release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag_name:
        description: 'Tag name for release (e.g. v0.8.3)'
        required: true
        type: string

permissions:
  contents: write

env:
  VCPKG_COMMIT: 45f9f39362a4c52e2b1fbe57b7e649db7f3d96d4
  VCPKG_CACHE_REVISION: ffmpeg-nvcodec-static-v1

jobs:
  build-release:
    name: Build and Release Binary
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7 # v5.0.0
        with:
          ref: ${{ inputs.tag_name || github.ref }}
          fetch-depth: 0

      - name: Verify checked-out release tag
        env:
          INPUT_TAG: ${{ inputs.tag_name }}
          EVENT_NAME: ${{ github.event_name }}
          EVENT_REF_TYPE: ${{ github.ref_type }}
          EVENT_REF_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            test -n "$INPUT_TAG" || { echo "manual releases require an existing tag_name" >&2; exit 1; }
            TAG="$INPUT_TAG"
          else
            test "$EVENT_REF_TYPE" = "tag" || { echo "release workflow must run from a tag" >&2; exit 1; }
            TAG="$EVENT_REF_NAME"
          fi
          git show-ref --verify --quiet "refs/tags/$TAG" || { echo "tag $TAG does not exist" >&2; exit 1; }
          TAG_COMMIT="$(git rev-parse "refs/tags/$TAG^{commit}")"
          CHECKED_OUT_COMMIT="$(git rev-parse HEAD)"
          test "$CHECKED_OUT_COMMIT" = "$TAG_COMMIT" || { echo "checkout does not match $TAG" >&2; exit 1; }
          TAG_VERSION="${TAG#v}"
          META_VERSION="$(cargo metadata --no-deps --format-version 1 | jq -re '.packages[] | select(.name=="wallr") | .version')"
          test "$TAG_VERSION" = "$META_VERSION" || { echo "tag $TAG != workspace version $META_VERSION" >&2; exit 1; }
          grep -q "## \[$META_VERSION\]" CHANGELOG.md
          echo "Verified $TAG at $CHECKED_OUT_COMMIT"
      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwayland-dev \
            wayland-protocols \
            libxkbcommon-dev \
            libegl-dev \
            libgles-dev \
            libx11-dev \
            libasound2-dev \
            libudev-dev \
            pkg-config \
            cmake \
            ninja-build \
            nasm

      - name: Restore vcpkg binary archives
        # x-gha was removed from vcpkg in April 2025 (microsoft/vcpkg-tool#1662).
        # The recommended replacement for GitHub Actions is a filesystem cache
        # via VCPKG_BINARY_SOURCES=clear;files,<path>,readwrite + actions/cache
        # on that path. We cache the archives (per-port zip files) in the
        # workspace, not inside /opt/vcpkg, so a fresh `git clone` of the
        # tool doesn't wipe the cache.
        id: vcpkg-cache
        uses: actions/cache/restore@v6 # v5.1.0
        with:
          path: ${{ github.workspace }}/.vcpkg-cache
          key: wallr-vcpkg-archives-${{ runner.os }}-${{ env.VCPKG_COMMIT }}-${{ env.VCPKG_CACHE_REVISION }}-${{ hashFiles('.github/vcpkg-triplets/**') }}
          restore-keys: |
            wallr-vcpkg-archives-${{ runner.os }}-${{ env.VCPKG_COMMIT }}-
            wallr-vcpkg-archives-${{ runner.os }}-

      - name: Report vcpkg cache status
        env:
          CACHE_HIT: ${{ steps.vcpkg-cache.outputs.cache-hit }}
        run: |
          if [ "$CACHE_HIT" = "true" ]; then
            echo "vcpkg binary archive cache: exact hit"
          else
            echo "vcpkg binary archive cache: no exact hit (a fallback cache may have been restored)"
          fi

      - name: Install vcpkg
        run: |
          if [ -d /opt/vcpkg/.git ]; then
            echo "vcpkg already present from cache, updating"
            git -C /opt/vcpkg fetch --depth 1 origin "$VCPKG_COMMIT"
            git -C /opt/vcpkg checkout "$VCPKG_COMMIT"
          else
            sudo rm -rf /opt/vcpkg
            git clone --depth 1 --branch master https://github.com/microsoft/vcpkg /opt/vcpkg
            git -C /opt/vcpkg fetch --depth 1 origin "$VCPKG_COMMIT"
            git -C /opt/vcpkg checkout "$VCPKG_COMMIT"
          fi
          /opt/vcpkg/bootstrap-vcpkg.sh -disableMetrics

