open-standards/.github/workflows/wai-quantum-cli-release.yml

name: wai-quantum command line release

# On a tag wai-quantum-cli-v<version> (the version wai/wai-quantum-cli/Cargo.toml
# states), builds the wai-quantum binary on each runner and attaches it to the forge
# release of that tag, each archive with its SHA-256:
#   macOS      aarch64-apple-darwin and x86_64-apple-darwin, with the GPU state vector;
#   Linux      x86_64- and aarch64-unknown-linux-musl, static, so any distribution runs it;
#   Windows    x86_64-pc-windows-msvc, as a zip.
# Each binary is run once before it is packaged (`--version`, and `key --demo-key` for
# a did:key). A last job writes the Homebrew formula and the Scoop manifest for the
# archives just uploaded and attaches them too.
#
# Uploads go to the forge directly over the private network (FORGE_API), never through
# the public tunnel. A runner that is down leaves its platform's archive missing: the
# release lists what each build attached.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    tags: ['wai-quantum-cli-v*']

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always
  FORGE_API: http://100.64.224.0:3400/api/v1
  FORGE_REPO: Transaction-Science/open-standards
  PUBLIC: https://git.transaction.science/Transaction-Science/open-standards

jobs:
  version:
    name: the tag is the crate's version
    runs-on: linux
    outputs:
      version: ${{ steps.v.outputs.version }}
    steps:
      - uses: actions/checkout@v5
      - id: v
        shell: bash
        run: |
          set -euo pipefail
          tag="${GITHUB_REF_NAME}"
          v="${tag#wai-quantum-cli-v}"
          crate="$(sed -n 's/^version = "\(.*\)"$/\1/p' wai/wai-quantum-cli/Cargo.toml | head -1)"
          [ "$v" = "$crate" ] || { echo "::error::the tag says $v, wai-quantum-cli/Cargo.toml says $crate"; exit 1; }
          echo "version=$v" >> "$GITHUB_OUTPUT"

  macos:
    name: macOS · ${{ matrix.triple }}
    needs: version
    runs-on: macos
    timeout-minutes: 90
    strategy:
      fail-fast: false
      max-parallel: 1
      matrix:
        triple: [aarch64-apple-darwin, x86_64-apple-darwin]
    steps:
      - uses: actions/checkout@v5
      # launchd's PATH omits cargo on the macOS host runner.
      - name: Put cargo on PATH
        shell: bash
        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Build, check and package
        shell: bash
        working-directory: wai/wai-quantum-cli
        run: |
          set -euo pipefail
          rustup target add "${{ matrix.triple }}"
          nice -n 10 cargo build --locked --release --features metal --target "${{ matrix.triple }}"
          bin="target/${{ matrix.triple }}/release/wai-quantum"
          if [ "${{ matrix.triple }}" = "$(rustc -vV | sed -n 's/^host: //p')" ]; then
            "$bin" --version
            "$bin" key --demo-key | grep -q '^did:key:z6Mk'
          fi
          bash release/package.sh "$bin" "${{ needs.version.outputs.version }}" "${{ matrix.triple }}" "$RUNNER_TEMP/dist"
      - name: Attach to the release
        shell: bash
        working-directory: wai/wai-quantum-cli
        env:
          FORGE_TOKEN: ${{ github.token }}
        run: bash release/publish.sh "$GITHUB_REF_NAME" "wai-quantum ${{ needs.version.outputs.version }}" "$RUNNER_TEMP"/dist/*

  linux:
    name: Linux · ${{ matrix.triple }}
    needs: version
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: linux
            triple: x86_64-unknown-linux-musl
          - runner: linux-arm64
            triple: aarch64-unknown-linux-musl
    steps:
      - uses: actions/checkout@v5
      - name: Install Rust 1.99.1, the musl target and musl-gcc
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.99.1
          rustup toolchain install 1.99.1 --profile minimal
          rustup default 1.99.1
          rustup target add "${{ matrix.triple }}"
          SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo"
          $SUDO apt-get update -qq
          $SUDO apt-get install -y -qq musl-tools
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Build, check and package
        shell: bash
        working-directory: wai/wai-quantum-cli
        run: |
          set -euo pipefail
          t="${{ matrix.triple }}"
          T="$(echo "$t" | tr 'a-z-' 'A-Z_')"
          export "CC_${t//-/_}=musl-gcc" "CARGO_TARGET_${T}_LINKER=musl-gcc"
          # Static, not static-pie: rustc asks the linker for -static-pie on musl,
          # which this musl-gcc's specs do not take (it links a dynamic PIE against
          # ld-musl instead); without position-independent code it asks for
          # -static, which they do. RUSTFLAGS reach the target only, since
          # --target is given, so build scripts build for the host as before.
          RUSTFLAGS="-C target-feature=+crt-static -C relocation-model=static" cargo build --locked --release --target "$t"
          bin="target/$t/release/wai-quantum"
          if command -v file >/dev/null 2>&1; then
            file "$bin" | grep -q -E 'statically linked|static-pie linked' || { echo "::error::$bin is not static"; file "$bin"; exit 1; }
          else
            echo "note: no file(1) here to confirm the binary is static"
          fi
          "$bin" --version
          "$bin" key --demo-key | grep -q '^did:key:z6Mk'
          bash release/package.sh "$bin" "${{ needs.version.outputs.version }}" "$t" "$RUNNER_TEMP/dist"
      - name: Attach to the release
        shell: bash
        working-directory: wai/wai-quantum-cli
        env:
          FORGE_TOKEN: ${{ github.token }}
        run: bash release/publish.sh "$GITHUB_REF_NAME" "wai-quantum ${{ needs.version.outputs.version }}" "$RUNNER_TEMP"/dist/*

