release.yml

name: Release

on:
  push:
    tags: ["v*"]

permissions:
  contents: write
  id-token: write
  attestations: write

jobs:
  validate:
    name: Validate release tag
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install Racket
        uses: Bogdanp/setup-racket@v1.15
        with:
          version: stable
          distribution: full
      - name: Check tag matches rivet.rktd and CHANGELOG
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          VERSION=$(racket -e '(begin (require racket/file) (hash-ref (file->value "rivet.rktd") (quote version) #f))' | tr -d '"')
          echo "tag=$TAG rivet.rktd=$VERSION"
          test "$TAG" = "$VERSION" || { echo "::error::tag $TAG != rivet.rktd version $VERSION"; exit 1; }
          grep -q "^## \[$TAG\]" CHANGELOG.md || { echo "::error::CHANGELOG.md has no '[$TAG]' section"; exit 1; }

  macos:
    name: macOS DMG
    needs: validate
    runs-on: macos-15
    # Independent of the publish job: uploads the DMG itself (see release).
    steps:
      - uses: actions/checkout@v4
      - name: Checkout Rivet
        uses: actions/checkout@v4
        with:
          repository: turinglambdaai/rivet
          path: rivet
      - name: Install Racket
        uses: Bogdanp/setup-racket@v1.15
        with:
          architecture: arm64
          version: stable
          distribution: full
      - name: Install crypto package (rivet/distribution dependency)
        run: raco pkg install --auto --no-docs crypto
        shell: bash
      - name: Link Rivet
        run: raco pkg install --auto --no-docs --link "$GITHUB_WORKSPACE/rivet/rivet" "$GITHUB_WORKSPACE/rivet/rivet-cli"
      - name: Package
        run: raco rivet package
      - name: Human installer (DMG)
        run: |
          hdiutil create -volname BrainFuel -srcfolder dist/brainfuel.app -ov -format UDZO \
            "BrainFuel-${{ github.ref_name }}-macos.dmg"
      - name: Upload DMG to the release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          for attempt in 1 2 3 4 5; do
            if gh release view "${{ github.ref_name }}" -R turinglambdaai/brainfuel >/dev/null 2>&1; then
              gh release upload "${{ github.ref_name }}" "BrainFuel-${{ github.ref_name }}-macos.dmg" --clobber -R turinglambdaai/brainfuel
              exit 0
            fi
            sleep 300
          done
          echo "::error::release ${{ github.ref_name }} never appeared; upload the DMG manually" >&2
          exit 1
      - uses: actions/upload-artifact@v4
        with:
          name: macos
          path: BrainFuel-*-macos.dmg
          if-no-files-found: error

  windows:
    name: Windows MSI
    needs: validate
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - name: Checkout Rivet
        uses: actions/checkout@v4
        with:
          repository: turinglambdaai/rivet
          path: rivet
      - name: Install Racket
        uses: Bogdanp/setup-racket@v1.15
        with:
          version: stable
          distribution: full
      - name: Install crypto package (rivet/distribution dependency)
        run: raco pkg install --auto --no-docs crypto
        shell: bash
      - name: Link Rivet
        run: raco pkg install --auto --no-docs --link "$GITHUB_WORKSPACE/rivet/rivet" "$GITHUB_WORKSPACE/rivet/rivet-cli"
        shell: bash
      - name: Install WiX (v5; v7 requires EULA acceptance, v5 runs the v4 schema)
        run: dotnet tool install --global wix --version 5.0.2
        shell: bash
      - name: Release + MSI (development-strength signing; production trust rides on the update feed)
        env:
          RIVET_UPDATE_BASE_URL: https://github.com/turinglambdaai/brainfuel/releases/download/${{ github.ref_name }}
          RIVET_UPDATE_KEY_ID: brainfuel-2026-10
          RIVET_UPDATE_PRIVATE_KEY_B64: ${{ secrets.UPDATE_ED25519_PRIVATE_KEY_B64 }}
        run: |
          KEY_DER="$(mktemp -d)/update-ed25519-private.der"
          printf '%s' "$RIVET_UPDATE_PRIVATE_KEY_B64" | base64 -d > "$KEY_DER"
          export RIVET_UPDATE_PRIVATE_KEY="$KEY_DER"
          raco rivet release --development
          rm -f "$KEY_DER"
        shell: bash
      - name: Collect MSI
        run: |
          mv dist/*.msi "brainfuel-${GITHUB_REF_NAME#v}-windows-x64.msi"
          mv dist/update-stable.json update-stable-windows.json
        shell: bash
      - uses: actions/upload-artifact@v4
        with:
          name: windows
          path: |
            brainfuel-*-windows-x64.msi
            update-stable-windows.json
          if-no-files-found: error

