release.yml

name: Release

# Releases are immutable once published, so assets must exist before
# the Publish button is pressed. Pushing a version tag builds the
# assets and attaches them to a draft release (creating the draft if
# one does not already exist). Publish the draft from the website
# once all assets are present.
on:
  push:
    tags:
      - '[0-9]+.[0-9]+.[0-9]+'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Existing tag to (re)build assets for'
        required: true

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always
  RELEASE_TAG: ${{ github.event.inputs.tag || github.ref_name }}

jobs:
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # Linux binaries are built as static musl so they run on any
        # Linux with no libc or dynamic-loader dependency: old-glibc
        # distros (RHEL 8, glibc 2.28) and musl distros (Alpine) alike,
        # which the old dynamically-linked glibc build could not. They
        # are published under the historical `-unknown-linux-gnu` asset
        # names (`asset_target`) so the editor extensions keep resolving
        # the same asset with no change on their side; a static musl
        # binary runs on glibc systems just as well.
        include:
          - target: x86_64-unknown-linux-musl
            asset_target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            archive: tar.gz
          - target: aarch64-unknown-linux-musl
            asset_target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            archive: tar.gz
            use_cross: true
          - target: x86_64-apple-darwin
            asset_target: x86_64-apple-darwin
            os: macos-latest
            archive: tar.gz
            macos_sign: true
          - target: aarch64-apple-darwin
            asset_target: aarch64-apple-darwin
            os: macos-latest
            archive: tar.gz
            macos_sign: true
          - target: x86_64-pc-windows-msvc
            asset_target: x86_64-pc-windows-msvc
            os: windows-latest
            archive: zip
          - target: aarch64-pc-windows-msvc
            asset_target: aarch64-pc-windows-msvc
            os: windows-latest
            archive: zip

    steps:
      - uses: actions/checkout@v4
        with:
          # For workflow_dispatch, build the requested tag rather than
          # whatever ref the workflow was dispatched from.
          ref: ${{ env.RELEASE_TAG }}

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      # x86_64 musl builds natively on the runner (build scripts, and
      # the phpstorm-stubs download they perform, run on the host with
      # normal network access). musl-gcc links ring's C code.
      - name: Install musl toolchain
        if: matrix.target == 'x86_64-unknown-linux-musl'
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools

      # aarch64 musl cannot build natively on an x86_64 runner, so it is
      # cross-compiled with cross inside a container.
      - name: Install cross
        if: matrix.use_cross
        uses: taiki-e/install-action@v2
        with:
          tool: cross

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}

      - name: Build
        shell: bash
        env:
          CARGO_PROFILE_RELEASE_LTO: "thin"
          # Embed the tag as the version explicitly; actions/checkout
          # fetches a shallow clone, so `git describe` may not see it.
          PHPANTOM_GIT_VERSION: ${{ env.RELEASE_TAG }}
        run: |
          if [ "${{ matrix.use_cross }}" = "true" ]; then
            cross build --release --target ${{ matrix.target }}
          else
            cargo build --release --target ${{ matrix.target }}
          fi

      # --- macOS: import certificate and sign the binary ---

      - name: Import Apple Developer ID certificate
        if: matrix.macos_sign
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          # Write the .p12 to disk
          echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12

          # Create a temporary keychain so we don't touch the login keychain
          security create-keychain -p actions-keychain phpantom.keychain
          security set-keychain-settings -lut 21600 phpantom.keychain
          security unlock-keychain -p actions-keychain phpantom.keychain

          # Import the certificate + private key
          security import certificate.p12 \
            -k phpantom.keychain \
            -P "$APPLE_CERTIFICATE_PASSWORD" \
            -T /usr/bin/codesign
          security list-keychain -d user -s phpantom.keychain

          # Allow codesign to use the key without a UI prompt
          security set-key-partition-list \
            -S apple-tool:,apple: \
            -k actions-keychain \
            phpantom.keychain

          rm certificate.p12

      - name: Sign binary (macOS)
        if: matrix.macos_sign
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          codesign \
            --keychain phpantom.keychain \
            --sign "$APPLE_SIGNING_IDENTITY" \
            --options runtime \
            --timestamp \
            --force \
            target/${{ matrix.target }}/release/phpantom_lsp

      - name: Notarize binary (macOS)
        if: matrix.macos_sign
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          # Zip just for submission — notarytool requires an archive
          ditto -c -k --keepParent \
            target/${{ matrix.target }}/release/phpantom_lsp \
            phpantom_lsp-notarize.zip

          xcrun notarytool submit phpantom_lsp-notarize.zip \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_ID_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait

          rm phpantom_lsp-notarize.zip

      - name: Delete temporary keychain
        if: matrix.macos_sign && always()
        run: |
          security delete-keychain phpantom.keychain || true

      # --- Package ---

      - name: Package (unix)
        if: matrix.archive == 'tar.gz'
        run: |
          cd target/${{ matrix.target }}/release
          tar czf ../../../phpantom_lsp-${{ matrix.asset_target }}.tar.gz phpantom_lsp
          cd ../../..

      - name: Package (windows)
        if: matrix.archive == 'zip'
        shell: pwsh
        run: |
          Compress-Archive `
            -Path "target/${{ matrix.target }}/release/phpantom_lsp.exe" `
            -DestinationPath "phpantom_lsp-${{ matrix.asset_target }}.zip"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: phpantom_lsp-${{ matrix.asset_target }}
          path: phpantom_lsp-${{ matrix.asset_target }}.${{ matrix.archive }}

  # The WebAssembly module for in-browser hosts (see docs/wasm.md). Kept out
  # of the matrix above: it needs none of the signing, cross-compilation, or
  # musl setup those targets carry, and it ships a library rather than an
  # executable.
  wasm:
    name: Build wasm32-wasip1
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ env.RELEASE_TAG }}

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-wasip1

      - uses: Swatinem/rust-cache@v2
        with:
          key: wasm32-wasip1

      - name: Build
        env:
          PHPANTOM_GIT_VERSION: ${{ env.RELEASE_TAG }}
        run: |
          cargo rustc --lib --crate-type cdylib \
            --profile wasm-release --target wasm32-wasip1

      - uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Smoke-test the wasm reactor
        run: node scripts/wasm-smoke-test.mjs

      - name: Package
        run: |
          tar czf phpantom_lsp-wasm32-wasip1.tar.gz \
            -C target/wasm32-wasip1/wasm-release phpantom_lsp.wasm

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: phpantom_lsp-wasm32-wasip1
          path: phpantom_lsp-wasm32-wasip1.tar.gz

  release:
    name: Attach assets to draft
    needs: [build, wasm]
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Attach assets to the draft release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: |
          tag="$RELEASE_TAG"
          # If a draft with this tag name already exists (e.g. written
          # by hand on the website before pushing the tag), attach the
          # assets to it without touching its notes. Otherwise create a
          # fresh draft with auto-generated notes. A release that is
          # already published is immutable; fail loudly in that case.
          if gh release view "$tag" --json isDraft --jq .isDraft > /tmp/is_draft 2>/dev/null; then
            if [ "$(cat /tmp/is_draft)" != "true" ]; then
              echo "::error::Release $tag is already published and immutable; assets cannot be attached." >&2
              exit 1
            fi
            echo "Uploading assets to existing draft $tag"
            gh release upload "$tag" artifacts/* --clobber
          else
            echo "Creating draft release $tag"
            gh release create "$tag" artifacts/* \
              --draft --verify-tag --title "$tag" --generate-notes
          fi