  windows:
    name: Windows · x86_64-pc-windows-msvc
    needs: version
    runs-on: windows
    timeout-minutes: 90
    env:
      CI: ""
    steps:
      - uses: actions/checkout@v5
      - name: Build, check and package
        shell: pwsh
        working-directory: wai/wai-quantum-cli
        run: |
          $ErrorActionPreference = 'Stop'
          Remove-Item Env:CI -ErrorAction SilentlyContinue
          cargo build --locked --release --target x86_64-pc-windows-msvc
          if ($LASTEXITCODE -ne 0) { throw "the build failed" }
          $bin = "target\x86_64-pc-windows-msvc\release\wai-quantum.exe"
          & $bin --version
          $did = & $bin key --demo-key 2>$null
          if ($did -notmatch '^did:key:z6Mk') { throw "no did:key from the binary: $did" }
          $v = "${{ needs.version.outputs.version }}"
          $name = "wai-quantum-$v-x86_64-pc-windows-msvc"
          $stage = Join-Path $env:RUNNER_TEMP $name
          $dist = Join-Path $env:RUNNER_TEMP 'dist'
          Remove-Item $stage, $dist -Recurse -Force -ErrorAction Ignore
          New-Item -ItemType Directory -Force -Path $stage, $dist | Out-Null
          Copy-Item $bin, README.md, ..\LICENSE $stage
          Compress-Archive -Path $stage -DestinationPath (Join-Path $dist "$name.zip") -Force
          $h = (Get-FileHash (Join-Path $dist "$name.zip") -Algorithm SHA256).Hash.ToLower()
          Set-Content -NoNewline -Path (Join-Path $dist "$name.zip.sha256") -Value "$h  $name.zip`n"
      - name: Attach to the release
        shell: pwsh
        env:
          FORGE_TOKEN: ${{ github.token }}
        run: |
          $ErrorActionPreference = 'Stop'
          $H = @{ Authorization = "token $env:FORGE_TOKEN" }
          $base = "$env:FORGE_API/repos/$env:FORGE_REPO/releases"
          $tag = $env:GITHUB_REF_NAME
          $rel = $null
          for ($i = 0; $i -lt 6 -and -not $rel; $i++) {
            try { $rel = Invoke-RestMethod -Headers $H -Uri "$base/tags/$tag" } catch {
              try { Invoke-RestMethod -Headers $H -Method Post -Uri $base -ContentType 'application/json' -Body (@{ tag_name = $tag; name = "wai-quantum ${{ needs.version.outputs.version }}" } | ConvertTo-Json) | Out-Null } catch {}
              Start-Sleep -Seconds 3
            }
          }
          if (-not $rel) { throw "no release for $tag" }
          foreach ($f in Get-ChildItem (Join-Path $env:RUNNER_TEMP 'dist')) {
            foreach ($a in (Invoke-RestMethod -Headers $H -Uri "$base/$($rel.id)/assets" | Where-Object { $_.name -eq $f.Name })) {
              Invoke-RestMethod -Headers $H -Method Delete -Uri "$base/$($rel.id)/assets/$($a.id)" | Out-Null
            }
            curl.exe -fsS -H "Authorization: token $env:FORGE_TOKEN" -X POST "$base/$($rel.id)/assets?name=$($f.Name)" -F "attachment=@$($f.FullName);type=application/octet-stream" -o NUL -w "uploaded $($f.Name): http %{http_code}`n"
            if ($LASTEXITCODE -ne 0) { throw "the upload of $($f.Name) failed" }
          }

  # The package managers' entries for the archives just attached, from their own
  # SHA-256 files: a Homebrew formula (macOS and Linux) and a Scoop manifest (Windows).
  # A platform whose build did not attach an archive is left out, and the log says so.
  formulae:
    name: Homebrew formula and Scoop manifest
    needs: [version, macos, linux, windows]
    if: always() && needs.version.result == 'success'
    runs-on: linux
    steps:
      - uses: actions/checkout@v5
      - name: Write and attach them
        shell: bash
        working-directory: wai/wai-quantum-cli
        env:
          FORGE_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          v="${{ needs.version.outputs.version }}"
          out="$RUNNER_TEMP/formulae"; mkdir -p "$out"
          python3 release/formulae.py "$v" "$GITHUB_REF_NAME" "$FORGE_API" "$FORGE_REPO" "$PUBLIC" "$out"
          bash release/publish.sh "$GITHUB_REF_NAME" "wai-quantum $v" "$out"/*