release.yml

name: Release

on:
  workflow_call:
    inputs:
      tag:
        description: 'Tag to release'
        required: true
        type: string
      prerelease:
        description: 'Mark as pre-release'
        required: false
        type: boolean
        default: false
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to release (e.g., v0.1.0)'
        required: true
      prerelease:
        description: 'Mark as pre-release'
        type: boolean
        default: false

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # macOS
          - target: x86_64-apple-darwin
            os: macos-latest
            archive: tar.gz
          - target: aarch64-apple-darwin
            os: macos-latest
            archive: tar.gz
          # Linux
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            archive: tar.gz
            musl: true
          - target: aarch64-unknown-linux-musl
            os: ubuntu-24.04-arm
            archive: tar.gz
            musl: true
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-24.04-arm
            archive: tar.gz
          # Windows
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            archive: zip

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
        with:
          targets: ${{ matrix.target }}

      - name: Install musl tools
        if: matrix.musl
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools

      - name: Install packaging tools
        if: matrix.musl
        run: |
          cargo install cargo-deb --version 3.8.0 --locked
          cargo install cargo-generate-rpm --version 0.21.1 --locked

      - name: Build rtk
        run: cargo build --release --target ${{ matrix.target }}
        env:
          RTK_TELEMETRY_URL: ${{ vars.RTK_TELEMETRY_URL }}
          RTK_TELEMETRY_TOKEN: ${{ secrets.RTK_TELEMETRY_TOKEN }}

      - name: Package deb and rpm
        if: matrix.musl
        run: |
          cargo deb --no-build --target ${{ matrix.target }}
          cargo generate-rpm --target ${{ matrix.target }} --payload-compress gzip

      - name: Package (Unix)
        if: matrix.os != 'windows-latest'
        run: |
          # The binary links the BUSL-1.1 rtk-engine, so both texts travel
          # with every artifact: LICENSE (Apache-2.0, the CLI sources) and
          # LICENSE-ENGINE (BUSL-1.1, the linked engine).
          cp LICENSE target/${{ matrix.target }}/release/LICENSE
          cp engine/LICENSE target/${{ matrix.target }}/release/LICENSE-ENGINE
          cd target/${{ matrix.target }}/release
          tar -czvf ../../../rtk-${{ matrix.target }}.${{ matrix.archive }} rtk LICENSE LICENSE-ENGINE
          cd ../../..

      - name: Package (Windows)
        if: matrix.os == 'windows-latest'
        run: |
          cp LICENSE target/${{ matrix.target }}/release/LICENSE
          cp engine/LICENSE target/${{ matrix.target }}/release/LICENSE-ENGINE
          cd target/${{ matrix.target }}/release
          7z a ../../../rtk-${{ matrix.target }}.${{ matrix.archive }} rtk.exe LICENSE LICENSE-ENGINE
          cd ../../..

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: rtk-${{ matrix.target }}
          path: rtk-${{ matrix.target }}.${{ matrix.archive }}

      # The Apache-2.0 edition: the same binary built without the BUSL engine,
      # so only LICENSE travels with it. Same binary name `rtk` inside -- an
      # installed hook command must keep working across editions.
      - name: Build rtk (Apache-2.0 edition)
        run: cargo build --release --no-default-features --target ${{ matrix.target }}
        env:
          RTK_TELEMETRY_URL: ${{ vars.RTK_TELEMETRY_URL }}
          RTK_TELEMETRY_TOKEN: ${{ secrets.RTK_TELEMETRY_TOKEN }}

      - name: Package deb and rpm (Apache-2.0 edition)
        if: matrix.musl
        run: |
          cargo deb --no-build --target ${{ matrix.target }} --variant oss
          cargo generate-rpm --target ${{ matrix.target }} --variant oss --payload-compress gzip

      - name: Upload deb and rpm
        if: matrix.musl
        uses: actions/upload-artifact@v7
        with:
          name: packages-${{ matrix.target }}
          path: |
            target/${{ matrix.target }}/debian/*.deb
            target/${{ matrix.target }}/generate-rpm/*.rpm

      - name: Package rtk-oss (Unix)
        if: matrix.os != 'windows-latest'
        run: |
          cp LICENSE target/${{ matrix.target }}/release/LICENSE
          cd target/${{ matrix.target }}/release
          tar -czvf ../../../rtk-oss-${{ matrix.target }}.${{ matrix.archive }} rtk LICENSE
          cd ../../..

