release.yml

name: release

on:
  push:
    branches:
      - "main"
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      publish_npm:
        description: "Publish TypeScript SDK to npm"
        required: false
        default: true
        type: boolean
      publish_crate_nexis_wasm_plugin:
        description: "Publish nexis_wasm_plugin crate to crates.io"
        required: false
        default: true
        type: boolean
      publish_images:
        description: "Build and publish Docker images to GHCR"
        required: false
        default: true
        type: boolean

permissions:
  contents: read

env:
  BUN_VERSION: 1.3.9
  IMAGE_NAMESPACE: ghcr.io/${{ github.repository_owner }}

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      sdk_ts: ${{ steps.set.outputs.sdk_ts }}
      crate_nexis_wasm_plugin: ${{ steps.set.outputs.crate_nexis_wasm_plugin }}
      image_rust_server: ${{ steps.set.outputs.image_rust_server }}
      image_control_api: ${{ steps.set.outputs.image_control_api }}
      image_dashboard_ui: ${{ steps.set.outputs.image_dashboard_ui }}
      image_web_demo: ${{ steps.set.outputs.image_web_demo }}
      any_images: ${{ steps.set.outputs.any_images }}
    steps:
      - uses: actions/checkout@v4
      - id: filter
        if: github.ref == 'refs/heads/main'
        uses: dorny/paths-filter@v3
        with:
          filters: |
            sdk_ts:
              - 'sdks/ts/**'
            crate_nexis_wasm_plugin:
              - 'plugins/rust/nexis_wasm_plugin/**'
            image_rust_server:
              - 'server/**'
              - 'plugins/**'
              - 'examples/wasm-plugins/**'
            image_control_api:
              - 'dashboard/control-api/**'
            image_dashboard_ui:
              - 'dashboard/ui/**'
            image_web_demo:
              - 'examples/web-demo/**'
              - 'sdks/ts/**'
      - id: set
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/v* ]] || [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
            sdk_ts=true
            crate_nexis_wasm_plugin=true
            image_rust_server=true
            image_control_api=true
            image_dashboard_ui=true
            image_web_demo=true
          else
            sdk_ts="${{ steps.filter.outputs.sdk_ts }}"
            crate_nexis_wasm_plugin="${{ steps.filter.outputs.crate_nexis_wasm_plugin }}"
            image_rust_server="${{ steps.filter.outputs.image_rust_server }}"
            image_control_api="${{ steps.filter.outputs.image_control_api }}"
            image_dashboard_ui="${{ steps.filter.outputs.image_dashboard_ui }}"
            image_web_demo="${{ steps.filter.outputs.image_web_demo }}"
          fi

          any_images=false
          if [[ "${image_rust_server}" == "true" ]] || [[ "${image_control_api}" == "true" ]] || [[ "${image_dashboard_ui}" == "true" ]] || [[ "${image_web_demo}" == "true" ]]; then
            any_images=true
          fi

          echo "sdk_ts=${sdk_ts}" >> "$GITHUB_OUTPUT"
          echo "crate_nexis_wasm_plugin=${crate_nexis_wasm_plugin}" >> "$GITHUB_OUTPUT"
          echo "image_rust_server=${image_rust_server}" >> "$GITHUB_OUTPUT"
          echo "image_control_api=${image_control_api}" >> "$GITHUB_OUTPUT"
          echo "image_dashboard_ui=${image_dashboard_ui}" >> "$GITHUB_OUTPUT"
          echo "image_web_demo=${image_web_demo}" >> "$GITHUB_OUTPUT"
          echo "any_images=${any_images}" >> "$GITHUB_OUTPUT"

