open-standards/.github/workflows/wai-release.yml

name: wai command line release

# On a tag wai-v<version> (the version wai/wai-rs/Cargo.toml states), builds the quickstart
# archive (wai/quickstart/build.sh) on each runner and attaches it to the forge release of that
# tag, each archive with its SHA-256. An archive holds bin/ (wai with the feature quickstart,
# wai-relay, wai-room, wai-ingest, wai-remote-host, wai-pack, wai-quantum), share/wai/web/ (the
# room client) and share/wai/studio/ (WAI Studio, which `wai dev` serves at /_wai/), both built
# once, on the macOS host, which has the WebAssembly toolchain and Node:
#   macOS      aarch64-apple-darwin, and x86_64-apple-darwin on the Intel Mac (macos-x86_64);
#   Linux      x86_64- and aarch64-unknown-linux-musl, static, so any distribution runs it;
#   Windows    x86_64-pc-windows-msvc, as a zip.
# The first job checks the tag against the crate's version and the installer's, and that each
# project file schema (wai/schema/) is served at its $id as committed: every project file the
# release writes names its schema there, so a tag does not build until the site serves it.
# Before it is attached, each archive runs the quickstart as a new user runs it, from the
# archive alone on a fresh home directory and a PATH of the system's own directories
# (wai/quickstart/test/clean-machine.sh; on Windows its PowerShell twin, clean-machine.ps1):
# the archive checked against its SHA-256 and unpacked, what it holds checked (every binary,
# each of which runs, the room client and WAI Studio), then wai hello, wai verify,
# wai create my-room --template video-room and wai dev --check in the project, Studio at /_wai/
# among what it checks; and on the Apple-silicon Mac, the project's page joined in two browser
# pages, each decoding the other. A cross-built archive, whose binaries this host cannot run,
# is not run.
# A last job writes the Homebrew formula and the Scoop manifest for the archives attached and
# attaches them too; they go into the tap and the bucket by hand.
#
# Uploads go to the forge directly over the private network (FORGE_API), never through the
# public tunnel. A runner that is down leaves its platform's archive missing: the release lists
# what each build attached.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    tags: ['wai-v*']

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always
  FORGE_API: http://100.64.224.0:3400/api/v1
  FORGE_REPO: Transaction-Science/open-standards
  PUBLIC: https://git.transaction.science/Transaction-Science/open-standards

jobs:
  version:
    name: the tag is the crate's version
    runs-on: linux
    outputs:
      version: ${{ steps.v.outputs.version }}
    steps:
      - uses: actions/checkout@v5
      - id: v
        shell: bash
        run: |
          set -euo pipefail
          v="${GITHUB_REF_NAME#wai-v}"
          crate="$(sed -n 's/^version = "\(.*\)"$/\1/p' wai/wai-rs/Cargo.toml | head -1)"
          [ "$v" = "$crate" ] || { echo "::error::the tag says $v, wai/wai-rs/Cargo.toml says $crate"; exit 1; }
          grep -q "WAI_VERSION:-$v}" wai/quickstart/install.sh || { echo "::error::wai/quickstart/install.sh does not install $v"; exit 1; }
          # Every project file this release writes names its schema by URL ($schema), which
          # editors and agents fetch: each committed schema is served at its $id, as committed,
          # before a release writes a file that names it (wai/schema/README.md).
          for f in wai/schema/wai-json-*.schema.json; do
            python3 - "$f" <<'PY' || exit 1
          import json, sys, urllib.request
          f = sys.argv[1]
          want = json.load(open(f))
          url = want["$id"]
          try:
              with urllib.request.urlopen(urllib.request.Request(url, headers={"User-Agent": "wai-release"}), timeout=30) as r:
                  got = json.loads(r.read())
          except Exception as e:
              sys.exit(f"::error::{url} does not serve {f} ({e}): deploy the site with the schema before the release")
          if got != want:
              sys.exit(f"::error::{url} serves a schema other than {f}: deploy the site with the schema before the release")
          print(f"{url} serves {f}")
          PY
          done
          echo "version=$v" >> "$GITHUB_OUTPUT"