      - name: Package rtk-oss (Windows)
        if: matrix.os == 'windows-latest'
        run: |
          cp LICENSE target/${{ matrix.target }}/release/LICENSE
          cd target/${{ matrix.target }}/release
          7z a ../../../rtk-oss-${{ matrix.target }}.${{ matrix.archive }} rtk.exe LICENSE
          cd ../../..

      - name: Upload rtk-oss artifact
        uses: actions/upload-artifact@v7
        with:
          name: rtk-oss-${{ matrix.target }}
          path: rtk-oss-${{ matrix.target }}.${{ matrix.archive }}

      # The daemon ships as its own archive rather than inside the rtk one.
      # It is licensed BUSL-1.1, not Apache-2.0, so bundling it would hand
      # every rtk user a binary under different terms without them choosing
      # it. The BSL requires its text to travel with the work, hence the
      # LICENSE alongside the binary, plus LICENSE-ENGINE for the rtk-engine
      # crate the daemon links.
      #
      # `--target-dir target` keeps the output where the packaging steps look:
      # proxy/ is not a workspace member, so its default target dir would be
      # proxy/target/.
      - name: Build rtk-proxy
        id: build_proxy
        run: >
          cargo build --release
          --manifest-path proxy/Cargo.toml
          --target-dir target
          --target ${{ matrix.target }}
        env:
          CFLAGS_x86_64_unknown_linux_musl: "-Du_int8_t=uint8_t -Du_int16_t=uint16_t -Du_int64_t=uint64_t"
          CFLAGS_aarch64_unknown_linux_musl: "-Du_int8_t=uint8_t -Du_int16_t=uint16_t -Du_int64_t=uint64_t"

      - name: Package rtk-proxy (Unix)
        if: matrix.os != 'windows-latest'
        run: |
          cp proxy/LICENSE target/${{ matrix.target }}/release/LICENSE
          cp engine/LICENSE target/${{ matrix.target }}/release/LICENSE-ENGINE
          cd target/${{ matrix.target }}/release
          tar -czvf ../../../rtk-proxy-${{ matrix.target }}.${{ matrix.archive }} rtk-proxy LICENSE LICENSE-ENGINE
          cd ../../..

      - name: Check Linux binaries are static
        if: matrix.musl
        run: |
          for a in rtk rtk-oss rtk-proxy; do
            d=$(mktemp -d)
            tar -xzf "$a-${{ matrix.target }}.tar.gz" -C "$d"
            case "$a" in
              rtk-proxy) b="$d/rtk-proxy" ;;
              *) b="$d/rtk" ;;
            esac
            readelf -h "$b" > /dev/null
            if readelf -lW "$b" | grep INTERP || readelf -dW "$b" | grep NEEDED; then
              echo "::error::$a-${{ matrix.target }}.tar.gz is not statically linked"
              exit 1
            fi
            "$b" --version
          done

      - name: Package rtk-proxy (Windows)
        if: matrix.os == 'windows-latest'
        run: |
          cp proxy/LICENSE target/${{ matrix.target }}/release/LICENSE
          cp engine/LICENSE target/${{ matrix.target }}/release/LICENSE-ENGINE
          cd target/${{ matrix.target }}/release
          7z a ../../../rtk-proxy-${{ matrix.target }}.${{ matrix.archive }} rtk-proxy.exe LICENSE LICENSE-ENGINE
          cd ../../..

      - name: Upload rtk-proxy artifact
        uses: actions/upload-artifact@v7
        with:
          name: rtk-proxy-${{ matrix.target }}
          path: rtk-proxy-${{ matrix.target }}.${{ matrix.archive }}

  release:
    name: Create Release
    needs: [build]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        id: app-token
        with:
          client-id: ${{ secrets.APP_CLIENT_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          permission-contents: write

      - name: Checkout
        uses: actions/checkout@v7

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Get version
        id: version
        env:
          INPUT_TAG: ${{ inputs.tag }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          TAG="$INPUT_TAG"
          if [ -z "$TAG" ]; then
            TAG="$RELEASE_TAG"
          fi
          echo "version=$TAG" >> $GITHUB_OUTPUT

      - name: Flatten artifacts
        run: |
          mkdir -p release
          find artifacts -type f \( -name "*.tar.gz" -o -name "*.zip" -o -name "*.deb" -o -name "*.rpm" \) -exec cp {} release/ \;

