release.yml

on:
  workflow_dispatch: {}
  push:
    # Sequence of patterns matched against refs/tags
    tags:
      - "v*" # Push events to matching v*, i.e. v1.0, v20.15.10
    branches:
      - "release-test"

name: Create Release

permissions:
  contents: write
  actions: read

jobs:
  build-macos-windows:
    name: Build sqlpage binaries (macOS & Windows)
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [macos-latest, windows-latest]
        include:
          - os: windows-latest
            binary_extension: .exe
            target: x86_64-pc-windows-msvc
            features: ""
          - os: macos-latest
            target: aarch64-apple-darwin
            features: "odbc-static"
    steps:
      - uses: actions/checkout@v7
      - name: Set up cargo cache
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        env:
          NODE_OPTIONS: --no-deprecation
      - uses: ./.github/actions/install-frontend-dependencies
      - name: Build
        run: cargo build --profile superoptimized --locked --target ${{ matrix.target }} --features "${{ matrix.features }}"

      # macOS: sign and notarize the binary
      - name: Sign and notarize macOS binary
        if: matrix.os == 'macos-latest'
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_NOTARIZATION_APPLE_ID: ${{ secrets.APPLE_NOTARIZATION_APPLE_ID }}
          APPLE_NOTARIZATION_PASSWORD: ${{ secrets.APPLE_NOTARIZATION_PASSWORD }}
          APPLE_NOTARIZATION_TEAM_ID: ${{ secrets.APPLE_NOTARIZATION_TEAM_ID }}
          P12_BASE64: ${{ secrets.APPLE_SIGNING_CERTIFICATE_P12_BASE64 }}
          P12_PASSWORD: ${{ secrets.APPLE_SIGNING_CERTIFICATE_PASSWORD }}
        run: |
          set -euo pipefail
          BIN=target/${{ matrix.target }}/superoptimized/sqlpage
          # Import the signing certificate into a temporary keychain
          umask 077
          trap 'security delete-keychain /tmp/signing.keychain; rm -f /tmp/signing.p12 /tmp/signing.pem' EXIT
          # Use PKCS12 algorithms supported by macOS Keychain.
          printf '%s' "$P12_BASE64" | base64 -d > /tmp/signing.p12
          openssl pkcs12 -in /tmp/signing.p12 -passin env:P12_PASSWORD -nodes -out /tmp/signing.pem
          openssl pkcs12 -export -in /tmp/signing.pem -passout env:P12_PASSWORD \
            -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg sha1 -out /tmp/signing.p12
          rm -f /tmp/signing.pem
          security create-keychain -p "" /tmp/signing.keychain
          security set-keychain-settings -lut 3600 /tmp/signing.keychain
          security unlock-keychain -p "" /tmp/signing.keychain
          security import /tmp/signing.p12 -k /tmp/signing.keychain -P "$P12_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple: -s -k "" /tmp/signing.keychain > /dev/null
          security list-keychains -d user -s /tmp/signing.keychain "$(security default-keychain)"
          # Sign with hardened runtime and entitlements
          codesign --force --options runtime --entitlements .github/macos/entitlements.plist --sign "$APPLE_SIGNING_IDENTITY" --timestamp "$BIN"
          codesign --verify --deep --strict --verbose=2 "$BIN"
          # Package in a zip and submit for notarization.
          # Note: stapler only supports .app bundles, disk images, and flat packages —
          # not bare Mach-O executables or zip archives. For a standalone binary,
          # notarization alone is sufficient: Gatekeeper checks Apple's servers online.
          ditto -c -k --keepParent "$BIN" sqlpage-macos.zip
          xcrun notarytool submit sqlpage-macos.zip \
            --apple-id "$APPLE_NOTARIZATION_APPLE_ID" \
            --password "$APPLE_NOTARIZATION_PASSWORD" \
            --team-id "$APPLE_NOTARIZATION_TEAM_ID" \
            --wait --output-format plist > notarization-result.plist
          if [[ "$(plutil -extract status raw -o - notarization-result.plist)" != "Accepted" ]]; then
            echo "Notarization was not accepted:" >&2
            cat notarization-result.plist >&2
            exit 1
          fi
          codesign --verify --deep --strict "$BIN"

      - name: Upload unsigned Windows artifact
        if: matrix.os == 'windows-latest'
        id: upload_unsigned
        uses: actions/upload-artifact@v7
        with:
          name: unsigned-windows
          path: target/${{ matrix.target }}/superoptimized/sqlpage.exe
          if-no-files-found: error

