build.yml

name: build

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            target: aarch64-apple-darwin
            name: runctl-macos-arm64
          - os: macos-latest
            target: x86_64-apple-darwin
            name: runctl-macos-x64
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            name: runctl-windows-x64
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Build
        run: cargo build --release --target ${{ matrix.target }}

      # NOTE: macOS distribution needs codesign + notarization to clear
      # Gatekeeper, and Windows benefits from Authenticode signing to reduce
      # SmartScreen prompts. Both are intentionally left out here — add them
      # before packaging when you publish with your signing identities.

      - name: Package
        shell: bash
        run: |
          mkdir -p dist staging
          cp README.md LICENSE staging/
          if [ "${{ runner.os }}" = "Windows" ]; then
            cp "target/${{ matrix.target }}/release/runctl.exe" staging/
            7z a "dist/${{ matrix.name }}.zip" ./staging/*
          else
            cp "target/${{ matrix.target }}/release/runctl" staging/
            tar -czf "dist/${{ matrix.name }}.tar.gz" -C staging .
          fi

      - name: Checksum
        shell: bash
        run: |
          cd dist
          for f in *; do
            if command -v shasum >/dev/null; then
              shasum -a 256 "$f" > "$f.sha256"
            else
              sha256sum "$f" > "$f.sha256"
            fi
          done

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.name }}
          path: dist/*

  release:
    needs: build
    runs-on: ubuntu-latest
    # Publish on a tag push or a manual run; the tag is derived from the
    # version in Cargo.toml (the same one `runctl --version` reports).
    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4

      - name: Resolve version tag
        id: ver
        shell: bash
        run: |
          version=$(grep -m1 '^version = ' Cargo.toml | sed -E 's/.*"(.*)".*/\1/')
          [ -n "$version" ] || { echo "could not read version from Cargo.toml"; exit 1; }
          echo "tag=v$version" >> "$GITHUB_OUTPUT"
          echo "Release tag: v$version"

      - uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.ver.outputs.tag }}
          files: artifacts/**/*
          generate_release_notes: true