zyphrzero_Termy/.github/workflows/release.yml

name: Release

on:
  push:
    tags:
      - '*.*.*'

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-rust:
    name: Build Rust ${{ matrix.platform }}-${{ matrix.arch }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            platform: win32
            arch: x64
            target: x86_64-pc-windows-msvc
            ext: .exe
          - os: macos-latest
            platform: darwin
            arch: arm64
            target: aarch64-apple-darwin
            ext: ''
          - os: macos-latest
            platform: darwin
            arch: x64
            target: x86_64-apple-darwin
            ext: ''
          - os: ubuntu-latest
            platform: linux
            arch: x64
            target: x86_64-unknown-linux-gnu
            ext: ''
          - os: ubuntu-24.04-arm
            platform: linux
            arch: arm64
            target: aarch64-unknown-linux-gnu
            ext: ''

    steps:
      - uses: actions/checkout@v5

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Cache Rust
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust-servers -> target
          key: ${{ matrix.target }}

      - name: Build
        working-directory: rust-servers
        env:
          TERMINAL_SERVER_VERSION: ${{ github.ref_name }}
        run: cargo build --release --target ${{ matrix.target }}

      - name: Prepare binary
        shell: bash
        run: |
          mkdir -p binaries
          BINARY_NAME="termy-server-${{ matrix.platform }}-${{ matrix.arch }}${{ matrix.ext }}"
          cp "rust-servers/target/${{ matrix.target }}/release/termy-server${{ matrix.ext }}" "binaries/${BINARY_NAME}"
          
          cd binaries
          if command -v sha256sum &> /dev/null; then
            sha256sum "${BINARY_NAME}" > "${BINARY_NAME}.sha256"
          else
            shasum -a 256 "${BINARY_NAME}" > "${BINARY_NAME}.sha256"
          fi          

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: server-${{ matrix.platform }}-${{ matrix.arch }}
          path: |
            binaries/termy-server-${{ matrix.platform }}-${{ matrix.arch }}${{ matrix.ext }}
            binaries/termy-server-${{ matrix.platform }}-${{ matrix.arch }}${{ matrix.ext }}.sha256            

  release:
    name: Release
    needs: build-rust
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: write
      id-token: write
      attestations: write

    steps:
      - uses: actions/checkout@v5

      - uses: pnpm/action-setup@v5

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Download binaries
        uses: actions/download-artifact@v7
        with:
          pattern: 'server-*'
          path: binaries
          merge-multiple: true

      - name: Set permissions
        run: |
          chmod +x binaries/termy-server-darwin-* || true
          chmod +x binaries/termy-server-linux-* || true          

      - name: Install and build
        run: |
          pnpm install --frozen-lockfile
          pnpm build          

      - name: Generate release notes
        run: |
          node scripts/release-notes.js \
            --version "${{ github.ref_name }}" \
            --repository "${{ github.repository }}" \
            --output release-body.md          

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: |
            main.js
            styles.css            

      - name: Prepare release assets
        run: |
          # BRAT 需要的三个核心文件（直接上传，不打包）
          # main.js, manifest.json, styles.css 已在根目录
          
          # 设置二进制文件执行权限
          chmod +x binaries/termy-server-darwin-* || true
          chmod +x binaries/termy-server-linux-* || true
          
          # 创建完整包（所有平台，供手动安装）
          mkdir -p termy/binaries
          cp main.js manifest.json styles.css termy/
          cp binaries/termy-server-* termy/binaries/
          chmod +x termy/binaries/termy-server-darwin-* || true
          chmod +x termy/binaries/termy-server-linux-* || true
          zip -r "termy-${{ github.ref_name }}.zip" termy          

      - name: Upload binaries to R2
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          node scripts/upload-r2-assets.js \
            --bucket termy-binaries-apac \
            --version "${{ github.ref_name }}" \
            --config wrangler.jsonc          

      - name: Release
        uses: softprops/action-gh-release@v3
        with:
          files: |
            main.js
            manifest.json
            styles.css
            termy-${{ github.ref_name }}.zip
            binaries/termy-server-win32-x64.exe
            binaries/termy-server-win32-x64.exe.sha256
            binaries/termy-server-darwin-arm64
            binaries/termy-server-darwin-arm64.sha256
            binaries/termy-server-darwin-x64
            binaries/termy-server-darwin-x64.sha256
            binaries/termy-server-linux-x64
            binaries/termy-server-linux-x64.sha256
            binaries/termy-server-linux-arm64
            binaries/termy-server-linux-arm64.sha256            
          body_path: release-body.md
          draft: false
          prerelease: false