release-react-native.yml

name: Release React Native (iOS + Android)

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (strict semver, e.g. 0.1.0). Must match an existing Swift release tag.'
        required: true
        type: string
  workflow_call:
    inputs:
      version:
        description: 'Version to release (strict semver, e.g. 0.1.0). Must match an existing Swift release tag.'
        required: true
        type: string

permissions:
  contents: write
  id-token: write

concurrency:
  group: release-react-native-${{ inputs.version }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: macos-15
    env:
      VERSION: ${{ inputs.version }}
      ANDROID_NDK_VERSION: 27.0.12077973
      CARGO_NDK_VERSION: 4.1.2
    steps:
      - name: Validate version
        run: |
          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::Invalid version '$VERSION' — must match ^[0-9]+\\.[0-9]+\\.[0-9]+\$" >&2
            exit 1
          fi

      - name: Checkout release tag
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.version }}
          fetch-depth: 0

      - name: Ensure Swift release for this tag exists with xcframework asset
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if ! gh release view "$VERSION" --json assets --jq '.assets[].name' | grep -q '^libclear_signing\.xcframework\.zip$'; then
            echo "::error::Release $VERSION exists but is missing libclear_signing.xcframework.zip. Re-run the Swift release first." >&2
            exit 1
          fi

      - name: Setup Rust (iOS + Android targets)
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-ios,x86_64-apple-ios,aarch64-apple-ios-sim,aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: ". -> target"

      - name: Setup Node 20
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'

      - name: Setup Java 17 (for sdkmanager)
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17

      - name: Setup Android SDK + pinned NDK 27.0.12077973 (parity with release-kotlin.yml)
        uses: android-actions/setup-android@v3
      - run: sdkmanager "ndk;$ANDROID_NDK_VERSION"

      - name: Wire ANDROID_NDK_HOME + install cargo-ndk
        run: |
          echo "ANDROID_NDK_HOME=$ANDROID_HOME/ndk/$ANDROID_NDK_VERSION" >> "$GITHUB_ENV"
          cargo install cargo-ndk --version "$CARGO_NDK_VERSION" --locked

      - name: Install npm deps
        working-directory: bindings/react-native
        run: npm ci

      - name: Regenerate iOS JSI bridge + bindings (full release build)
        working-directory: bindings/react-native
        run: npx ubrn build ios --release --and-generate --config ubrn.config.yaml

      - name: Restore podspec to local-dev shape (for drift guard)
        run: ./scripts/prepare-rn-podspec.sh

      - name: Drift guard — committed iOS bindings must match regeneration
        run: |
          git diff --quiet -- \
            bindings/react-native/cpp \
            bindings/react-native/ios \
            bindings/react-native/src/generated \
            bindings/react-native/react-native-clear-signing.podspec || {
            echo "::error::Regenerated iOS bindings drift from committed state." >&2
            echo "Run scripts/build-rn-ios.sh locally and commit the result before releasing." >&2
            git --no-pager diff -- \
              bindings/react-native/cpp \
              bindings/react-native/ios \
              bindings/react-native/src/generated \
              bindings/react-native/react-native-clear-signing.podspec | head -200 >&2
            exit 1
          }

      - name: Regenerate Android JSI bridge + bindings + cross-compiled Rust .a
        working-directory: bindings/react-native
        run: npx ubrn build android --release --and-generate --config ubrn.config.yaml

      - name: Re-apply 16 KB common-page-size CMake patch
        run: ./scripts/prepare-rn-android-cmake.sh

      - name: Drift guard — committed Android bindings must match regeneration
        run: |
          git diff --quiet -- \
            bindings/react-native/cpp \
            bindings/react-native/src/generated \
            bindings/react-native/android \
            ':!bindings/react-native/android/src/main/jniLibs' || {
            echo "::error::Regenerated Android bindings drift from committed state." >&2
            echo "Run scripts/build-rn-android.sh locally and commit the result before releasing." >&2
            git --no-pager diff -- \
              bindings/react-native/cpp \
              bindings/react-native/src/generated \
              bindings/react-native/android \
              ':!bindings/react-native/android/src/main/jniLibs' | head -200 >&2
            exit 1
          }

      - name: Strip Android .a files (--strip-debug)
        run: |
          STRIP="$(find -L "$ANDROID_NDK_HOME/toolchains/llvm/prebuilt" -path '*/bin/llvm-strip' -type f | head -1)"
          if [ -z "$STRIP" ]; then
            echo "::error::llvm-strip not found under $ANDROID_NDK_HOME/toolchains/llvm/prebuilt" >&2
            exit 1
          fi
          echo "Using llvm-strip: $STRIP"
          for abi in arm64-v8a armeabi-v7a x86_64; do
            "$STRIP" --strip-debug "bindings/react-native/android/src/main/jniLibs/$abi/libclear_signing.a"
          done
          ls -la bindings/react-native/android/src/main/jniLibs/*/libclear_signing.a

      - name: Zip RN-flavored XCFramework
        run: |
          mkdir -p Output
          cd bindings/react-native
          zip -r ../../Output/libclear_signing-rn.xcframework.zip ClearSigning.xcframework

      - name: Compute xcframework SHA-256
        id: checksum
        run: |
          SHA="$(shasum -a 256 Output/libclear_signing-rn.xcframework.zip | awk '{print $1}')"
          echo "sha256=$SHA" >> "$GITHUB_OUTPUT"

      - name: Attach xcframework to GitHub release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.version }}
          files: Output/libclear_signing-rn.xcframework.zip

      - name: Apply release-mode podspec patches (with checksum)
        env:
          CHECKSUM: ${{ steps.checksum.outputs.sha256 }}
        run: ./scripts/prepare-rn-podspec.sh "$VERSION" "$CHECKSUM"

      - name: Bump package.json version
        working-directory: bindings/react-native
        run: npm version "$VERSION" --no-git-tag-version --allow-same-version

      - name: Audit npm tarball before publish
        working-directory: bindings/react-native
        run: |
          npm pack --dry-run --json > /tmp/pack.json
          SIZE=$(jq '.[0].size' /tmp/pack.json)
          UNPACKED=$(jq '.[0].unpackedSize' /tmp/pack.json)
          echo "Tarball: $SIZE bytes compressed, $UNPACKED bytes unpacked"
          if [ "$SIZE" -gt 62914560 ]; then
            echo "::error::Tarball $SIZE bytes exceeds 60 MB ceiling" >&2
            exit 1
          fi
          for abi in arm64-v8a armeabi-v7a x86_64; do
            jq -e --arg p "android/src/main/jniLibs/$abi/libclear_signing.a" \
              '.[0].files[] | select(.path == $p)' /tmp/pack.json > /dev/null \
              || { echo "::error::Tarball missing $abi/libclear_signing.a" >&2; exit 1; }
          done
          echo "All 3 ABI .a files present in tarball."

      - name: Publish to npm
        working-directory: bindings/react-native
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish --access public --provenance