oxc-project__oxc/.github/workflows/release_apps.yml

name: Release Apps

permissions: {}

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - npm/oxfmt/package.json
      - npm/oxlint/package.json

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    if: github.repository == 'oxc-project/oxc'
    name: Check version
    runs-on: ubuntu-slim
    outputs:
      version_changed: ${{ steps.oxfmt.outputs.version_changed && steps.oxlint.outputs.version_changed }}
      oxfmt_version: ${{ steps.oxfmt.outputs.version }}
      oxlint_version: ${{ steps.oxlint.outputs.version }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - uses: oxc-project/setup-node@d59b270414aa7d0eed947eed4eb5b0b8a675f01d # v1.4.0

      - uses: ./.github/actions/check-version
        id: oxfmt
        with:
          file-name: npm/oxfmt/package.json
          file-url: https://unpkg.com/oxfmt@latest/package.json

      - uses: ./.github/actions/check-version
        id: oxlint
        with:
          file-name: npm/oxlint/package.json
          file-url: https://unpkg.com/oxlint@latest/package.json

      - name: Validate rule versions
        if: steps.oxlint.outputs.version_changed == 'true'
        env:
          OXLINT_VERSION: ${{ steps.oxlint.outputs.version }}
        run: |
          node .github/scripts/update-rule-versions.mts --release-version "$OXLINT_VERSION" --write
          git diff --exit-code -- crates/oxc_linter/src/rules

  build-oxlint:
    needs: check
    if: needs.check.outputs.version_changed == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            build: pnpm run build-napi-release --target x86_64-pc-windows-msvc

          - os: windows-latest
            target: aarch64-pc-windows-msvc
            build: pnpm run build-napi-release --target aarch64-pc-windows-msvc

          - os: windows-latest
            target: i686-pc-windows-msvc
            build: pnpm run build-napi-release --target i686-pc-windows-msvc

          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            build: pnpm run build-napi-release --target x86_64-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            build: pnpm run build-napi-release --target aarch64-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: armv7-unknown-linux-gnueabihf
            build: pnpm run build-napi-release --target armv7-unknown-linux-gnueabihf --use-napi-cross

          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            build: pnpm run build-napi-release --target x86_64-unknown-linux-musl -x

          - os: ubuntu-latest
            target: aarch64-unknown-linux-musl
            build: pnpm run build-napi-release --target aarch64-unknown-linux-musl -x

          - os: ubuntu-latest
            target: armv7-unknown-linux-musleabihf
            build: pnpm run build-napi-release --target armv7-unknown-linux-musleabihf -x

          - os: macos-latest
            target: x86_64-apple-darwin
            build: pnpm run build-napi-release --target x86_64-apple-darwin

          - os: macos-latest
            target: aarch64-apple-darwin
            build: pnpm run build-napi-release --target aarch64-apple-darwin

          - os: ubuntu-latest
            target: aarch64-linux-android
            build: pnpm run build-napi-release --target aarch64-linux-android

          - os: ubuntu-latest
            target: armv7-linux-androideabi
            build: pnpm run build-napi-release --target armv7-linux-androideabi

          - os: ubuntu-latest
            target: aarch64-unknown-linux-ohos
            build: pnpm run build-napi-release --target aarch64-unknown-linux-ohos

          - os: ubuntu-latest
            target: powerpc64le-unknown-linux-gnu
            build: pnpm run build-napi-release --target powerpc64le-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: riscv64gc-unknown-linux-gnu
            build: |
              sudo apt-get update
              sudo apt-get install gcc-riscv64-linux-gnu g++-riscv64-linux-gnu -y
              export TARGET_CC=riscv64-linux-gnu-gcc
              export CXX=riscv64-linux-gnu-g++
              pnpm run build-napi-release --target riscv64gc-unknown-linux-gnu

          - os: ubuntu-latest
            target: riscv64gc-unknown-linux-musl
            build: pnpm run build-napi-release --target riscv64gc-unknown-linux-musl -x

          - os: ubuntu-latest
            target: s390x-unknown-linux-gnu
            build: export CFLAGS="-fuse-ld=lld" && pnpm run build-napi-release --target s390x-unknown-linux-gnu --use-napi-cross

    name: Build Oxlint ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    env:
      # `clang` lacks the `__ldar64`/`__stlr64` MSVC intrinsics that mimalloc's
      # atomic.h uses on the ARM64 MSVC C path, so leave TARGET_CC unset on
      # `*-pc-windows-msvc` targets and let cc-rs pick `cl.exe`.
      TARGET_CC: ${{ !contains(matrix.target, 'pc-windows-msvc') && 'clang' || '' }} # for mimalloc
    defaults:
      run:
        shell: bash
    steps:
      - if: ${{ contains(matrix.os, 'windows') }}
        run: git config --system core.longpaths true

