release.yml

name: release

# Tag-driven, multi-channel release for the runx CLI.
#
# A reviewed CLI version is committed to the candidate manifests before the
# cli-vX.Y.Z tag is created. Every job re-stamps and verifies the tag version in
# its ephemeral checkout so `runx --version` stays truthful on every channel.
# Internal Rust crates keep their own semver and are not published by this CLI
# release workflow.
#
# The GitHub Release is the hub: it serves the raw per-target archives that
# Homebrew, Scoop, winget, optional AUR handoff, Docker, and direct downloads
# all consume by URL + sha256. npm packages and native archives carry the same
# stamped version. GitHub Release, npm, GHCR, Homebrew, and Scoop are the
# independently verified release set. Winget remains an asynchronous submission;
# AUR is not published unless Runx controls the package.
#
# Pushing a cli-v* tag runs a real release. workflow_dispatch runs a dry-run
# (build + render, no publish).

on:
  push:
    tags:
      - "cli-v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Version to dry-run (X.Y.Z)"
        type: string
        required: true

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  runtime-quality:
    uses: ./.github/workflows/runtime-quality.yml

  prepare:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    outputs:
      version: ${{ steps.resolve.outputs.version }}
      publish: ${{ steps.resolve.outputs.publish }}
      platform_matrix: ${{ steps.platforms.outputs.matrix }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: pnpm/action-setup@v6
        with:
          version: 10.18.2
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - name: Resolve version
        id: resolve
        run: |
          if [ "${{ github.event_name }}" = "push" ]; then
            version="${GITHUB_REF_NAME#cli-v}"
            echo "publish=true" >> "$GITHUB_OUTPUT"
          else
            version="${{ github.event.inputs.version }}"
            echo "publish=false" >> "$GITHUB_OUTPUT"
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "resolved version=$version publish from tag=${{ github.event_name == 'push' }}"
      - name: Verify complete release notes
        run: node scripts/check-runx-cli-release-notes.mjs --version "${{ steps.resolve.outputs.version }}"
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Resolve release platform matrix
        id: platforms
        shell: bash
        run: echo "matrix=$(node scripts/release-platform-matrix.mjs)" >> "$GITHUB_OUTPUT"
      - name: Stamp + verify manifests match the tag
        run: |
          pnpm exec tsx scripts/set-release-version.ts "${{ steps.resolve.outputs.version }}"
          pnpm exec tsx scripts/set-release-version.ts --check "${{ steps.resolve.outputs.version }}"
      - name: Fast verify
        run: pnpm verify:fast