  linux:
    name: Linux tar.gz
    needs: validate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Checkout Rivet
        uses: actions/checkout@v4
        with:
          repository: turinglambdaai/rivet
          path: rivet
      - name: Cache embedded Racket CS build
        id: cache-racket-embed
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/racket-embed
          key: racket-embed-9.3-linux-v1
          save-always: true
      - name: Build full Racket CS 9.3 from pinned source
        if: steps.cache-racket-embed.outputs.cache-hit != 'true'
        run: |
          set -euo pipefail
          archive="$RUNNER_TEMP/racket-minimal-9.3-src-builtpkgs.tgz"
          source_root="$RUNNER_TEMP/racket-9.3"
          build_root="$RUNNER_TEMP/racket-embed-build"
          embed_prefix="$RUNNER_TEMP/racket-embed"

          curl --fail --location --retry 3 \
            --output "$archive" \
            https://download.racket-lang.org/releases/9.3/installers/racket-minimal-9.3-src-builtpkgs.tgz
          echo "3a01324d559a15e3f1f58b0c57a92bb344dce534e72e564e0d8b75e3b9c65295  $archive" |
            sha256sum --check
          tar -xzf "$archive" -C "$RUNNER_TEMP"
          mkdir -p "$build_root"
          cd "$build_root"
          "$source_root/src/configure" --prefix="$embed_prefix"
          make -j2
          make install
      - name: Install GTK4 development files
        run: |
          sudo apt-get update
          sudo apt-get install --yes libgtk-4-dev
      - name: Link Rivet + provide raco ctool
        run: |
          echo "$RUNNER_TEMP/racket-embed/bin" >> "$GITHUB_PATH"
          export PATH="$RUNNER_TEMP/racket-embed/bin:$PATH"
          # crypto first: rivet's own setup compiles rivet/distribution.
          raco pkg install --auto --no-docs crypto
          raco pkg install --auto --no-docs --link "$GITHUB_WORKSPACE/rivet/rivet" "$GITHUB_WORKSPACE/rivet/rivet-cli"
          # The minimal source build ships no cext-lib; raco ctool — which
          # compiles the backend bundle — lives there.
          raco pkg install --auto --no-docs cext-lib
      - name: Release (development-strength signing; production trust rides on the update feed)
        env:
          RIVET_UPDATE_BASE_URL: https://github.com/turinglambdaai/brainfuel/releases/download/${{ github.ref_name }}
          RIVET_UPDATE_KEY_ID: brainfuel-2026-10
          RIVET_UPDATE_PRIVATE_KEY_B64: ${{ secrets.UPDATE_ED25519_PRIVATE_KEY_B64 }}
          RIVET_RACKET_INCLUDE: ${{ runner.temp }}/racket-embed/include/racket
        run: |
          set -euo pipefail
          export PATH="$RUNNER_TEMP/racket-embed/bin:$PATH"
          racket_include="$RIVET_RACKET_INCLUDE"
          racket_library="$(find "$RUNNER_TEMP/racket-embed" -name 'libracketcs*.a' -print -quit)"
          petite_boot="$(find "$RUNNER_TEMP/racket-embed" -name petite.boot -print -quit)"
          for artifact in "$racket_include" "$racket_library" "$petite_boot"; do
            if [[ -z "$artifact" ]]; then
              echo "embedded Racket CS artifact not found" >&2
              exit 1
            fi
          done
          export RIVET_RACKET_LIBRARY="$racket_library"
          export RIVET_RACKET_BOOT_DIR="$(dirname "$petite_boot")"

