release.yml

name: Release

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+-*'

env:
  CARGO_TERM_COLOR: always
  BINARY_NAME: cc-relay-server
  DOCKER_IMAGE: wakaka6/claude-code-relay

permissions:
  contents: write
  packages: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            archive: tar.gz
            use_cross: false
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            archive: tar.gz
            use_cross: true
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            archive: tar.gz
            use_cross: true
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
            archive: tar.gz
            use_cross: true
          - target: x86_64-apple-darwin
            os: macos-latest
            archive: tar.gz
            use_cross: false
          - target: aarch64-apple-darwin
            os: macos-latest
            archive: tar.gz
            use_cross: false
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            archive: zip
            use_cross: false

    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install cross
        if: matrix.use_cross
        run: cargo install cross --git https://github.com/cross-rs/cross

      - name: Install musl-tools (x86_64-musl without cross)
        if: matrix.target == 'x86_64-unknown-linux-musl' && !matrix.use_cross
        run: sudo apt-get update && sudo apt-get install -y musl-tools

      - name: Build with cross
        if: matrix.use_cross
        run: cross build --release --target ${{ matrix.target }} -p relay-server

      - name: Build with cargo
        if: ${{ !matrix.use_cross }}
        run: cargo build --release --target ${{ matrix.target }} -p relay-server

      - name: Get version
        id: version
        shell: bash
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Package (Unix)
        if: matrix.os != 'windows-latest'
        run: |
          cd target/${{ matrix.target }}/release
          tar -czvf ../../../${{ env.BINARY_NAME }}-${{ steps.version.outputs.version }}-${{ matrix.target }}.tar.gz ${{ env.BINARY_NAME }}

      - name: Package (Windows)
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: |
          cd target/${{ matrix.target }}/release
          Compress-Archive -Path ${{ env.BINARY_NAME }}.exe -DestinationPath ../../../${{ env.BINARY_NAME }}-${{ steps.version.outputs.version }}-${{ matrix.target }}.zip

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-${{ matrix.target }}
          path: ${{ env.BINARY_NAME }}-${{ steps.version.outputs.version }}-${{ matrix.target }}.${{ matrix.archive }}
          if-no-files-found: error

  docker:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Get version
        id: version
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.DOCKER_IMAGE }}
            ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable=${{ !contains(github.ref, '-') }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  release:
    needs: [build, docker]
    runs-on: ubuntu-latest
    steps:
      - name: Get version
        id: version
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          pattern: ${{ env.BINARY_NAME }}-*
          merge-multiple: true

      - name: Generate checksums
        working-directory: artifacts
        run: |
          sha256sum * > checksums-sha256.txt
          cat checksums-sha256.txt

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          name: Release v${{ steps.version.outputs.version }}
          draft: false
          prerelease: ${{ contains(github.ref, '-') }}
          generate_release_notes: true
          files: |
            artifacts/*

  update-aur:
    needs: release
    if: ${{ !contains(github.ref, '-') }}
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - name: Get version
        id: version
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Wait for release tarball
        run: |
          set -euo pipefail
          for i in $(seq 1 30); do
            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
              "https://github.com/${{ github.repository }}/archive/refs/tags/v${{ steps.version.outputs.version }}.tar.gz")
            if [ "$HTTP_CODE" = "200" ] || [ "$HTTP_CODE" = "302" ]; then
              echo "Release tarball is available"
              exit 0
            fi
            echo "Waiting for release tarball (HTTP $HTTP_CODE)... attempt $i/30"
            sleep 10
          done
          echo "Release tarball not available after 5 minutes"
          exit 1

      - name: Get tarball SHA256
        id: sha256
        run: |
          set -euo pipefail
          SHA256=$(curl -fsSL --retry 3 --retry-delay 10 \
            "https://github.com/${{ github.repository }}/archive/refs/tags/v${{ steps.version.outputs.version }}.tar.gz" \
            | sha256sum | cut -d' ' -f1)
          if [[ ! "$SHA256" =~ ^[a-f0-9]{64}$ ]]; then
            echo "Invalid SHA256: $SHA256"
            exit 1
          fi
          echo "SHA256: $SHA256"
          echo "sha256=$SHA256" >> $GITHUB_OUTPUT

      - name: Setup SSH
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          printf '%s\n' "${{ secrets.AUR_SSH_PRIVATE_KEY }}" > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts
          cat >> ~/.ssh/config <<'EOF'
          Host aur.archlinux.org
            IdentityFile ~/.ssh/aur
            User aur
          EOF
          sed -i 's/^          //' ~/.ssh/config
          chmod 600 ~/.ssh/config