  build:
    needs: [prepare, runtime-quality]
    strategy:
      fail-fast: true
      matrix: ${{ fromJSON(needs.prepare.outputs.platform_matrix) }}
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
        with:
          version: 10.18.2
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Set up pinned toolchain (rust-toolchain.toml) + target
        working-directory: crates
        shell: bash
        run: |
          rustup show               # installs the version pinned by rust-toolchain.toml
          rustup target add ${{ matrix.target }}
      - name: Install musl toolchain
        if: contains(matrix.target, 'musl')
        run: sudo apt-get install -y musl-tools
      - name: Prove deterministic module boundary on the native runner
        working-directory: crates
        run: |
          cargo test --locked -p runx-js-worker
          cargo test --locked -p runx-runtime --test integration 'javascript_worker::' -- --nocapture
          cargo test --locked -p runx-runtime --test integration 'javascript_worker_hostile::' -- --nocapture
      - name: Stamp version from tag
        shell: bash
        run: pnpm exec tsx scripts/set-release-version.ts "${{ needs.prepare.outputs.version }}"
      - name: Build release binary
        working-directory: crates
        run: cargo build --release --locked --target ${{ matrix.target }} -p runx-cli -p runx-js-worker
      - name: Prove the optimized worker starts on the release runner
        working-directory: crates
        env:
          RUNX_JS_WORKER_PATH: ${{ github.workspace }}/crates/target/${{ matrix.target }}/release/${{ matrix.worker }}
        run: cargo test --locked -p runx-runtime --test integration 'javascript_worker::javascript_worker_reuses_a_process_without_reusing_javascript_state' -- --exact
      - name: Record deterministic module platform evidence
        shell: bash
        run: |
          node scripts/record-deterministic-module-platform-evidence.mjs \
            --decision "docs/architecture/deterministic-module-engine.json" \
            --platform "${{ matrix.platform }}" \
            --target "${{ matrix.target }}" \
            --runner "${{ matrix.runner }}" \
            --worker "crates/target/${{ matrix.target }}/release/${{ matrix.worker }}" \
            --out "dist/archives/deterministic-module-${{ matrix.platform }}.json"
      - name: Stage signature manifest (npm)
        shell: bash
        run: |
          pnpm exec tsx scripts/make-signature-manifest.ts \
            --binary "crates/target/${{ matrix.target }}/release/${{ matrix.binary }}" \
            --worker "crates/target/${{ matrix.target }}/release/${{ matrix.worker }}" \
            --platform "${{ matrix.platform }}" \
            --out "signatures-${{ matrix.platform }}.json" \
            --identity "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
      - name: Package npm artifacts (selector + native)
        shell: bash
        run: |
          pnpm exec tsx scripts/package-rust-cli.ts \
            --binary "crates/target/${{ matrix.target }}/release/${{ matrix.binary }}" \
            --worker "crates/target/${{ matrix.target }}/release/${{ matrix.worker }}" \
            --platform "${{ matrix.platform }}" \
            --out-dir ".runx/rust-cli-artifacts" \
            --signature-manifest "signatures-${{ matrix.platform }}.json"
      - name: Build raw release archive
        shell: bash
        run: |
          pnpm exec tsx scripts/build-release-archives.ts \
            --binary "crates/target/${{ matrix.target }}/release/${{ matrix.binary }}" \
            --worker "crates/target/${{ matrix.target }}/release/${{ matrix.worker }}" \
            --target "${{ matrix.target }}" \
            --version "${{ needs.prepare.outputs.version }}" \
            --out-dir "dist/archives"
      - name: Build .deb (linux only)
        if: contains(matrix.target, 'linux')
        run: |
          cargo install cargo-deb --locked
          cargo deb --no-build --target ${{ matrix.target }} -p runx-cli --output "dist/archives/"
        working-directory: crates
      - name: Upload npm artifacts
        uses: actions/upload-artifact@v7
        with:
          name: npm-${{ matrix.platform }}
          path: |
            .runx/rust-cli-artifacts/${{ matrix.platform }}/
            .runx/rust-cli-artifacts/selector/
          if-no-files-found: error
          retention-days: 7
      - name: Upload release archives
        uses: actions/upload-artifact@v7
        with:
          name: archive-${{ matrix.platform }}
          path: dist/archives/
          if-no-files-found: error
          retention-days: 7

  smoke:
    needs: [prepare, build]
    strategy:
      fail-fast: true
      matrix: ${{ fromJSON(needs.prepare.outputs.platform_matrix) }}
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v7
      - name: Download built archive
        uses: actions/download-artifact@v8
        with:
          name: archive-${{ matrix.platform }}
          path: dist
      - name: Extract and run the released binary
        shell: bash
        run: |
          set -eux
          stem="runx-${{ needs.prepare.outputs.version }}-${{ matrix.target }}"
          if [ "${{ matrix.ext }}" = "zip" ]; then
            # GitHub windows-latest ships 7-Zip (the same tool that produced
            # the archive); the runner's bsdtar does not autodetect zip.
            7z x -y "dist/${stem}.zip" -o"dist" >/dev/null
          else
            tar -xzf "dist/${stem}.tar.gz" -C dist
          fi
          test -f "dist/${stem}/${{ matrix.worker }}"
          out=$("dist/${stem}/${{ matrix.binary }}" --version)
          echo "got: $out"
          case "$out" in
            *"${{ needs.prepare.outputs.version }}"*) echo "smoke ok" ;;
            *) echo "::error::version mismatch: $out"; exit 1 ;;
          esac
          node scripts/smoke-release-candidate.mjs \
            --runx-bin "dist/${stem}/${{ matrix.binary }}" \
            --expected-version "${{ needs.prepare.outputs.version }}"