  validate:
    needs: changes
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.89.0
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - name: Rust tests
        working-directory: server
        run: cargo test
      - name: SDK install
        working-directory: sdks/ts
        run: bun install --frozen-lockfile
      - name: SDK tests
        working-directory: sdks/ts
        run: bun test
      - name: SDK typecheck
        working-directory: sdks/ts
        run: bunx tsc -p tsconfig.json --noEmit
      - name: Control API install
        working-directory: dashboard/control-api
        run: bun install --frozen-lockfile
      - name: Control API tests
        working-directory: dashboard/control-api
        run: bun test
      - name: Control API typecheck
        working-directory: dashboard/control-api
        run: bunx tsc --noEmit

  publish-image-rust-server:
    needs: [changes, validate]
    if: (github.event_name == 'push' || inputs.publish_images == true) && needs.changes.outputs.image_rust_server == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Determine release channel
        id: channel
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            echo "channel=stable" >> "$GITHUB_OUTPUT"
          else
            echo "channel=next" >> "$GITHUB_OUTPUT"
          fi
      - name: Compute image tags
        id: tags
        run: |
          if [[ "${{ steps.channel.outputs.channel }}" == "stable" ]]; then
            echo "primary=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
            echo "secondary=latest" >> "$GITHUB_OUTPUT"
          else
            short_sha="${GITHUB_SHA::7}"
            echo "primary=next" >> "$GITHUB_OUTPUT"
            echo "secondary=sha-${short_sha}" >> "$GITHUB_OUTPUT"
          fi
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE_NAMESPACE }}/rust-server
          tags: |
            type=raw,value=${{ steps.tags.outputs.primary }}
            type=raw,value=${{ steps.tags.outputs.secondary }}
      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: server/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  publish-image-control-api:
    needs: [changes, validate]
    if: (github.event_name == 'push' || inputs.publish_images == true) && needs.changes.outputs.image_control_api == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Determine release channel
        id: channel
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            echo "channel=stable" >> "$GITHUB_OUTPUT"
          else
            echo "channel=next" >> "$GITHUB_OUTPUT"
          fi
      - name: Compute image tags
        id: tags
        run: |
          if [[ "${{ steps.channel.outputs.channel }}" == "stable" ]]; then
            echo "primary=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
            echo "secondary=latest" >> "$GITHUB_OUTPUT"
          else
            short_sha="${GITHUB_SHA::7}"
            echo "primary=next" >> "$GITHUB_OUTPUT"
            echo "secondary=sha-${short_sha}" >> "$GITHUB_OUTPUT"
          fi
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE_NAMESPACE }}/control-api
          tags: |
            type=raw,value=${{ steps.tags.outputs.primary }}
            type=raw,value=${{ steps.tags.outputs.secondary }}
      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: dashboard/control-api/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  publish-image-dashboard-ui:
    needs: [changes, validate]
    if: (github.event_name == 'push' || inputs.publish_images == true) && needs.changes.outputs.image_dashboard_ui == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Determine release channel
        id: channel
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            echo "channel=stable" >> "$GITHUB_OUTPUT"
          else
            echo "channel=next" >> "$GITHUB_OUTPUT"
          fi
      - name: Compute image tags
        id: tags
        run: |
          if [[ "${{ steps.channel.outputs.channel }}" == "stable" ]]; then
            echo "primary=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
            echo "secondary=latest" >> "$GITHUB_OUTPUT"
          else
            short_sha="${GITHUB_SHA::7}"
            echo "primary=next" >> "$GITHUB_OUTPUT"
            echo "secondary=sha-${short_sha}" >> "$GITHUB_OUTPUT"
          fi
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE_NAMESPACE }}/dashboard-ui
          tags: |
            type=raw,value=${{ steps.tags.outputs.primary }}
            type=raw,value=${{ steps.tags.outputs.secondary }}
      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: dashboard/ui/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  publish-image-web-demo:
    needs: [changes, validate]
    if: (github.event_name == 'push' || inputs.publish_images == true) && needs.changes.outputs.image_web_demo == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Determine release channel
        id: channel
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            echo "channel=stable" >> "$GITHUB_OUTPUT"
          else
            echo "channel=next" >> "$GITHUB_OUTPUT"
          fi
      - name: Compute image tags
        id: tags
        run: |
          if [[ "${{ steps.channel.outputs.channel }}" == "stable" ]]; then
            echo "primary=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
            echo "secondary=latest" >> "$GITHUB_OUTPUT"
          else
            short_sha="${GITHUB_SHA::7}"
            echo "primary=next" >> "$GITHUB_OUTPUT"
            echo "secondary=sha-${short_sha}" >> "$GITHUB_OUTPUT"
          fi
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE_NAMESPACE }}/web-demo
          tags: |
            type=raw,value=${{ steps.tags.outputs.primary }}
            type=raw,value=${{ steps.tags.outputs.secondary }}
      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: examples/web-demo/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  publish-sdk-npm:
    needs: [changes, validate]
    if: (github.event_name == 'push' || inputs.publish_npm == true) && needs.changes.outputs.sdk_ts == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - name: Determine npm dist-tag
        id: npm_tag
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            echo "tag=latest" >> "$GITHUB_OUTPUT"
            echo "channel=stable" >> "$GITHUB_OUTPUT"
          else
            echo "tag=next" >> "$GITHUB_OUTPUT"
            echo "channel=next" >> "$GITHUB_OUTPUT"
          fi
      - uses: actions/setup-node@v4
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - name: Install SDK deps
        working-directory: sdks/ts
        run: bun install --frozen-lockfile
      - name: Test SDK
        working-directory: sdks/ts
        run: bun test
      - name: Typecheck SDK
        working-directory: sdks/ts
        run: bunx tsc -p tsconfig.json --noEmit
      - name: Set prerelease version for next channel
        if: steps.npm_tag.outputs.channel == 'next'
        working-directory: sdks/ts
        run: |
          node <<'NODE'
          const fs = require("fs");
          const p = "package.json";
          const j = JSON.parse(fs.readFileSync(p, "utf8"));
          const base = String(j.version).split("-")[0];
          const sha = String(process.env.GITHUB_SHA || "dev").slice(0, 7);
          j.version = `${base}-next.${sha}`;
          fs.writeFileSync(p, `${JSON.stringify(j, null, 2)}\n`);
          console.log("Publishing version", j.version);
          NODE
      - name: Publish SDK to npm
        working-directory: sdks/ts
        run: npm publish --access public --provenance --tag ${{ steps.npm_tag.outputs.tag }}

