release.yml

name: Release

permissions:
  contents: write

on:
  release:
    types: [created, published]
  workflow_dispatch:

jobs:
  # No separate "create the release" job: we create and write the release
  # ourselves (gh release create, with our own notes) before this workflow ever
  # runs. This job only needs to build binaries and attach them to whatever
  # release already exists for the tag - it must not touch the release's own
  # draft/published state, since that job used to force it back to draft (and
  # wipe our release notes) every time this workflow fired.
  upload-assets:
    strategy:
      matrix:
        include:
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
         # - target: aarch64-apple-darwin
         #   os: macos-latest
          # Pinned below ubuntu-latest (glibc 2.39 as of Ubuntu 24.04) so the
          # binary doesn't require a newer glibc than most real systems have -
          # AppImageHub's own compatibility test flagged this for real
          # (`GLIBC_2.38'/2.39' not found) against the ubuntu-latest build.
          # aarch64 doesn't need the same pin - it builds via `cross`'s own
          # Docker image regardless of host OS, not directly on the runner.
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-22.04
         # - target: x86_64-apple-darwin
         #   os: macos-latest
          # Universal macOS binary is supported as universal-apple-darwin.
          - target: universal-apple-darwin
            os: macos-latest
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: taiki-e/upload-rust-binary-action@v1
        with:
          # (required) Comma-separated list of binary names (non-extension portion of filename) to build and upload.
          # Note that glob pattern is not supported yet.
          bin: absotui
          # (optional) Target triple, default is host triple.
          target: ${{ matrix.target }}
          # (required) GitHub token for uploading assets to GitHub Releases.
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Prepare assets
        run: |
          mkdir -p dist
          cp ./config.example.toml dist/
          cp ./linux/absotui.desktop dist/
          cp ./linux/absotui.svg dist/
          cp ./hello_absotui.sh dist/

      # AppImage packaging only makes sense for Linux targets, and only needs an
      # x86_64 appimagetool regardless of which arch we're packaging - it doesn't
      # execute the payload binary, just embeds a runtime stub for the target arch
      # (downloaded separately for aarch64, since appimagetool only ships its own
      # host arch's runtime). absotui only links libc/libm/libgcc_s (confirmed via
      # ldd - reqwest here uses rustls, not system OpenSSL, and rusqlite is
      # bundled), so no linuxdeploy-style dependency bundling is needed.
      - name: Build AppImage
        if: contains(matrix.target, 'linux')
        run: |
          arch=$(echo "${{ matrix.target }}" | cut -d- -f1)

          mkdir -p AppDir/usr/bin
          cp "target/${{ matrix.target }}/release/absotui" AppDir/usr/bin/absotui
          cp ./linux/absotui.desktop AppDir/absotui.desktop
          cp ./linux/absotui.svg AppDir/absotui.svg
          ln -s usr/bin/absotui AppDir/AppRun

          curl -sL -o appimagetool https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
          chmod +x appimagetool

          runtime_args=()
          if [[ "$arch" != "x86_64" ]]; then
            curl -sL -o "runtime-$arch" "https://github.com/AppImage/type2-runtime/releases/download/continuous/runtime-$arch"
            runtime_args=(--runtime-file "runtime-$arch")
          fi

          # --updateinformation lets AppImageUpdate/AppImageLauncher find new
          # releases on their own; appimagetool bundles its own zsyncmake, so the
          # matching .zsync file is generated automatically - but it lands in the
          # working directory, not next to the AppImage, so move it into dist/
          # for the upload step below.
          APPIMAGE_EXTRACT_AND_RUN=1 ARCH="$arch" ./appimagetool "${runtime_args[@]}" \
            --updateinformation "gh-releases-zsync|pdwaldrop|absotui|latest|absotui-$arch.AppImage.zsync" \
            AppDir "dist/absotui-$arch.AppImage"
          for z in ./*.AppImage.zsync; do
            [ -e "$z" ] && mv "$z" dist/
          done

      - name: Create GitHub release and upload files
        uses: softprops/action-gh-release@v1
        with:
          files: dist/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # Generates a checksums manifest from the release's actual uploaded assets, once
  # they all exist, so hello_absotui.sh can verify downloads against real values
  # fetched at install time instead of hardcoding checksums into the script itself -
  # those went stale on every release, since CI only builds the real binaries after
  # a release is cut.
  generate-checksums:
    needs: upload-assets
    runs-on: ubuntu-latest
    steps:
      - name: Download release assets
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mkdir -p assets
          gh release download "${{ github.ref_name }}" --repo "${{ github.repository }}" --dir assets --clobber

      - name: Generate SHA256SUMS.txt
        run: |
          cd assets
          sha256sum * > SHA256SUMS.txt
          cat SHA256SUMS.txt

      - name: Upload checksums manifest
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "${{ github.ref_name }}" assets/SHA256SUMS.txt --repo "${{ github.repository }}" --clobber