grim/.github/workflows/release.yml

# Release builds on native runners — one per platform, no cross-compilation
# (nokhwa's camera backends want each platform's own SDK; see NEXT-STEPS judgment).
#
# Manually triggered (Actions → Release → Run workflow) against an existing tag
# until a run has been validated end-to-end; then this can move to a tag trigger.
# Android is built locally via scripts/android.sh for now — the gradle `ci`
# flavor expects maven credentials this repository does not carry.
name: Release

on:
  # macOS is DEFERRED until Linux/Windows/Android are polished — so this is
  # manual-dispatch only for now (no auto-build on release publish). When macOS
  # is back on the table, re-add `release: { types: [published] }` here and the
  # macOS job will attach a universal build to each release automatically.
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing release tag to build and upload artifacts to (e.g. build27)"
        required: true

permissions:
  contents: write

env:
  TAG: ${{ inputs.tag || github.event.release.tag_name }}
  # aws-lc-sys (via nym-sdk) needs NASM on native Windows; use its prebuilt NASM.
  AWS_LC_SYS_PREBUILT_NASM: 1

jobs:
  linux:
    name: Linux x86_64
    runs-on: ubuntu-latest
    # Built locally and uploaded with the release; only run on manual dispatch.
    if: github.event_name == 'workflow_dispatch'
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.tag || github.event.release.tag_name }}
          submodules: recursive
      - uses: ./.github/actions/fetch-nym
      - name: Build
        shell: bash
        run: GOBLIN_BUILD="${TAG#build}" cargo build --release
      - name: Package
        run: |
          tar -C target/release -czf "goblin-$TAG-linux-x86_64.tar.gz" goblin
          sha256sum "goblin-$TAG-linux-x86_64.tar.gz" > "goblin-$TAG-linux-x86_64-sha256sum.txt"
      - uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.tag || github.event.release.tag_name }}
          files: |
            goblin-${{ inputs.tag || github.event.release.tag_name }}-linux-x86_64.tar.gz
            goblin-${{ inputs.tag || github.event.release.tag_name }}-linux-x86_64-sha256sum.txt

  windows:
    name: Windows x86_64 (MSVC)
    runs-on: windows-latest
    # Built locally and uploaded with the release; only run on manual dispatch.
    if: github.event_name == 'workflow_dispatch'
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.tag || github.event.release.tag_name }}
          submodules: recursive
      - uses: ./.github/actions/fetch-nym
      - name: Build
        shell: bash
        run: GOBLIN_BUILD="${TAG#build}" cargo build --release
      - name: Package
        shell: bash
        run: |
          7z a "goblin-$TAG-win-x86_64.zip" ./target/release/goblin.exe
          sha256sum "goblin-$TAG-win-x86_64.zip" > "goblin-$TAG-win-x86_64-sha256sum.txt"
      - uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.tag || github.event.release.tag_name }}
          files: |
            goblin-${{ inputs.tag || github.event.release.tag_name }}-win-x86_64.zip
            goblin-${{ inputs.tag || github.event.release.tag_name }}-win-x86_64-sha256sum.txt

  macos:
    name: macOS universal
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.tag || github.event.release.tag_name }}
          submodules: recursive
      - uses: ./.github/actions/fetch-nym
      - name: Build both architectures
        run: |
          export GOBLIN_BUILD="${TAG#build}"
          rustup target add aarch64-apple-darwin x86_64-apple-darwin
          cargo build --release --target aarch64-apple-darwin
          cargo build --release --target x86_64-apple-darwin
      - name: Universal binary into Goblin.app bundle
        run: |
          # Combine both arches into one universal Mach-O and drop it into the
          # app bundle's executable slot (CFBundleExecutable=goblin).
          lipo -create -output goblin \
            target/aarch64-apple-darwin/release/goblin \
            target/x86_64-apple-darwin/release/goblin
          cp goblin macos/Goblin.app/Contents/MacOS/goblin
          chmod +x macos/Goblin.app/Contents/MacOS/goblin
          # Drop the placeholder that kept the empty dir tracked in git.
          rm -f macos/Goblin.app/Contents/MacOS/.gitignore
          # Ad-hoc sign (no Apple cert in CI). REQUIRED on Apple Silicon: lipo
          # strips the per-arch signatures cargo/ld add, and an unsigned arm64
          # Mach-O is killed by the OS. Ad-hoc gives a valid (if unidentified)
          # signature; users still right-click → Open past Gatekeeper.
          codesign --force --sign - macos/Goblin.app/Contents/MacOS/goblin
          codesign --force --sign - macos/Goblin.app
          # ditto is the macOS-correct way to zip an .app (preserves the bundle
          # layout, symlinks and permissions; plain `zip` mangles bundles).
          ditto -c -k --keepParent macos/Goblin.app "goblin-$TAG-macos-universal.zip"
          shasum -a 256 "goblin-$TAG-macos-universal.zip" > "goblin-$TAG-macos-universal-sha256sum.txt"
      - uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.tag || github.event.release.tag_name }}
          files: |
            goblin-${{ inputs.tag || github.event.release.tag_name }}-macos-universal.zip
            goblin-${{ inputs.tag || github.event.release.tag_name }}-macos-universal-sha256sum.txt