      # Stable download names. Match each edition explicitly: a bare *.deb
      # glob would copy both editions over one name and drop the other.
      - name: Create version-agnostic package names
        run: |
          cd release
          for a in amd64 arm64; do
            for f in rtk_*_"${a}".deb;     do [ -f "$f" ] && cp "$f" "rtk_${a}.deb"; done
            for f in rtk-oss_*_"${a}".deb; do [ -f "$f" ] && cp "$f" "rtk-oss_${a}.deb"; done
          done
          for a in x86_64 aarch64; do
            for f in rtk-[0-9]*."${a}".rpm;     do [ -f "$f" ] && cp "$f" "rtk.${a}.rpm"; done
            for f in rtk-oss-[0-9]*."${a}".rpm; do [ -f "$f" ] && cp "$f" "rtk-oss.${a}.rpm"; done
          done

      - name: Create checksums
        run: |
          cd release
          sha256sum * > checksums.txt

      - name: Upload Release Assets
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          tag_name: ${{ steps.version.outputs.version }}
          files: release/*
          prerelease: ${{ inputs.prerelease }}
          token: ${{ steps.app-token.outputs.token }}

  notify-discord:
    name: Notify Discord
    needs: [release]
    if: ${{ !inputs.prerelease }}
    runs-on: ubuntu-latest
    steps:
      - name: Get version
        id: version
        env:
          INPUT_TAG: ${{ inputs.tag }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          TAG="$INPUT_TAG"
          if [ -z "$TAG" ]; then
            TAG="$RELEASE_TAG"
          fi
          echo "tag=$TAG" >> $GITHUB_OUTPUT

      - name: Send Discord notification
        env:
          DISCORD_WEBHOOK: ${{ secrets.RTK_DISCORD_RELEASE }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${{ steps.version.outputs.tag }}"
          RELEASE_URL="https://github.com/rtk-ai/rtk/releases/tag/${TAG}"

          # Fetch release notes from GitHub API
          NOTES=$(gh api "repos/rtk-ai/rtk/releases/tags/${TAG}" --jq '.body' 2>/dev/null | head -c 1800 || echo "")
          DESC=$(echo "${NOTES:-No release notes}" | jq -Rs .)

          jq -n \
            --arg title "RTK ${TAG} released" \
            --arg url "$RELEASE_URL" \
            --argjson desc "$DESC" \
            '{embeds: [{title: $title, url: $url, description: $desc, color: 5814783, footer: {text: "Rust Token Killer"}}]}' \
          | curl -sf -H "Content-Type: application/json" -d @- "$DISCORD_WEBHOOK"

  homebrew:
    name: Update Homebrew formula
    needs: [release]
    if: ${{ !inputs.prerelease }}
    runs-on: ubuntu-latest
    steps:
      - name: Get version
        id: version
        env:
          INPUT_TAG: ${{ inputs.tag }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          TAG="$INPUT_TAG"
          if [ -z "$TAG" ]; then
            TAG="$RELEASE_TAG"
          fi
          VERSION="${TAG#v}"
          echo "tag=$TAG" >> $GITHUB_OUTPUT
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Download checksums
        run: |
          gh release download "${{ steps.version.outputs.tag }}" \
            --repo rtk-ai/rtk \
            --pattern checksums.txt
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Parse checksums
        id: sha
        run: |
          echo "mac_arm=$(grep "[[:space:]]rtk-aarch64-apple-darwin.tar.gz\$" checksums.txt | awk '{print $1}')" >> $GITHUB_OUTPUT
          echo "mac_intel=$(grep "[[:space:]]rtk-x86_64-apple-darwin.tar.gz\$" checksums.txt | awk '{print $1}')" >> $GITHUB_OUTPUT
          echo "linux_arm=$(grep "[[:space:]]rtk-aarch64-unknown-linux-musl.tar.gz\$" checksums.txt | awk '{print $1}')" >> $GITHUB_OUTPUT
          echo "linux_intel=$(grep "[[:space:]]rtk-x86_64-unknown-linux-musl.tar.gz\$" checksums.txt | awk '{print $1}')" >> $GITHUB_OUTPUT
          echo "oss_mac_arm=$(grep "[[:space:]]rtk-oss-aarch64-apple-darwin.tar.gz\$" checksums.txt | awk '{print $1}')" >> $GITHUB_OUTPUT
          echo "oss_mac_intel=$(grep "[[:space:]]rtk-oss-x86_64-apple-darwin.tar.gz\$" checksums.txt | awk '{print $1}')" >> $GITHUB_OUTPUT
          echo "oss_linux_arm=$(grep "[[:space:]]rtk-oss-aarch64-unknown-linux-musl.tar.gz\$" checksums.txt | awk '{print $1}')" >> $GITHUB_OUTPUT
          echo "oss_linux_intel=$(grep "[[:space:]]rtk-oss-x86_64-unknown-linux-musl.tar.gz\$" checksums.txt | awk '{print $1}')" >> $GITHUB_OUTPUT