      - name: Clone AUR repo
        run: git clone ssh://aur@aur.archlinux.org/claude-code-relay.git aur-repo

      - name: Update PKGBUILD
        working-directory: aur-repo
        env:
          NEW_VERSION: ${{ steps.version.outputs.version }}
          NEW_SHA: ${{ steps.sha256.outputs.sha256 }}
        run: |
          set -euo pipefail
          echo "Before update:"
          grep -E "^(pkgver|sha256sums)" PKGBUILD | head -3

          sed -i "s/^pkgver=.*/pkgver=${NEW_VERSION}/" PKGBUILD
          sed -i "0,/'[a-f0-9]\{64\}'/s/'[a-f0-9]\{64\}'/'${NEW_SHA}'/" PKGBUILD

          echo "After update:"
          grep -E "^(pkgver|sha256sums)" PKGBUILD | head -3

          if ! grep -q "${NEW_SHA}" PKGBUILD; then
            echo "Error: SHA256 not updated in PKGBUILD"
            exit 1
          fi

      - name: Generate .SRCINFO
        working-directory: aur-repo
        run: |
          docker run --rm -v "$(pwd):/pkg" archlinux:base-devel bash -c "
            useradd -m builder
            chown -R builder:builder /pkg
            cd /pkg
            su builder -c 'makepkg --printsrcinfo > .SRCINFO'
          "

      - name: Commit and push
        working-directory: aur-repo
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          git add PKGBUILD .SRCINFO
          if git diff --cached --quiet; then
            echo "No changes to commit"
            exit 0
          fi

          git commit -m "Update to v${{ steps.version.outputs.version }}"
          git push

  update-homebrew:
    needs: release
    if: ${{ !contains(github.ref, '-') }}
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - name: Get version
        id: version
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Wait for release tarball
        run: |
          set -euo pipefail
          for i in $(seq 1 30); do
            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
              "https://github.com/${{ github.repository }}/archive/refs/tags/v${{ steps.version.outputs.version }}.tar.gz")
            if [ "$HTTP_CODE" = "200" ] || [ "$HTTP_CODE" = "302" ]; then
              echo "Release tarball is available"
              exit 0
            fi
            echo "Waiting for release tarball (HTTP $HTTP_CODE)... attempt $i/30"
            sleep 10
          done
          echo "Release tarball not available after 5 minutes"
          exit 1

      - name: Get tarball SHA256
        id: sha256
        run: |
          set -euo pipefail
          SHA256=$(curl -fsSL --retry 3 --retry-delay 10 \
            "https://github.com/${{ github.repository }}/archive/refs/tags/v${{ steps.version.outputs.version }}.tar.gz" \
            | sha256sum | cut -d' ' -f1)
          if [[ ! "$SHA256" =~ ^[a-f0-9]{64}$ ]]; then
            echo "Invalid SHA256: $SHA256"
            exit 1
          fi
          echo "SHA256: $SHA256"
          echo "sha256=$SHA256" >> $GITHUB_OUTPUT

      - name: Clone homebrew-tap
        env:
          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          git clone https://github.com/wakaka6/homebrew-tap.git
          cd homebrew-tap
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/wakaka6/homebrew-tap.git"

      - name: Update Formula
        working-directory: homebrew-tap
        env:
          NEW_VERSION: ${{ steps.version.outputs.version }}
          NEW_SHA: ${{ steps.sha256.outputs.sha256 }}
        run: |
          set -euo pipefail
          FORMULA="Formula/claude-code-relay.rb"

          echo "Before update:"
          grep -E "^  (url|sha256)" "$FORMULA"

          sed -i "s|url \"https://github.com/.*/archive/refs/tags/v[^\"]*\.tar\.gz\"|url \"https://github.com/${{ github.repository }}/archive/refs/tags/v${NEW_VERSION}.tar.gz\"|" "$FORMULA"
          sed -i "s/sha256 \"[a-f0-9]\{64\}\"/sha256 \"${NEW_SHA}\"/" "$FORMULA"

          echo "After update:"
          grep -E "^  (url|sha256)" "$FORMULA"

          if ! grep -q "${NEW_SHA}" "$FORMULA"; then
            echo "Error: SHA256 not updated in Formula"
            exit 1
          fi

      - name: Commit and push
        working-directory: homebrew-tap
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          git add Formula/claude-code-relay.rb
          if git diff --cached --quiet; then
            echo "No changes to commit"
            exit 0
          fi

          git commit -m "claude-code-relay: update to v${{ steps.version.outputs.version }}"
          git push