  # The room client and WAI Studio, once: the same files on every platform.
  web:
    name: the room client and WAI Studio
    needs: version
    runs-on: macos
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      # launchd's PATH omits cargo and node on the macOS host runner.
      - name: Put cargo and node on PATH
        shell: bash
        run: |
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
          echo "/opt/homebrew/bin" >> "$GITHUB_PATH"
      - name: Build and attach them
        shell: bash
        env:
          FORGE_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          rustup target add wasm32-unknown-unknown
          command -v wasm-bindgen >/dev/null && wasm-bindgen --version | grep -q ' 0\.2\.127$' || cargo install --locked wasm-bindgen-cli --version 0.2.127
          v="${{ needs.version.outputs.version }}"
          bash wai/quickstart/build-web.sh "$RUNNER_TEMP/web"
          bash wai/quickstart/build-studio.sh "$RUNNER_TEMP/studio"
          mkdir -p "$RUNNER_TEMP/dist"
          tar -C "$RUNNER_TEMP" -czf "$RUNNER_TEMP/dist/wai-web-$v.tar.gz" web studio
          ( cd "$RUNNER_TEMP/dist" && shasum -a 256 "wai-web-$v.tar.gz" > "wai-web-$v.tar.gz.sha256" )
          bash wai/quickstart/publish.sh "$GITHUB_REF_NAME" "wai $v" "$RUNNER_TEMP"/dist/*

  macos:
    name: macOS · ${{ matrix.triple }}
    needs: [version, web]
    # Each archive on a Mac of its own architecture, so its own `wai` runs before it is
    # attached (the checks below run when the triple is the host's): x86_64 on the Intel Mac.
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 120
    strategy:
      fail-fast: false
      matrix:
        # `browser`: whether the host has the browser and the automation package the
        # quickstart's two-page step drives (the Apple-silicon runner does, as wai-examples.yml
        # uses them; the Intel Mac is not set up for it).
        include:
          - { triple: aarch64-apple-darwin, runner: macos, browser: true }
          - { triple: x86_64-apple-darwin, runner: macos-x86_64, browser: false }
    steps:
      - uses: actions/checkout@v5
      - name: Put cargo on PATH
        shell: bash
        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Build, check and package
        shell: bash
        run: |
          set -euo pipefail
          v="${{ needs.version.outputs.version }}"
          rustup target add "${{ matrix.triple }}"
          curl -fsS -o "$RUNNER_TEMP/web.tar.gz" "${FORGE_API%/api/v1}/$FORGE_REPO/releases/download/$GITHUB_REF_NAME/wai-web-$v.tar.gz"
          tar -C "$RUNNER_TEMP" -xzf "$RUNNER_TEMP/web.tar.gz"
          nice -n 10 bash wai/quickstart/build.sh "$RUNNER_TEMP/dist" --web "$RUNNER_TEMP/web" --studio "$RUNNER_TEMP/studio" --target "${{ matrix.triple }}" --version "$v"
      - name: The quickstart from the archive, as a new user runs it
        shell: bash
        env:
          BROWSER_BIN: /Applications/Google Chrome.app/Contents/MacOS/Google Chrome  # allow-name: the macOS runner's browser executable, a file path
        run: |
          set -euo pipefail
          v="${{ needs.version.outputs.version }}"
          if [ "${{ matrix.triple }}" != "$(rustc -vV | sed -n 's/^host: //p')" ]; then
            echo "cross-built for ${{ matrix.triple }}: this host cannot run it"
            exit 0
          fi
          flag=""
          if [ "${{ matrix.browser }}" = true ]; then
            test -x "$BROWSER_BIN" || { echo "::error::this runner has no browser at $BROWSER_BIN"; exit 1; }
            pw="$RUNNER_TEMP/automation"; mkdir -p "$pw"
            cp wai/quickstart/test/package.json wai/quickstart/test/package-lock.json "$pw/"
            (cd "$pw" && npm ci --ignore-scripts --no-audit --no-fund > /dev/null)
            export PLAYWRIGHT_HOST="$pw/node_modules"
            flag=--browser
          fi
          bash wai/quickstart/test/clean-machine.sh "$RUNNER_TEMP/dist/wai-$v-${{ matrix.triple }}.tar.gz" $flag
      - name: Attach to the release
        shell: bash
        env:
          FORGE_TOKEN: ${{ github.token }}
        run: bash wai/quickstart/publish.sh "$GITHUB_REF_NAME" "wai ${{ needs.version.outputs.version }}" "$RUNNER_TEMP"/dist/*

