fx/.github/workflows/dev-release.yml

name: Dev Release

on:
  workflow_run:
    workflows: [CI]
    types: [completed]
    branches: [main]

permissions:
  contents: read

concurrency:
  group: dev-release
  cancel-in-progress: true

jobs:
  build:
    if: >-
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'push' &&
      github.event.workflow_run.head_repository.full_name == github.repository
    name: Build ${{ matrix.name }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux-x86_64
            target: x86_64-linux
          - name: linux-aarch64
            target: aarch64-linux
          - name: macos-x86_64
            target: x86_64-macos
          - name: macos-aarch64
            target: aarch64-macos
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_sha }}

      - name: Setup Zig
        uses: mlugg/setup-zig@v2
        with:
          version: "0.16.0"

      - name: Build dev binary
        run: zig build -Doptimize=ReleaseSafe -Dtarget=${{ matrix.target }} -Dupdate-channel=dev

      - name: Package
        run: |
          package_dir="$RUNNER_TEMP/fx-package-${{ matrix.name }}"
          mkdir -p "$package_dir"
          cp zig-out/bin/fx LICENSE THIRD_PARTY_NOTICES.md "$package_dir/"
          tar -czf fx-${{ matrix.name }}.tar.gz -C "$package_dir" fx LICENSE THIRD_PARTY_NOTICES.md
          sha256sum fx-${{ matrix.name }}.tar.gz > fx-${{ matrix.name }}.tar.gz.sha256

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: fx-${{ matrix.name }}
          path: |
            fx-${{ matrix.name }}.tar.gz
            fx-${{ matrix.name }}.tar.gz.sha256

  web:
    if: >-
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'push' &&
      github.event.workflow_run.head_repository.full_name == github.repository
    name: Build web artifacts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_sha }}

      - name: Setup Zig
        uses: mlugg/setup-zig@v2
        with:
          version: "0.16.0"

      - name: Build terminal WASM
        run: zig build -Doptimize=ReleaseSafe -Dwasm-surface=term

      - name: Package web artifacts
        run: |
          cp sdk/fx-sdk.js fx-sdk.js
          cp zig-out/bin/fx-term.wasm fx-term.wasm
          sha256sum fx-sdk.js > fx-sdk.js.sha256
          sha256sum fx-term.wasm > fx-term.wasm.sha256

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: fx-web
          path: |
            fx-sdk.js
            fx-sdk.js.sha256
            fx-term.wasm
            fx-term.wasm.sha256

  publish:
    needs: [build, web]
    runs-on: ubuntu-latest
    env:
      RELEASE_SHA: ${{ github.event.workflow_run.head_sha }}
      BLOB_READ_WRITE_TOKEN: ${{ secrets.BLOB_READ_WRITE_TOKEN }}
      FX_WEB_DEPLOY_HOOK_URL: ${{ secrets.FX_WEB_DEPLOY_HOOK_URL }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_sha }}

      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          merge-multiple: true

      - name: Publish immutable dev artifacts
        run: |
          set -euo pipefail

          for FILE in fx-*.tar.gz fx-*.tar.gz.sha256; do
            [ -f "$FILE" ] || continue
            CONTENT_TYPE="application/octet-stream"
            [[ "$FILE" == *.sha256 ]] && CONTENT_TYPE="text/plain"
            [[ "$FILE" == *.tar.gz ]] && CONTENT_TYPE="application/gzip"

            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
              -X PUT "https://blob.vercel-storage.com/cli/dev/${RELEASE_SHA}/${FILE}" \
              -H "Authorization: Bearer ${BLOB_READ_WRITE_TOKEN}" \
              -H "x-api-version: 7" \
              -H "x-content-type: ${CONTENT_TYPE}" \
              -H "x-add-random-suffix: 0" \
              -H "x-cache-control-max-age: 31536000" \
              --data-binary "@${FILE}")
            echo "Uploaded ${FILE} for ${RELEASE_SHA} ($HTTP_CODE)"
            if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
              echo "::error::Failed to upload ${FILE} to the dev channel ($HTTP_CODE)"
              exit 1
            fi
          done

      - name: Publish immutable web artifacts
        run: |
          set -euo pipefail

          sha256sum --check fx-sdk.js.sha256
          sha256sum --check fx-term.wasm.sha256

          for FILE in fx-sdk.js fx-sdk.js.sha256 fx-term.wasm fx-term.wasm.sha256; do
            CONTENT_TYPE="application/octet-stream"
            [[ "$FILE" == *.js ]] && CONTENT_TYPE="text/javascript"
            [[ "$FILE" == *.wasm ]] && CONTENT_TYPE="application/wasm"
            [[ "$FILE" == *.sha256 ]] && CONTENT_TYPE="text/plain"

            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
              -X PUT "https://blob.vercel-storage.com/cli/dev/${RELEASE_SHA}/web/${FILE}" \
              -H "Authorization: Bearer ${BLOB_READ_WRITE_TOKEN}" \
              -H "x-api-version: 7" \
              -H "x-content-type: ${CONTENT_TYPE}" \
              -H "x-add-random-suffix: 0" \
              -H "x-cache-control-max-age: 31536000" \
              --data-binary "@${FILE}")
            echo "Uploaded web/${FILE} for ${RELEASE_SHA} ($HTTP_CODE)"
            if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
              echo "::error::Failed to upload ${FILE} to the dev web channel ($HTTP_CODE)"
              exit 1
            fi
          done

      - name: Point dev channel at this commit
        id: point-dev
        run: |
          set -euo pipefail
          echo "updated=false" >> "$GITHUB_OUTPUT"

          MAIN_SHA=$(git ls-remote origin refs/heads/main | cut -f1)
          if [ "$MAIN_SHA" != "$RELEASE_SHA" ]; then
            echo "main advanced to ${MAIN_SHA}; leaving dev.json unchanged"
            exit 0
          fi

          VERSION=$(grep 'pub const version' src/main.zig | head -1 | sed 's/.*"\(.*\)".*/\1/')
          jq -n --arg version "$VERSION" --arg commit "$RELEASE_SHA" \
            '{version: $version, commit: $commit}' > /tmp/dev.json

          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
            -X PUT "https://blob.vercel-storage.com/cli/dev.json" \
            -H "Authorization: Bearer ${BLOB_READ_WRITE_TOKEN}" \
            -H "x-api-version: 7" \
            -H "x-content-type: application/json" \
            -H "x-add-random-suffix: 0" \
            -H "x-cache-control-max-age: 60" \
            --data-binary "@/tmp/dev.json")
          echo "Updated dev.json to ${RELEASE_SHA} ($HTTP_CODE)"
          if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
            echo "::error::Failed to update dev.json ($HTTP_CODE)"
            exit 1
          fi
          echo "updated=true" >> "$GITHUB_OUTPUT"

      - name: Deploy fx-web
        if: steps.point-dev.outputs.updated == 'true' && env.FX_WEB_DEPLOY_HOOK_URL != ''
        run: |
          curl --fail --silent --show-error \
            --retry 3 --retry-all-errors --max-time 30 \
            -X POST "$FX_WEB_DEPLOY_HOOK_URL"