name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            # Build on Ubuntu 22.04 so the Linux release binary works on
            # common LTS servers with glibc 2.35 instead of requiring the
            # newer glibc shipped by ubuntu-latest.
            os: ubuntu-22.04
            name: obscura-x86_64-linux
          - target: aarch64-unknown-linux-gnu
            # Native build on GitHub's ARM runner.
            os: ubuntu-22.04-arm
            name: obscura-aarch64-linux
          - target: aarch64-apple-darwin
            os: macos-latest
            name: obscura-aarch64-macos
          - target: x86_64-apple-darwin
            # Must run on a native Intel runner. obscura-js bakes a V8 startup
            # snapshot at build time, and that snapshot is architecture specific.
            # macos-latest is Apple Silicon, so building x86_64 there embeds an
            # arm64 snapshot into the Intel binary and V8 crashes deserializing
            # it at isolate init (issue #290). macos-15-intel is the last x86_64
            # image (available until Aug 2027); there is no cross-build that
            # produces a correct snapshot.
            os: macos-15-intel
            name: obscura-x86_64-macos
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            name: obscura-x86_64-windows

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install stealth build dependencies (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y cmake clang libclang-dev llvm-dev

      - name: Configure libclang (macOS)
        if: runner.os == 'macOS'
        shell: bash
        run: |
          # Use one coherent SDK. A hard-coded CommandLineTools include path can
          # mix libc++ headers with the selected Xcode SDK and break BoringSSL.
          XCODE_PATH="$(xcode-select -p)"
          SDK_PATH="$(xcrun --show-sdk-path)"
          echo "SDKROOT=$SDK_PATH" >> "$GITHUB_ENV"
          echo "CXXFLAGS=-isystem $SDK_PATH/usr/include/c++/v1" >> "$GITHUB_ENV"
          echo "LIBCLANG_PATH=$XCODE_PATH/Toolchains/XcodeDefault.xctoolchain/usr/lib" >> "$GITHUB_ENV"

      - name: Configure libclang (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          "LIBCLANG_PATH=C:\Program Files\LLVM\bin" | Out-File -FilePath $env:GITHUB_ENV -Append

      - name: Build default release binary
        run: cargo build --release --target ${{ matrix.target }}

      - name: Stage default release binary
        shell: bash
        run: |
          BIN_DIR=target/${{ matrix.target }}/release
          mkdir -p dist/default
          if [ -f "$BIN_DIR/obscura.exe" ]; then
            cp "$BIN_DIR/obscura.exe" "$BIN_DIR/obscura-worker.exe" dist/default/
          else
            cp "$BIN_DIR/obscura" "$BIN_DIR/obscura-worker" dist/default/
          fi

      # Build and package stealth separately so the default download keeps its
      # lower RSS while the advertised wreq/BoringSSL variant cannot silently
      # fall back to a non-stealth binary.
      - name: Build stealth release binary
        run: cargo build --release --target ${{ matrix.target }} --features stealth

      - name: Stage stealth release binary
        shell: bash
        run: |
          BIN_DIR=target/${{ matrix.target }}/release
          mkdir -p dist/stealth
          if [ -f "$BIN_DIR/obscura.exe" ]; then
            cp "$BIN_DIR/obscura.exe" "$BIN_DIR/obscura-worker.exe" dist/stealth/
          else
            cp "$BIN_DIR/obscura" "$BIN_DIR/obscura-worker" dist/stealth/
          fi

      - name: Smoke test release binaries (V8 snapshot)
        # Run the V8 path once so a release never ships a binary that crashes at
        # isolate init from a mismatched snapshot (issue #290). The data: URL
        # keeps it offline. Every target here is native, so the runner can
        # execute both variants it just built.
        shell: bash
        run: |
          for VARIANT in default stealth; do
            BIN=dist/$VARIANT/obscura
            [ -f "$BIN.exe" ] && BIN="$BIN.exe"
            "$BIN" fetch "data:text/html,<title>ok</title>" --eval "1+1"
          done

      - name: Package (Unix)
        if: runner.os != 'Windows'
        run: |
          tar czf ${{ matrix.name }}.tar.gz -C dist/default obscura obscura-worker
          tar czf ${{ matrix.name }}-stealth.tar.gz -C dist/stealth obscura obscura-worker

      - name: Package (Windows)
        if: runner.os == 'Windows'
        run: |
          cd dist/default
          7z a ../../${{ matrix.name }}.zip obscura.exe obscura-worker.exe
          cd ../stealth
          7z a ../../${{ matrix.name }}-stealth.zip obscura.exe obscura-worker.exe

      - name: Upload
        uses: softprops/action-gh-release@v2
        with:
          files: |
            ${{ matrix.name }}.tar.gz
            ${{ matrix.name }}-stealth.tar.gz
            ${{ matrix.name }}.zip
            ${{ matrix.name }}-stealth.zip