      - name: Generate formula
        run: |
          cat > rtk.rb << 'FORMULA'
          class Rtk < Formula
            desc "Rust Token Killer - High-performance CLI proxy to minimize LLM token consumption"
            homepage "https://www.rtk-ai.app"
            version "VERSION_PLACEHOLDER"
            license all_of: ["Apache-2.0", "BUSL-1.1"]

            conflicts_with "rtk-oss", because: "both install the rtk binary"

            if OS.mac? && Hardware::CPU.arm?
              url "https://github.com/rtk-ai/rtk/releases/download/TAG_PLACEHOLDER/rtk-aarch64-apple-darwin.tar.gz"
              sha256 "SHA_MAC_ARM_PLACEHOLDER"
            elsif OS.mac? && Hardware::CPU.intel?
              url "https://github.com/rtk-ai/rtk/releases/download/TAG_PLACEHOLDER/rtk-x86_64-apple-darwin.tar.gz"
              sha256 "SHA_MAC_INTEL_PLACEHOLDER"
            elsif OS.linux? && Hardware::CPU.arm?
              url "https://github.com/rtk-ai/rtk/releases/download/TAG_PLACEHOLDER/rtk-aarch64-unknown-linux-musl.tar.gz"
              sha256 "SHA_LINUX_ARM_PLACEHOLDER"
            elsif OS.linux? && Hardware::CPU.intel?
              url "https://github.com/rtk-ai/rtk/releases/download/TAG_PLACEHOLDER/rtk-x86_64-unknown-linux-musl.tar.gz"
              sha256 "SHA_LINUX_INTEL_PLACEHOLDER"
            end

            def install
              bin.install "rtk"
            end

            def caveats
              <<~EOS
                rtk is installed! Get started:

                  # Initialize for Claude Code
                  rtk init -g          # Global hook-first setup (recommended)
                  rtk init             # Add to ./CLAUDE.md (this project only)

                  # See all commands
                  rtk --help

                  # Measure your token savings
                  rtk gain

                Full documentation: https://www.rtk-ai.app
              EOS
            end

            test do
              system "#{bin}/rtk", "--version"
            end
          end
          FORMULA
          sed -i "s/VERSION_PLACEHOLDER/${{ steps.version.outputs.version }}/g" rtk.rb
          sed -i "s/TAG_PLACEHOLDER/${{ steps.version.outputs.tag }}/g" rtk.rb
          sed -i "s/SHA_MAC_ARM_PLACEHOLDER/${{ steps.sha.outputs.mac_arm }}/g" rtk.rb
          sed -i "s/SHA_MAC_INTEL_PLACEHOLDER/${{ steps.sha.outputs.mac_intel }}/g" rtk.rb
          sed -i "s/SHA_LINUX_ARM_PLACEHOLDER/${{ steps.sha.outputs.linux_arm }}/g" rtk.rb
          sed -i "s/SHA_LINUX_INTEL_PLACEHOLDER/${{ steps.sha.outputs.linux_intel }}/g" rtk.rb
          # Remove leading spaces from heredoc
          sed -i 's/^          //' rtk.rb

      # Second formula for the Apache-2.0 edition. Class name RtkOss maps to
      # Formula/rtk-oss.rb, installed as `brew install rtk-ai/tap/rtk-oss`.
      # It provides the same `rtk` binary, so it conflicts with the full one.
      - name: Generate formula (Apache-2.0 edition)
        run: |
          cat > rtk-oss.rb << 'FORMULA'
          class RtkOss < Formula
            desc "Rust Token Killer - Apache-2.0 edition: hook rewrite and command filters"
            homepage "https://www.rtk-ai.app"
            version "VERSION_PLACEHOLDER"
            license "Apache-2.0"

            conflicts_with "rtk", because: "both install the rtk binary"

