publish.yml

name: Publish to npm

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-24.04
    steps:
      # actions/checkout@v6
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
        with:
          fetch-depth: 0

      - name: Verify tag is on default branch
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          git fetch --no-tags origin "$DEFAULT_BRANCH"
          if ! git merge-base --is-ancestor "$GITHUB_SHA" "origin/$DEFAULT_BRANCH"; then
            printf 'Tag commit %s is not reachable from origin/%s\n' "$GITHUB_SHA" "$DEFAULT_BRANCH"
            exit 1
          fi

      - name: Use stable Rust
        run: |
          rustup toolchain install stable --profile minimal --component rustfmt
          rustup default stable

      # actions/setup-node@v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Ensure npm 11.12.1
        run: npm install -g npm@11.12.1

      - name: Verify release version
        shell: bash
        run: |
          tag_version="${GITHUB_REF_NAME#v}"
          package_version="$(node -p "require('./package.json').version")"
          cargo_version="$(cargo metadata --no-deps --format-version 1 | node -e "const fs = require('node:fs'); const data = JSON.parse(fs.readFileSync(0, 'utf8')); console.log(data.packages.find((pkg) => pkg.name === 'ossrandom-lane').version);")"

          if [ "$tag_version" != "$package_version" ] || [ "$tag_version" != "$cargo_version" ]; then
            printf 'Version mismatch: tag=%s package.json=%s Cargo.toml=%s\n' "$tag_version" "$package_version" "$cargo_version"
            exit 1
          fi

      - name: Format
        run: cargo fmt --check

      - name: Test
        run: cargo test --locked

  build:
    needs: verify
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-22.04
            package: linux-x64
            binary: lane
            rust-target: x86_64-unknown-linux-musl
          - runner: ubuntu-22.04-arm
            package: linux-arm64
            binary: lane
            rust-target: aarch64-unknown-linux-musl
          - runner: macos-15-intel
            package: darwin-x64
            binary: lane
            rust-target: ""
          - runner: macos-15
            package: darwin-arm64
            binary: lane
            rust-target: ""
          - runner: windows-2025
            package: win32-x64
            binary: lane.exe
            rust-target: ""
    runs-on: ${{ matrix.runner }}
    steps:
      # actions/checkout@v6
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10

      - name: Use stable Rust
        shell: bash
        run: |
          rustup toolchain install stable --profile minimal
          rustup default stable
          if [ -n "${{ matrix.rust-target }}" ]; then
            rustup target add "${{ matrix.rust-target }}"
          fi

      - name: Install musl tools
        if: startsWith(matrix.package, 'linux-')
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools

      - name: Build binary
        shell: bash
        run: |
          if [ -n "${{ matrix.rust-target }}" ]; then
            if [ "${{ matrix.rust-target }}" = "x86_64-unknown-linux-musl" ]; then
              export CC_x86_64_unknown_linux_musl=musl-gcc
            fi
            if [ "${{ matrix.rust-target }}" = "aarch64-unknown-linux-musl" ]; then
              export CC_aarch64_unknown_linux_musl=musl-gcc
            fi
            cargo build --release --locked --target "${{ matrix.rust-target }}"
          else
            cargo build --release --locked
          fi

      - name: Stage binary
        shell: bash
        run: |
          mkdir -p "dist/${{ matrix.package }}"
          if [ -n "${{ matrix.rust-target }}" ]; then
            cp "target/${{ matrix.rust-target }}/release/${{ matrix.binary }}" "dist/${{ matrix.package }}/${{ matrix.binary }}"
          else
            cp "target/release/${{ matrix.binary }}" "dist/${{ matrix.package }}/${{ matrix.binary }}"
          fi
          if [ "${{ runner.os }}" != "Windows" ]; then
            chmod 755 "dist/${{ matrix.package }}/${{ matrix.binary }}"
          fi

      # actions/upload-artifact@v4
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: lane-${{ matrix.package }}
          path: dist/${{ matrix.package }}/${{ matrix.binary }}
          if-no-files-found: error

  publish:
    needs: build
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write
    steps:
      # actions/checkout@v6
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10

      # actions/setup-node@v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Ensure npm 11.12.1
        run: npm install -g npm@11.12.1

      # actions/download-artifact@v4
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: lane-linux-x64
          path: vendor/linux-x64

      # actions/download-artifact@v4
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: lane-linux-arm64
          path: vendor/linux-arm64

      # actions/download-artifact@v4
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: lane-darwin-x64
          path: vendor/darwin-x64

      # actions/download-artifact@v4
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: lane-darwin-arm64
          path: vendor/darwin-arm64

      # actions/download-artifact@v4
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: lane-win32-x64
          path: vendor/win32-x64

      - name: Restore executable bits
        run: |
          chmod 755 vendor/linux-x64/lane
          chmod 755 vendor/linux-arm64/lane
          chmod 755 vendor/darwin-x64/lane
          chmod 755 vendor/darwin-arm64/lane

      - name: Verify vendor binaries
        run: npm run check:vendor

      - name: Package dry run
        run: npm pack --dry-run

      - name: Publish
        run: npm publish --access public