name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            # Build on Ubuntu 22.04 so the Linux release binary works on
            # common LTS servers with glibc 2.35 instead of requiring the
            # newer glibc shipped by ubuntu-latest.
            os: ubuntu-22.04
            name: obscura-x86_64-linux
          - target: aarch64-unknown-linux-gnu
            # Native build on GitHub's ARM runner.
            os: ubuntu-22.04-arm
            name: obscura-aarch64-linux
          - target: aarch64-apple-darwin
            os: macos-latest
            name: obscura-aarch64-macos
          - target: x86_64-apple-darwin
            # Must run on a native Intel runner. obscura-js bakes a V8 startup
            # snapshot at build time, and that snapshot is architecture specific.
            # macos-latest is Apple Silicon, so building x86_64 there embeds an
            # arm64 snapshot into the Intel binary and V8 crashes deserializing
            # it at isolate init (issue #290). macos-15-intel is the last x86_64
            # image (available until Aug 2027); there is no cross-build that
            # produces a correct snapshot.
            os: macos-15-intel
            name: obscura-x86_64-macos
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            name: obscura-x86_64-windows

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Build
        run: cargo build --release --target ${{ matrix.target }}

      - name: Build stealth
        run: cargo build --release --target ${{ matrix.target }} --features stealth
        continue-on-error: true

      - name: Smoke test (V8 snapshot)
        # Run the V8 path once so a release never ships a binary that crashes at
        # isolate init from a mismatched snapshot (issue #290). The data: URL
        # keeps it offline. Every target here is native, so the runner can
        # execute what it just built.
        shell: bash
        run: |
          BIN=target/${{ matrix.target }}/release/obscura
          [ -f "$BIN.exe" ] && BIN="$BIN.exe"
          "$BIN" fetch "data:text/html,<title>ok</title>" --eval "1+1"

      - name: Package (Unix)
        if: runner.os != 'Windows'
        run: |
          cd target/${{ matrix.target }}/release
          tar czf ../../../${{ matrix.name }}.tar.gz obscura obscura-worker
          cd ../../..

      - name: Package (Windows)
        if: runner.os == 'Windows'
        run: |
          cd target/${{ matrix.target }}/release
          7z a ../../../${{ matrix.name }}.zip obscura.exe obscura-worker.exe
          cd ../../..

      - name: Upload
        uses: softprops/action-gh-release@v2
        with:
          files: |
            ${{ matrix.name }}.tar.gz
            ${{ matrix.name }}.zip