  github-release:
    needs: [prepare, build, smoke]
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      id-token: write # build provenance attestation
      attestations: write
    steps:
      - uses: actions/checkout@v7
      - name: Download archives
        uses: actions/download-artifact@v8
        with:
          pattern: archive-*
          merge-multiple: true
          path: dist/archives
      - name: Build consolidated checksums
        run: |
          cd dist/archives
          sha256sum runx-* > checksums.txt
          cat checksums.txt
      - name: Generate SBOM (CycloneDX)
        uses: anchore/sbom-action@v0
        with:
          path: crates
          format: cyclonedx-json
          output-file: dist/archives/runx-${{ needs.prepare.outputs.version }}-sbom.cdx.json
      - name: Attest build provenance for released binaries
        if: needs.prepare.outputs.publish == 'true'
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: "dist/archives/runx-*.tar.gz, dist/archives/runx-*.zip"
      - name: Stage install scripts
        run: cp scripts/install scripts/install.ps1 dist/archives/
      - name: Create / update GitHub release
        if: needs.prepare.outputs.publish == 'true'
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ github.ref_name }}
          body_path: release/notes/${{ needs.prepare.outputs.version }}.md
          files: |
            dist/archives/*

  publish-npm:
    needs: [prepare, github-release]
    if: needs.prepare.outputs.publish == 'true'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write # npm provenance
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
        with:
          version: 10.18.2
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
          registry-url: https://registry.npmjs.org
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download npm artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: npm-*
          merge-multiple: true
          path: .runx/rust-cli-artifacts
      - name: Restore executable bits on native binaries
        # actions/upload-artifact stores via a zip-on-the-wire path that does
        # not preserve POSIX exec bits; re-apply them before verify.
        run: |
          find .runx/rust-cli-artifacts -path '*/bin/runx' -type f -print0 \
            | xargs -0 -r chmod +x
          find .runx/rust-cli-artifacts -path '*/bin/runx.exe' -type f -print0 \
            | xargs -0 -r chmod +x
          find .runx/rust-cli-artifacts -path '*/bin/runx-js-worker' -type f -print0 \
            | xargs -0 -r chmod +x
          find .runx/rust-cli-artifacts -path '*/bin/runx-js-worker.exe' -type f -print0 \
            | xargs -0 -r chmod +x
      - name: Verify release artifacts
        run: |
          pnpm exec tsx scripts/check-rust-cli-release-artifacts.ts \
            --artifact-dir ".runx/rust-cli-artifacts" --no-js-delegation --verify-signatures
      - name: Publish packages
        working-directory: .runx/rust-cli-artifacts
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: "true"
        run: |
          for dir in */; do
            name=$(node -p "require('./${dir}package.json').name")
            version=$(node -p "require('./${dir}package.json').version")
            if npm view "${name}@${version}" version >/dev/null 2>&1; then
              echo "${name}@${version} already published; skipping"
              continue
            fi
            ( cd "$dir" && npm publish --access public --tag latest )
          done

  package-managers:
    needs: [prepare, github-release]
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
        with:
          version: 10.18.2
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download archives (for checksums)
        uses: actions/download-artifact@v8
        with:
          pattern: archive-*
          merge-multiple: true
          path: dist/archives
      - name: Build channel manifest input
        run: |
          node scripts/build-channel-input.mjs \
            --version "${{ needs.prepare.outputs.version }}" \
            --repo "${GITHUB_REPOSITORY}" \
            --tag "cli-v${{ needs.prepare.outputs.version }}" \
            --archives dist/archives \
            --out dist/channel-input.json
      - name: Render channel manifests
        run: pnpm exec tsx scripts/gen-channel-manifests.ts --input dist/channel-input.json --out-dir dist/channels
      - name: Verify channel manifests against archives
        run: node scripts/check-channel-manifests.mjs --input dist/channel-input.json --channels dist/channels --archives dist/archives
      - name: Attach rendered manifests to release
        if: needs.prepare.outputs.publish == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          tar -C dist -czf dist/channel-manifests.tar.gz channels
          gh release upload "${{ github.ref_name }}" dist/channel-manifests.tar.gz --clobber
      - name: Upload rendered manifests
        uses: actions/upload-artifact@v7
        with:
          name: channel-manifests
          path: dist/channels

