release.yml

name: Release

on:
  push:
    tags:
      - "v*"

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: mcr.microsoft.com/devcontainers/rust:1-bullseye
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Nix with Cachix
        uses: cachix/install-nix-action@v30
        with:
          nix_path: nixpkgs=channel:nixos-unstable

      - name: Setup FlakeHub Cache
        uses: DeterminateSystems/flakehub-cache-action@v7
        with:
          cache-name: "singularity-analysis"
          visibility: "public"
        env:
          FLAKEHUB_PUSH_TOKEN: ${{ secrets.FLAKEHUB_PUSH_TOKEN }}

      - name: Setup Cachix
        uses: cachix/cachix-action@v15
        with:
          name: mikkihugo
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: cargo-release-registry-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}

      - name: Cache cargo target
        uses: actions/cache@v4
        with:
          path: target
          key: cargo-release-target-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}

      - name: Clippy (strictest settings for release)
        run: |
          cargo clippy --workspace --all-targets --all-features -- \
            -D warnings \
            -D clippy::all \
            -D clippy::pedantic \
            -D clippy::nursery \
            -D clippy::cargo \
            -W clippy::restriction \
            -A clippy::missing_docs_in_private_items \
            -A clippy::implicit_return \
            -A clippy::missing_inline_in_public_items \
            -A clippy::question_mark_used \
            -A clippy::mod_module_files \
            -A clippy::self_named_module_files

      - name: Run tests
        run: cargo test --workspace --all-targets

      - name: Build release library
        run: cargo build --workspace --release --lib

      - name: Build CLI binary
        run: cargo build --release --bin singularity-rca --features cli

      - name: Prepare artifact directory
        run: mkdir -p release-artifacts

      - name: Generate release review
        run: ./scripts/generate-release-review.sh release-artifacts/RELEASE_REVIEW.md
        env:
          GITHUB_REF_NAME: ${{ github.ref_name }}

      - name: Package CLI binary
        run: |
          if [ -f target/release/singularity-rca ]; then
            cp target/release/singularity-rca release-artifacts/
            chmod +x release-artifacts/singularity-rca
            echo "✓ CLI binary packaged"
          fi

      - name: Package library artifacts
        run: |
          find target/release -maxdepth 1 -type f -executable -exec cp {} release-artifacts/ \;
          find target/release -maxdepth 1 -name "*.so" -exec cp {} release-artifacts/ \;

      - name: Create source tarball
        run: |
          tar -czf release-artifacts/singularity-rca-source.tar.gz \
            --exclude=target \
            --exclude=.git \
            --exclude=_build \
            --exclude=deps \
            --exclude=.direnv \
            .

      - name: Create binary tarball
        run: |
          tar -czf release-artifacts/singularity-rca-binaries.tar.gz -C release-artifacts singularity-rca

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: singularity-analysis-artifacts
          path: release-artifacts

  publish:
    runs-on: ubuntu-latest
    needs: build
    container:
      image: mcr.microsoft.com/devcontainers/rust:1-bullseye
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: singularity-analysis-artifacts
          path: dist

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: dist/**
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}