            if OS.mac? && Hardware::CPU.arm?
              url "https://github.com/rtk-ai/rtk/releases/download/TAG_PLACEHOLDER/rtk-oss-aarch64-apple-darwin.tar.gz"
              sha256 "SHA_OSS_MAC_ARM_PLACEHOLDER"
            elsif OS.mac? && Hardware::CPU.intel?
              url "https://github.com/rtk-ai/rtk/releases/download/TAG_PLACEHOLDER/rtk-oss-x86_64-apple-darwin.tar.gz"
              sha256 "SHA_OSS_MAC_INTEL_PLACEHOLDER"
            elsif OS.linux? && Hardware::CPU.arm?
              url "https://github.com/rtk-ai/rtk/releases/download/TAG_PLACEHOLDER/rtk-oss-aarch64-unknown-linux-musl.tar.gz"
              sha256 "SHA_OSS_LINUX_ARM_PLACEHOLDER"
            elsif OS.linux? && Hardware::CPU.intel?
              url "https://github.com/rtk-ai/rtk/releases/download/TAG_PLACEHOLDER/rtk-oss-x86_64-unknown-linux-musl.tar.gz"
              sha256 "SHA_OSS_LINUX_INTEL_PLACEHOLDER"
            end

            def install
              bin.install "rtk"
            end

            test do
              system "#{bin}/rtk", "--version"
            end
          end
          FORMULA
          sed -i "s/VERSION_PLACEHOLDER/${{ steps.version.outputs.version }}/g" rtk-oss.rb
          sed -i "s/TAG_PLACEHOLDER/${{ steps.version.outputs.tag }}/g" rtk-oss.rb
          sed -i "s/SHA_OSS_MAC_ARM_PLACEHOLDER/${{ steps.sha.outputs.oss_mac_arm }}/g" rtk-oss.rb
          sed -i "s/SHA_OSS_MAC_INTEL_PLACEHOLDER/${{ steps.sha.outputs.oss_mac_intel }}/g" rtk-oss.rb
          sed -i "s/SHA_OSS_LINUX_ARM_PLACEHOLDER/${{ steps.sha.outputs.oss_linux_arm }}/g" rtk-oss.rb
          sed -i "s/SHA_OSS_LINUX_INTEL_PLACEHOLDER/${{ steps.sha.outputs.oss_linux_intel }}/g" rtk-oss.rb
          sed -i 's/^          //' rtk-oss.rb

      - name: Push to homebrew-tap
        run: |
          for f in rtk rtk-oss; do
            CONTENT=$(base64 -w 0 "$f.rb")
            SHA=$(gh api "repos/rtk-ai/homebrew-tap/contents/Formula/$f.rb" --jq '.sha' 2>/dev/null || echo "")
            if [ -n "$SHA" ]; then
              gh api -X PUT "repos/rtk-ai/homebrew-tap/contents/Formula/$f.rb" \
                -f message="$f ${{ steps.version.outputs.version }}" \
                -f content="$CONTENT" \
                -f sha="$SHA"
            else
              gh api -X PUT "repos/rtk-ai/homebrew-tap/contents/Formula/$f.rb" \
                -f message="$f ${{ steps.version.outputs.version }}" \
                -f content="$CONTENT"
            fi
          done
        env:
          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}

  winget:
    name: Update winget manifest
    needs: [release]
    if: ${{ !inputs.prerelease }}
    runs-on: ubuntu-latest
    # A failed submission must not fail the release workflow: cd.yml gates
    # update-latest-tag on build-release, so a red job here would leave the
    # 'latest' tag on the previous version.
    continue-on-error: true
    steps:
      - name: Get version
        id: version
        env:
          INPUT_TAG: ${{ inputs.tag }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          TAG="$INPUT_TAG"
          if [ -z "$TAG" ]; then
            TAG="$RELEASE_TAG"
          fi
          VERSION="${TAG#v}"
          echo "tag=$TAG" >> $GITHUB_OUTPUT
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      # Pinned to a main commit, not the v2 tag: v2 has not moved since 2024-11-27
      # and is four fixes behind, including cargo binstall on ubuntu-slim runners.
      - uses: vedantmgoyal9/winget-releaser@a43926ed822e5a076ac8a81e0a794915cbad51d1 # 2026-03-14
        with:
          identifier: rtk-ai.rtk
          version: ${{ steps.version.outputs.version }}
          installers-regex: 'rtk-x86_64-pc-windows-msvc\.zip$'
          token: ${{ secrets.WINGET_TOKEN }}
          release-tag: ${{ steps.version.outputs.tag }}