  publish-homebrew:
    needs: [prepare, package-managers]
    if: needs.prepare.outputs.publish == 'true'
    runs-on: ubuntu-24.04
    steps:
      - name: Download rendered manifests
        uses: actions/download-artifact@v8
        with:
          name: channel-manifests
          path: channels
      - name: Check out tap
        uses: actions/checkout@v7
        with:
          repository: runxhq/homebrew-tap
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: tap
      - name: Commit formula
        run: |
          mkdir -p tap/Formula
          cp channels/homebrew/runx.rb tap/Formula/runx.rb
          git -C tap config user.name "github-actions[bot]"
          git -C tap config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git -C tap add Formula/runx.rb
          git -C tap diff --cached --quiet || { git -C tap commit -m "runx ${{ needs.prepare.outputs.version }}"; git -C tap push; }

  publish-scoop:
    needs: [prepare, package-managers]
    if: needs.prepare.outputs.publish == 'true'
    runs-on: ubuntu-24.04
    steps:
      - name: Download rendered manifests
        uses: actions/download-artifact@v8
        with:
          name: channel-manifests
          path: channels
      - name: Check out bucket
        uses: actions/checkout@v7
        with:
          repository: runxhq/scoop-bucket
          token: ${{ secrets.SCOOP_BUCKET_TOKEN }}
          path: bucket
      - name: Commit manifest
        run: |
          mkdir -p bucket/bucket
          cp channels/scoop/runx.json bucket/bucket/runx.json
          git -C bucket config user.name "github-actions[bot]"
          git -C bucket config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git -C bucket add bucket/runx.json
          git -C bucket diff --cached --quiet || { git -C bucket commit -m "runx ${{ needs.prepare.outputs.version }}"; git -C bucket push; }

  publish-winget:
    needs: [prepare, package-managers]
    if: needs.prepare.outputs.publish == 'true'
    runs-on: ubuntu-24.04
    steps:
      - name: Check winget credentials
        id: gate
        run: |
          if [ -n "${{ secrets.WINGET_TOKEN }}" ]; then
            echo "publish=true" >> "$GITHUB_OUTPUT"
          else
            echo "publish=false" >> "$GITHUB_OUTPUT"
            echo "::warning::Skipping winget publish because WINGET_TOKEN is not configured."
          fi
      - uses: actions/checkout@v7
        if: steps.gate.outputs.publish == 'true'
      - name: Download rendered manifests
        if: steps.gate.outputs.publish == 'true'
        uses: actions/download-artifact@v8
        with:
          name: channel-manifests
          path: channels
      - name: Submit validated manifests to winget-pkgs
        if: steps.gate.outputs.publish == 'true'
        env:
          GH_TOKEN: ${{ secrets.WINGET_TOKEN }}
        run: |
          node scripts/publish-winget-manifest.mjs \
            --manifest channels/winget \
            --version "${{ needs.prepare.outputs.version }}" \
            --identifier runxhq.runx

  publish-docker:
    needs: [prepare, github-release]
    if: needs.prepare.outputs.publish == 'true'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v7
      - uses: docker/setup-buildx-action@v4
      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push
        uses: docker/build-push-action@v7
        with:
          context: .
          file: packaging/docker/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: |
            VERSION=${{ needs.prepare.outputs.version }}
          tags: |
            ghcr.io/runxhq/runx:${{ needs.prepare.outputs.version }}
            ghcr.io/runxhq/runx:latest
      - name: Verify anonymous pull access
        env:
          RUNX_RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
        run: node scripts/check-ghcr-anonymous-access.mjs