          KEY_DER="$(mktemp -d)/update-ed25519-private.der"
          printf '%s' "$RIVET_UPDATE_PRIVATE_KEY_B64" | base64 -d > "$KEY_DER"
          export RIVET_UPDATE_PRIVATE_KEY="$KEY_DER"
          raco rivet release --development
          rm -f "$KEY_DER"
      - name: Collect tar.gz
        run: |
          mv dist/*.tar.gz "brainfuel-${GITHUB_REF_NAME#v}-linux-x64.tar.gz"
          if [ -f dist/update-stable.json ]; then
            mv dist/update-stable.json update-stable-linux.json
          fi
      - uses: actions/upload-artifact@v4
        with:
          name: linux
          path: |
            brainfuel-*-linux-x64.tar.gz
            update-stable-linux.json
          if-no-files-found: warn

  release:
    name: Sign manifest + publish
    # The macOS runner pool periodically stalls for hours; publish without
    # it — the manifest script skips the missing DMG entry — and the macOS
    # job uploads the DMG to the same release whenever a runner frees up.
    needs: [windows, linux]
    runs-on: macos-15
    steps:
      - uses: actions/checkout@v4
      - name: Checkout Rivet
        uses: actions/checkout@v4
        with:
          repository: turinglambdaai/rivet
          path: rivet
      - uses: actions/download-artifact@v4
        with:
          path: dist
      - name: Install Racket
        uses: Bogdanp/setup-racket@v1.15
        with:
          architecture: arm64
          version: stable
          distribution: full
      - name: Install crypto package (rivet/distribution dependency)
        run: raco pkg install --auto --no-docs crypto
        shell: bash
      - name: Link Rivet
        run: raco pkg install --auto --no-docs --link "$GITHUB_WORKSPACE/rivet/rivet" "$GITHUB_WORKSPACE/rivet/rivet-cli"
      - name: Flatten artifact dirs
        run: |
          find dist -mindepth 2 -maxdepth 2 -type f -exec mv {} dist/ \;
          find dist -mindepth 1 -maxdepth 1 -type d -empty -delete
          ls -la dist/
      - name: Generate + sign update manifest
        env:
          UPDATE_ED25519_PRIVATE_KEY_B64: ${{ secrets.UPDATE_ED25519_PRIVATE_KEY_B64 }}
        run: |
          KEY_DER="$(mktemp -d)/update-ed25519-private.der"
          printf '%s' "$UPDATE_ED25519_PRIVATE_KEY_B64" | base64 -d > "$KEY_DER"
          bash scripts/make-update-manifest.sh "${{ github.ref_name }}" dist "$KEY_DER"
          rm -f "$KEY_DER"
      - name: Ensure SHA256SUMS
        run: |
          cd dist
          [ -f SHA256SUMS ] || {
            find . -maxdepth 1 -type f ! -name SHA256SUMS -print0 | sort -z | xargs -0 shasum -a 256 > SHA256SUMS
          }
          shasum -a 256 --check SHA256SUMS
      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if gh release view "${{ github.ref_name }}" -R turinglambdaai/brainfuel >/dev/null 2>&1; then
            gh release upload "${{ github.ref_name }}" dist/* --clobber -R turinglambdaai/brainfuel
          else
            gh release create "${{ github.ref_name }}" dist/* \
              -R turinglambdaai/brainfuel \
              --title "BrainFuel ${{ github.ref_name }}" \
              --generate-notes
          fi
      - name: Attest build provenance
        uses: actions/attest-build-provenance@v1
        with:
          subject-path: dist/*