  linux:
    name: Linux · ${{ matrix.triple }}
    needs: [version, web]
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 120
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: linux
            triple: x86_64-unknown-linux-musl
          - runner: linux-arm64
            triple: aarch64-unknown-linux-musl
    steps:
      - uses: actions/checkout@v5
      - name: Install Rust 1.99.1, the musl target and musl-gcc
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.99.1
          rustup toolchain install 1.99.1 --profile minimal
          rustup default 1.99.1
          rustup target add "${{ matrix.triple }}"
          SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo"
          $SUDO apt-get update -qq
          $SUDO apt-get install -y -qq musl-tools python3 curl
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Build, check and package
        shell: bash
        run: |
          set -euo pipefail
          v="${{ needs.version.outputs.version }}"
          t="${{ matrix.triple }}"
          T="$(echo "$t" | tr 'a-z-' 'A-Z_')"
          # Static, as the quantum command line is built (wai-quantum-cli-release.yml).
          export "CC_${t//-/_}=musl-gcc" "CARGO_TARGET_${T}_LINKER=musl-gcc"
          export RUSTFLAGS="-C target-feature=+crt-static -C relocation-model=static"
          curl -fsS -o "$RUNNER_TEMP/web.tar.gz" "${FORGE_API%/api/v1}/$FORGE_REPO/releases/download/$GITHUB_REF_NAME/wai-web-$v.tar.gz"
          tar -C "$RUNNER_TEMP" -xzf "$RUNNER_TEMP/web.tar.gz"
          bash wai/quickstart/build.sh "$RUNNER_TEMP/dist" --web "$RUNNER_TEMP/web" --studio "$RUNNER_TEMP/studio" --target "$t" --version "$v"
      - name: The quickstart from the archive, as a new user runs it
        shell: bash
        run: bash wai/quickstart/test/clean-machine.sh "$RUNNER_TEMP/dist/wai-${{ needs.version.outputs.version }}-${{ matrix.triple }}.tar.gz"
      - name: Attach to the release
        shell: bash
        env:
          FORGE_TOKEN: ${{ github.token }}
        run: bash wai/quickstart/publish.sh "$GITHUB_REF_NAME" "wai ${{ needs.version.outputs.version }}" "$RUNNER_TEMP"/dist/*