  publish-crate-nexis-wasm-plugin:
    needs: [changes, validate]
    if: startsWith(github.ref, 'refs/tags/v') && (github.event_name == 'push' || inputs.publish_crate_nexis_wasm_plugin == true) && needs.changes.outputs.crate_nexis_wasm_plugin == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    environment: release
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.89.0
      - name: Read crate version
        id: crate
        shell: bash
        run: |
          version="$(grep -m1 '^version = ' plugins/rust/nexis_wasm_plugin/Cargo.toml | sed -E 's/version = \"([^\"]+)\"/\1/')"
          echo "version=${version}" >> "$GITHUB_OUTPUT"
      - name: Check if crate version already exists on crates.io
        id: exists
        shell: bash
        run: |
          if curl -fsS "https://crates.io/api/v1/crates/nexis_wasm_plugin/${{ steps.crate.outputs.version }}" > /dev/null; then
            echo "already_published=true" >> "$GITHUB_OUTPUT"
            echo "nexis_wasm_plugin@${{ steps.crate.outputs.version }} is already published."
          else
            echo "already_published=false" >> "$GITHUB_OUTPUT"
          fi
      - name: Dry-run publish
        if: steps.exists.outputs.already_published != 'true'
        run: cargo publish --dry-run --manifest-path plugins/rust/nexis_wasm_plugin/Cargo.toml
      - name: Authenticate with crates.io (trusted publishing)
        if: steps.exists.outputs.already_published != 'true'
        id: auth
        uses: rust-lang/crates-io-auth-action@v1
      - name: Publish crate to crates.io
        if: steps.exists.outputs.already_published != 'true'
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
        run: cargo publish --manifest-path plugins/rust/nexis_wasm_plugin/Cargo.toml