      - name: Submit signing request to SignPath
        if: matrix.os == 'windows-latest'
        id: signpath
        uses: signpath/github-action-submit-signing-request@v2.2
        with:
          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
          organization-id: '45fd8443-c7ca-4d29-a68b-608948185335'
          project-slug: 'sqlpage'
          signing-policy-slug: 'release-signing'
          github-artifact-id: ${{ steps.upload_unsigned.outputs.artifact-id }}
          wait-for-completion: true
          output-artifact-directory: './signed-windows'
          wait-for-completion-timeout-in-seconds: 7200
          service-unavailable-timeout-in-seconds: 1800
          download-signed-artifact-timeout-in-seconds: 1800

      - name: Upload signed Windows artifact
        if: matrix.os == 'windows-latest'
        uses: actions/upload-artifact@v7
        with:
          name: sqlpage windows-latest
          path: signed-windows/sqlpage.exe
          if-no-files-found: error

      - name: Upload artifact (non-Windows)
        if: matrix.os != 'windows-latest'
        uses: actions/upload-artifact@v7
        with:
          name: sqlpage ${{ matrix.os }}
          path: target/${{ matrix.target }}/superoptimized/sqlpage${{ matrix.binary_extension }}
          if-no-files-found: error

  build-linux:
    name: Build sqlpage binaries (Linux)
    runs-on: ubuntu-latest
    container: quay.io/pypa/manylinux_2_28_x86_64
    steps:
      - uses: actions/checkout@v7
      # The manylinux image ships no rustup, unlike the GitHub-hosted runners.
      - name: Install rustup
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain none
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Set up cargo cache
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        env:
          NODE_OPTIONS: --no-deprecation
      - uses: ./.github/actions/install-frontend-dependencies
      - name: Build
        run: cargo build --profile superoptimized --locked --target x86_64-unknown-linux-gnu --features "odbc-static"
      - uses: actions/upload-artifact@v7
        with:
          name: sqlpage ubuntu-latest
          path: target/x86_64-unknown-linux-gnu/superoptimized/sqlpage
          if-no-files-found: error

  build-aws:
    name: Build AWS Lambda Serverless zip image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - run: docker build -t sqlpage-lambda . -f lambda.Dockerfile --target runner
      - run: docker build -t sqlpage-lambda-builder . -f lambda.Dockerfile --target builder
      - run: docker run sqlpage-lambda-builder cat deploy.zip > sqlpage-aws-lambda.zip
      - uses: actions/upload-artifact@v7
        with:
          name: sqlpage aws lambda serverless image
          path: sqlpage-aws-lambda.zip

  create_release:
    name: Create Github Release
    needs: [build-macos-windows, build-linux, build-aws]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - uses: actions/checkout@v7
      - uses: actions/download-artifact@v8
        env:
          NODE_OPTIONS: --no-deprecation
      - run: |
          rm -rf sqlpage/templates/*.handlebars;
          chmod +x sqlpage*/sqlpage;
          mv 'sqlpage macos-latest/sqlpage' sqlpage.bin;
          tar --create --file sqlpage-macos.tgz --gzip sqlpage.bin sqlpage/sqlpage.json sqlpage/migrations sqlpage/templates sqlpage/sqlpage.json;
          mv 'sqlpage ubuntu-latest/sqlpage' sqlpage.bin;
          tar --create --file sqlpage-linux.tgz --gzip sqlpage.bin sqlpage/migrations sqlpage/templates sqlpage/sqlpage.json;
          mv 'sqlpage windows-latest/sqlpage.exe' .
          zip -r sqlpage-windows.zip sqlpage.exe sqlpage/migrations sqlpage/templates sqlpage/sqlpage.json;
      - name: Create Release
        id: create_release
        uses: softprops/action-gh-release@v3.0.0
        with:
          name: ${{ github.ref_name }}
          tag_name: ${{ github.ref_name }}
          draft: false
          prerelease: ${{ contains(github.ref_name, 'beta') }}
          files: |
            sqlpage-windows.zip
            sqlpage-linux.tgz
            sqlpage-macos.tgz
            sqlpage aws lambda serverless image/sqlpage-aws-lambda.zip

  cargo_publish:
    name: Publish to crates.io
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - uses: actions/checkout@v7
      - name: Set up cargo cache
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
        env:
          NODE_OPTIONS: --no-deprecation
      - run: sudo apt-get update && sudo apt-get install -y unixodbc-dev
      - uses: ./.github/actions/install-frontend-dependencies
      - name: Publish to crates.io
        run: |
          set +e
          cargo publish --allow-dirty --token ${{ secrets.CRATES_IO_TOKEN }} 2>&1 | tee cargo-publish.log
          status=${PIPESTATUS[0]}
          set -e
          if [ "$status" -ne 0 ]; then
            if grep -Eiq 'already (uploaded|exists)|version .* is already' cargo-publish.log; then
              echo "sqlpage ${GITHUB_REF_NAME#v} is already published on crates.io"
            else
              exit "$status"
            fi
          fi