  windows:
    name: Windows · x86_64-pc-windows-msvc
    needs: [version, web]
    runs-on: windows
    timeout-minutes: 120
    env:
      CI: ""
    steps:
      - uses: actions/checkout@v5
      - name: Build, check and package
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          Remove-Item Env:CI -ErrorAction SilentlyContinue
          $v = "${{ needs.version.outputs.version }}"
          $t = "x86_64-pc-windows-msvc"
          $web = Join-Path $env:RUNNER_TEMP 'web.tar.gz'
          curl.exe -fsS -o $web "$($env:FORGE_API -replace '/api/v1$','')/$env:FORGE_REPO/releases/download/$env:GITHUB_REF_NAME/wai-web-$v.tar.gz"
          tar -xzf $web -C $env:RUNNER_TEMP
          $name = "wai-$v-$t"
          $stage = Join-Path $env:RUNNER_TEMP $name
          $dist = Join-Path $env:RUNNER_TEMP 'dist'
          Remove-Item $stage, $dist -Recurse -Force -ErrorAction Ignore
          New-Item -ItemType Directory -Force -Path (Join-Path $stage 'bin'), (Join-Path $stage 'share\wai'), $dist | Out-Null
          $builds = @(
            @{ dir = 'wai\wai-rs'; bin = 'wai'; args = @('--no-default-features', '--features', 'quickstart', '--bin', 'wai') },
            @{ dir = 'joule-code\joule-code-rs'; bin = 'wai-relay'; args = @('-p', 'joule-moq-relay', '--bin', 'wai-relay') },
            @{ dir = 'joule-code\joule-code-rs\crates\joule-moq-room'; bin = 'wai-room'; args = @('--bin', 'wai-room') },
            @{ dir = 'joule-code\joule-code-rs'; bin = 'wai-ingest'; args = @('-p', 'joule-moq-ingest', '--bin', 'wai-ingest') },
            @{ dir = 'joule-code\joule-code-rs\crates\joule-moq-remote'; bin = 'wai-remote-host'; args = @('--bin', 'wai-remote-host') },
            @{ dir = 'wai\wai-pack'; bin = 'wai-pack'; args = @('--bin', 'wai-pack') },
            @{ dir = 'wai\wai-quantum-cli'; bin = 'wai-quantum'; args = @('--bin', 'wai-quantum') }
          )
          foreach ($b in $builds) {
            Push-Location $b.dir
            cargo build --locked --release --target $t @($b.args)
            if ($LASTEXITCODE -ne 0) { throw "the build of $($b.bin) failed" }
            $target = (cargo metadata --format-version 1 --no-deps --locked | ConvertFrom-Json).target_directory
            Copy-Item (Join-Path $target "$t\release\$($b.bin).exe") (Join-Path $stage 'bin')
            Pop-Location
          }
          Copy-Item -Recurse (Join-Path $env:RUNNER_TEMP 'web') (Join-Path $stage 'share\wai\web')
          Copy-Item -Recurse (Join-Path $env:RUNNER_TEMP 'studio') (Join-Path $stage 'share\wai\studio')
          Copy-Item wai\quickstart\README.md, wai\LICENSE $stage
          & (Join-Path $stage 'bin\wai.exe') create --list
          if ($LASTEXITCODE -ne 0) { throw "the packaged wai does not run" }
          & (Join-Path $stage 'bin\wai-quantum.exe') --version
          if ($LASTEXITCODE -ne 0) { throw "the packaged wai-quantum does not run" }
          Compress-Archive -Path $stage -DestinationPath (Join-Path $dist "$name.zip") -Force
          $h = (Get-FileHash (Join-Path $dist "$name.zip") -Algorithm SHA256).Hash.ToLower()
          Set-Content -NoNewline -Path (Join-Path $dist "$name.zip.sha256") -Value "$h  $name.zip`n"
      # Not yet run: the Windows runner is down, so this step has never run on a Windows archive.
      # Under PowerShell 7 on a macOS archive the script has run without its contents step and
      # its check of WAI Studio, which have not run yet.
      - name: The quickstart from the archive, as a new user runs it
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          Remove-Item Env:CI -ErrorAction SilentlyContinue
          $name = "wai-${{ needs.version.outputs.version }}-x86_64-pc-windows-msvc"
          pwsh -NoProfile -File wai\quickstart\test\clean-machine.ps1 (Join-Path $env:RUNNER_TEMP "dist\$name.zip")
          if ($LASTEXITCODE -ne 0) { throw "the quickstart failed from $name.zip" }
      - name: Attach to the release
        shell: pwsh
        env:
          FORGE_TOKEN: ${{ github.token }}
        run: |
          $ErrorActionPreference = 'Stop'
          $H = @{ Authorization = "token $env:FORGE_TOKEN" }
          $base = "$env:FORGE_API/repos/$env:FORGE_REPO/releases"
          $rel = Invoke-RestMethod -Headers $H -Uri "$base/tags/$env:GITHUB_REF_NAME"
          foreach ($f in Get-ChildItem (Join-Path $env:RUNNER_TEMP 'dist')) {
            foreach ($a in (Invoke-RestMethod -Headers $H -Uri "$base/$($rel.id)/assets" | Where-Object { $_.name -eq $f.Name })) {
              Invoke-RestMethod -Headers $H -Method Delete -Uri "$base/$($rel.id)/assets/$($a.id)" | Out-Null
            }
            curl.exe -fsS -H "Authorization: token $env:FORGE_TOKEN" -X POST "$base/$($rel.id)/assets?name=$($f.Name)" -F "attachment=@$($f.FullName);type=application/octet-stream" -o NUL -w "uploaded $($f.Name): http %{http_code}`n"
            if ($LASTEXITCODE -ne 0) { throw "the upload of $($f.Name) failed" }
          }

  formulae:
    name: Homebrew formula and Scoop manifest
    needs: [version, macos, linux, windows]
    if: always() && needs.version.result == 'success'
    runs-on: linux
    steps:
      - uses: actions/checkout@v5
      - name: Write and attach them
        shell: bash
        env:
          FORGE_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          v="${{ needs.version.outputs.version }}"
          out="$RUNNER_TEMP/formulae"; mkdir -p "$out"
          python3 wai/quickstart/formulae.py "$v" "$GITHUB_REF_NAME" "$FORGE_API" "$FORGE_REPO" "$PUBLIC" "$out"
          bash wai/quickstart/publish.sh "$GITHUB_REF_NAME" "wai $v" "$out"/*