release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  test:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run tests
        run: bun run test
      - name: Build TypeScript
        run: bun run build
      - name: Run integration tests
        run: bun run test:integration
        env:
          CERTMAN_API_KEY: ${{ secrets.CERTMAN_API_KEY }}

  build:
    needs: test
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            target: linux-x64
            platform: linux
            arch: amd64
          - os: ubuntu-latest
            target: linux-arm64
            platform: linux
            arch: arm64
          - os: macos-latest
            target: darwin-x64
            platform: darwin
            arch: amd64
          - os: macos-latest
            target: darwin-arm64
            platform: darwin
            arch: arm64
          - os: windows-latest
            target: windows-x64
            platform: windows
            arch: amd64

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v6

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build TypeScript
        run: bun run build

      - name: Build binary
        shell: bash
        run: |
          BINARY_NAME="certman-${{ matrix.platform }}-${{ matrix.arch }}"
          if [ "${{ matrix.platform }}" = "windows" ]; then
            bun build dist/index.js --compile --target=bun-${{ matrix.target }} --outfile="${BINARY_NAME}.exe"
          else
            bun build dist/index.js --compile --target=bun-${{ matrix.target }} --outfile="${BINARY_NAME}"
          fi

      - name: Create tar.gz archive
        shell: bash
        run: |
          BINARY_NAME="certman-${{ matrix.platform }}-${{ matrix.arch }}"
          if [ "${{ matrix.platform }}" = "windows" ]; then
            tar -czvf "${BINARY_NAME}.tar.gz" "${BINARY_NAME}.exe"
          else
            tar -czvf "${BINARY_NAME}.tar.gz" "${BINARY_NAME}"
          fi

      - name: Upload artifact
        uses: actions/upload-artifact@v6
        with:
          name: certman-${{ matrix.platform }}-${{ matrix.arch }}.tar.gz
          path: certman-*.tar.gz
          retention-days: 7

  build-deb:
    needs: build
    runs-on: ubuntu-latest
    strategy:
      matrix:
        arch: [amd64, arm64]

    steps:
      - uses: actions/checkout@v6

      - name: Download linux binary
        uses: actions/download-artifact@v7
        with:
          name: certman-linux-${{ matrix.arch }}.tar.gz
          path: .

      - name: Extract binary
        run: |
          mkdir -p bin
          tar -xzvf "certman-linux-${{ matrix.arch }}.tar.gz" -C bin/

      - name: Build Debian package
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          ./scripts/build-deb.sh "$VERSION" "${{ matrix.arch }}"

      - name: Upload artifact
        uses: actions/upload-artifact@v6
        with:
          name: certman-linux-${{ matrix.arch }}.deb
          path: deb/*.deb
          retention-days: 7

  release:
    needs: [build, build-deb]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write

    steps:
      - uses: actions/checkout@v6

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - uses: actions/setup-node@v6
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build
        run: bun run build

      - name: Publish to npm
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Download all artifacts
        uses: actions/download-artifact@v7
        with:
          path: artifacts/

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            artifacts/**/*
          generate_release_notes: true

  update-homebrew:
    needs: release
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Download artifacts
        uses: actions/download-artifact@v7
        with:
          path: artifacts/

      - name: Generate Homebrew formula
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          VERSION="$VERSION" ARTIFACTS_DIR="artifacts" bun run scripts/update-homebrew.ts

      - name: Push to homebrew-tap
        env:
          SSH_PRIVATE_KEY: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan github.com >> ~/.ssh/known_hosts

          git clone git@github.com:certman/homebrew-tap.git tap --config core.sshCommand="ssh -i ~/.ssh/deploy_key"
          cp certman.rb tap/certman.rb
          cd tap
          git config user.name "certman-release-bot"
          git config user.email "certman-release-bot@certman.app"
          git config core.sshCommand "ssh -i ~/.ssh/deploy_key"
          git add certman.rb
          git diff --staged --quiet || git commit -m "certman ${GITHUB_REF_NAME#v}"
          git push