      - name: Build static FFmpeg
        env:
          VCPKG_ROOT: /opt/vcpkg
          VCPKG_BINARY_SOURCES: "clear;files,${{ github.workspace }}/.vcpkg-cache,readwrite"
        run: |
          mkdir -p "${{ github.workspace }}/.vcpkg-cache"
          /opt/vcpkg/vcpkg install \
            'ffmpeg[core,avcodec,avformat,swscale,swresample,nvcodec]:x64-linux-static' \
            --overlay-triplets="$GITHUB_WORKSPACE/.github/vcpkg-triplets"

      - name: Save vcpkg binary archives
        if: always() && !cancelled()
        uses: actions/cache/save@v6 # v5.1.0
        with:
          path: ${{ github.workspace }}/.vcpkg-cache
          key: wallr-vcpkg-archives-${{ runner.os }}-${{ env.VCPKG_COMMIT }}-${{ env.VCPKG_CACHE_REVISION }}-${{ hashFiles('.github/vcpkg-triplets/**') }}

      - name: Install stable Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry and build artifacts
        uses: Swatinem/rust-cache@v2.9.3
        with:
          # No custom `key` override: rust-cache hashes Cargo.lock, the Rust
          # toolchain version, and the job's `runs-on` automatically. A fixed
          # key here (as in the original) never changes, so it restores the
          # same snapshot forever and never saves a fresh one after the
          # first run; this is the actual caching bug in the original file.
          # rust-cache's default env-vars list ("CARGO CC CFLAGS CXX CMAKE
          # RUST") already matches PKG_CONFIG_ALL_STATIC's C-toolchain
          # neighbors but not the two FFmpeg linkage vars themselves, since
          # matching is by *prefix*. Include the static-FFmpeg variables and
          # set them on this step so their values are part of the cache key.
          env-vars: CARGO CC CFLAGS CXX CMAKE RUST MEDIA_PREFIX PKG_CONFIG
          cache-on-failure: true
          shared-key: release-static-ffmpeg
        env:
          MEDIA_PREFIX: /opt/vcpkg/installed/x64-linux-static
          PKG_CONFIG_PATH: /opt/vcpkg/installed/x64-linux-static/lib/pkgconfig
          PKG_CONFIG_ALL_STATIC: "1"

      - name: Build release binary with static FFmpeg
        env:
          MEDIA_PREFIX: /opt/vcpkg/installed/x64-linux-static
          PKG_CONFIG_PATH: /opt/vcpkg/installed/x64-linux-static/lib/pkgconfig
          PKG_CONFIG_ALL_STATIC: "1"
        run: cargo build --release --bins --locked --features static-ffmpeg

      - name: Verify static FFmpeg hardware support
        env:
          MEDIA_PREFIX: /opt/vcpkg/installed/x64-linux-static
          PKG_CONFIG_PATH: /opt/vcpkg/installed/x64-linux-static/lib/pkgconfig
          PKG_CONFIG_ALL_STATIC: "1"
        run: |
          set -euo pipefail
          capabilities=$(cargo run -q -p wallr-core --example video_probe --release --features static-ffmpeg -- --capabilities)
          printf '%s\n' "$capabilities"
          grep -qx 'cuda: enabled' <<<"$capabilities"

      - name: Verify binary is self-contained
        run: |
          set -euo pipefail
          for BIN in target/release/wallr target/release/wallr-daemon; do
            if [ ! -x "$BIN" ]; then
              echo "ERROR: $BIN not found or not executable; build did not produce a binary"
              exit 1
            fi
          done
          if ldd target/release/wallr-daemon | grep -qE 'libav(a|util|codec|format|sw)'; then
            echo "ERROR: daemon links dynamic FFmpeg libraries"
            ldd target/release/wallr-daemon
            exit 1
          fi
          echo "OK: daemon has no dynamic FFmpeg dependencies"

      - name: Prepare Release Asset
        run: |
          set -euo pipefail
          mkdir -p staging
          cp target/release/wallr staging/
          cp target/release/wallr-daemon staging/
          cp README.md staging/
          cp -r docs staging/
          cd staging
          tar -czf ../wallr-linux-amd64.tar.gz -- *
          cd ..
          archive_contents="$(tar -tzf wallr-linux-amd64.tar.gz)"
          for required in wallr wallr-daemon README.md docs/; do
            grep -Fxq "$required" <<<"$archive_contents" || {
              echo "ERROR: release archive is missing $required" >&2
              exit 1
            }
          done
          sha256sum wallr-linux-amd64.tar.gz > wallr-linux-amd64.tar.gz.sha256

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3.0.3 # v3.0.1
        with:
          tag_name: ${{ inputs.tag_name || github.ref_name }}
          name: Release ${{ inputs.tag_name || github.ref_name }}
          draft: false
          prerelease: false
          files: |
            wallr-linux-amd64.tar.gz
            wallr-linux-amd64.tar.gz.sha256
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}