  build-rust-server-binary:
    needs: validate
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            label: linux-x86_64
            ext: ""
            archive_ext: tar.gz
          - os: macos-latest
            label: macos-x86_64
            ext: ""
            archive_ext: tar.gz
          - os: windows-latest
            label: windows-x86_64
            ext: ".exe"
            archive_ext: zip
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@1.89.0
      - name: Build rust-server
        working-directory: server
        run: cargo build --release -p transport_ws
      - name: Package rust-server (unix)
        if: runner.os != 'Windows'
        shell: bash
        run: |
          mkdir -p dist
          cp "server/target/release/transport_ws${{ matrix.ext }}" dist/nexis-rust-server${{ matrix.ext }}
          tar -czf "nexis-rust-server-${{ matrix.label }}.${{ matrix.archive_ext }}" -C dist .
      - name: Package rust-server (windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Path dist -Force | Out-Null
          Copy-Item "server/target/release/transport_ws${{ matrix.ext }}" "dist/nexis-rust-server${{ matrix.ext }}"
          Compress-Archive -Path "dist/*" -DestinationPath "nexis-rust-server-${{ matrix.label }}.${{ matrix.archive_ext }}" -Force
      - name: Upload rust-server artifact
        uses: actions/upload-artifact@v4
        with:
          name: rust-server-${{ matrix.label }}
          path: nexis-rust-server-${{ matrix.label }}.${{ matrix.archive_ext }}
          if-no-files-found: error

  build-control-api-binary:
    needs: validate
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            label: linux-x86_64
            ext: ""
            archive_ext: tar.gz
          - os: macos-latest
            label: macos-x86_64
            ext: ""
            archive_ext: tar.gz
          - os: windows-latest
            label: windows-x86_64
            ext: ".exe"
            archive_ext: zip
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - name: Install control-api deps
        working-directory: dashboard/control-api
        run: bun install --frozen-lockfile
      - name: Build control-api binary
        working-directory: dashboard/control-api
        run: bun build src/index.ts --compile --outfile control-api${{ matrix.ext }}
      - name: Package control-api (unix)
        if: runner.os != 'Windows'
        shell: bash
        run: |
          mkdir -p dist
          cp "dashboard/control-api/control-api${{ matrix.ext }}" dist/nexis-control-api${{ matrix.ext }}
          cp -R "dashboard/control-api/drizzle" dist/drizzle
          tar -czf "nexis-control-api-${{ matrix.label }}.${{ matrix.archive_ext }}" -C dist .
      - name: Package control-api (windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Path dist -Force | Out-Null
          Copy-Item "dashboard/control-api/control-api${{ matrix.ext }}" "dist/nexis-control-api${{ matrix.ext }}"
          Copy-Item -Recurse "dashboard/control-api/drizzle" "dist/drizzle"
          Compress-Archive -Path "dist/*" -DestinationPath "nexis-control-api-${{ matrix.label }}.${{ matrix.archive_ext }}" -Force
      - name: Upload control-api artifact
        uses: actions/upload-artifact@v4
        with:
          name: control-api-${{ matrix.label }}
          path: nexis-control-api-${{ matrix.label }}.${{ matrix.archive_ext }}
          if-no-files-found: error

  publish-release-assets:
    needs: [build-rust-server-binary, build-control-api-binary]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download rust-server artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: rust-server-*
          path: release-artifacts
          merge-multiple: true
      - name: Download control-api artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: control-api-*
          path: release-artifacts
          merge-multiple: true
      - name: Verify release assets
        shell: bash
        run: |
          ls -lah release-artifacts || true
          count="$(find release-artifacts -type f | wc -l | tr -d ' ')"
          if [[ "${count}" == "0" ]]; then
            echo "No release assets downloaded" >&2
            exit 1
          fi
      - name: Publish GitHub release assets
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          generate_release_notes: true
          files: |
            release-artifacts/**