64
            zip ../../release-assets/cc-switch-cli-${VERSION}-windows-x64.zip cc-switch.exe
            cd ../..
            cp release-assets/cc-switch-cli-${VERSION}-windows-x64.zip \
              release-assets/cc-switch-cli-windows-x64.zip
          fi

          # Linux x64 - MUSL
          if [ -f "artifacts/cc-switch-cli-linux-x64-musl/cc-switch" ]; then
            tar -czf release-assets/cc-switch-cli-${VERSION}-linux-x64-musl.tar.gz \
              -C artifacts/cc-switch-cli-linux-x64-musl cc-switch
            cp release-assets/cc-switch-cli-${VERSION}-linux-x64-musl.tar.gz \
              release-assets/cc-switch-cli-linux-x64-musl.tar.gz
          fi

          # Linux x64 - GLIBC
          if [ -f "artifacts/cc-switch-cli-linux-x64/cc-switch" ]; then
            tar -czf release-assets/cc-switch-cli-${VERSION}-linux-x64.tar.gz \
              -C artifacts/cc-switch-cli-linux-x64 cc-switch
            cp release-assets/cc-switch-cli-${VERSION}-linux-x64.tar.gz \
              release-assets/cc-switch-cli-linux-x64.tar.gz
          fi

          # Linux ARM64 - MUSL
          if [ -f "artifacts/cc-switch-cli-linux-arm64-musl/cc-switch" ]; then
            tar -czf release-assets/cc-switch-cli-${VERSION}-linux-arm64-musl.tar.gz \
              -C artifacts/cc-switch-cli-linux-arm64-musl cc-switch
            cp release-assets/cc-switch-cli-${VERSION}-linux-arm64-musl.tar.gz \
              release-assets/cc-switch-cli-linux-arm64-musl.tar.gz
          fi

          # Linux ARM64 - GLIBC
          if [ -f "artifacts/cc-switch-cli-linux-arm64/cc-switch" ]; then
            tar -czf release-assets/cc-switch-cli-${VERSION}-linux-arm64.tar.gz \
              -C artifacts/cc-switch-cli-linux-arm64 cc-switch
            cp release-assets/cc-switch-cli-${VERSION}-linux-arm64.tar.gz \
              release-assets/cc-switch-cli-linux-arm64.tar.gz
          fi

          # Include install script
          cp install.sh release-assets/install.sh

          echo "=== Release assets ==="
          ls -lh release-assets/

      - name: Sign updater assets and generate latest.json
        env:
          CC_SWITCH_MINISIGN_SECRET_KEY: ${{ secrets.CC_SWITCH_MINISIGN_SECRET_KEY }}
        run: |
          set -euxo pipefail
          if [ -z "${CC_SWITCH_MINISIGN_SECRET_KEY}" ]; then
            echo "CC_SWITCH_MINISIGN_SECRET_KEY is not configured" >&2
            exit 1
          fi

          key_file="$(mktemp)"
          trap 'rm -f "${key_file}"' EXIT
          printf '%s' "${CC_SWITCH_MINISIGN_SECRET_KEY}" > "${key_file}"
          chmod 600 "${key_file}"

          shopt -s nullglob
          for asset in release-assets/cc-switch-cli-*.tar.gz release-assets/cc-switch-cli-*.zip; do
            minisign -S \
              -s "${key_file}" \
              -m "${asset}" \
              -x "${asset}.minisig" \
              -t "cc-switch-cli ${GITHUB_REF_NAME}"
          done

          for asset in release-assets/cc-switch-cli-*.tar.gz release-assets/cc-switch-cli-*.zip; do
            minisign -Vm "${asset}" \
              -p src-tauri/updater/minisign.pub \
              -x "${asset}.minisig"
          done

          python3 scripts/generate_latest_json.py \
            release-assets \
            "${GITHUB_REF_NAME}" \
            "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
            "https://github.com/SaladDay/cc-switch-cli/releases/download/${GITHUB_REF_NAME}" \
            "CC Switch CLI ${GITHUB_REF_NAME}"

          rm -f release-assets/*.minisig

          (
            cd release-assets
            rm -f checksums.txt
            sha256sum * > checksums.txt
          )

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: CC Switch CLI ${{ github.ref_name }}
          draft: false
          prerelease: false
          generate_release_notes: true
          body_path: docs/releases/${{ github.ref_name }}.md
          files: release-assets/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}