      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Install cross
        uses: taiki-e/install-action@91ddec75689c4c78665b598d188dc821c5a43e5c # v2.85.9
        with:
          tool: cross # cross installs the latest rust toolchain

      # No Rust cache is provided, to avoid cache poisoning attack.

      - name: Add Rust Target
        run: rustup target add ${{ matrix.target }}

      - uses: oxc-project/setup-node@d59b270414aa7d0eed947eed4eb5b0b8a675f01d # v1.4.0

      # For cargo-zigbuild in musl builds.
      - uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
        if: ${{ contains(matrix.target, 'musl') }}
        with:
          version: 0.13.0

      - name: Setup OpenHarmony SDK
        if: ${{ contains(matrix.target, 'ohos') }}
        uses: Boshen/setup-ohos-sdk@edb865a89a712f1f15dbad932dfa9cfce849d95c # v1.0.0

      - name: Build oxlint for node.js
        working-directory: apps/oxlint
        run: ${{ matrix.build }}

      - name: Build Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') && !contains(matrix.target, 'riscv64gc-unknown-linux-musl') }}
        run: cross build --release -p oxlint --features allocator --target=${{ matrix.target }}

      - name: Build Rust binary (zigbuild)
        if: ${{ contains(matrix.target, 'riscv64gc-unknown-linux-musl') }}
        run: |
          pip3 install cargo-zigbuild
          cargo zigbuild --release -p oxlint --features allocator --target=${{ matrix.target }}

      - name: Upload NAPI artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          if-no-files-found: error
          name: oxlint-bindings-${{ matrix.target }}
          path: |
            apps/oxlint/src-js/*.node
            apps/oxlint/src-js/*.wasm

      # The binaries are zipped to fix permission loss https://github.com/actions/upload-artifact#permission-loss
      - name: Archive Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
        uses: ./.github/actions/archive-binary
        with:
          source_path: target/${{ matrix.target }}/release/oxlint${{ runner.os == 'Windows' && '.exe' || '' }}
          binary_name: oxlint-${{ matrix.target }}${{ runner.os == 'Windows' && '.exe' || '' }}
          archive_name: rust-oxlint-${{ matrix.target }}

      # For github release
      - name: Upload Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          if-no-files-found: error
          name: rust-oxlint-${{ matrix.target }}
          path: |
            rust-oxlint-**.zip
            rust-oxlint-**.tar.gz

  build-oxlint-freebsd:
    needs: check
    if: needs.check.outputs.version_changed == 'true'
    name: Build Oxlint FreeBSD
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - name: Build
        id: build
        uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0
        env:
          DEBUG: napi:*
          RUSTUP_IO_THREADS: 1
        with:
          operating_system: freebsd
          version: "14.2"
          memory: 8G
          cpu_count: 3
          environment_variables: "DEBUG RUSTUP_IO_THREADS"
          shell: bash
          run: |
            sudo pkg install -y -f curl libnghttp2 node22 npm cmake ca_root_nss
            curl https://sh.rustup.rs -sSf --output rustup.sh
            sh rustup.sh -y --profile minimal --default-toolchain stable
            source "$HOME/.cargo/env"
            echo "~~~~ rustc --version ~~~~"
            rustc --version
            echo "~~~~ node -v ~~~~"
            node -v
            pwd
            ls -lah
            whoami
            env
            export COREPACK_INTEGRITY_KEYS=0
            sudo corepack enable
            pnpm install --ignore-scripts # postinstall: The current platform (freebsd) and architecture (x64) is not supported.
            cd apps/oxlint
            pnpm run build-napi-release --target x86_64-unknown-freebsd
            cd ../..
            cargo build --release -p oxlint --features allocator --target=x86_64-unknown-freebsd
            rm -rf node_modules
            rm -rf target/x86_64-unknown-freebsd/release/build
            rm -rf target/x86_64-unknown-freebsd/release/deps
            rm -rf target/x86_64-unknown-freebsd/release/incremental

      - name: Upload NAPI artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          if-no-files-found: error
          name: oxlint-bindings-x86_64-unknown-freebsd
          path: apps/oxlint/src-js/*.node

      - name: Archive Rust binary
        uses: ./.github/actions/archive-binary
        with:
          source_path: target/x86_64-unknown-freebsd/release/oxlint
          binary_name: oxlint-x86_64-unknown-freebsd
          archive_name: rust-oxlint-x86_64-unknown-freebsd

      - name: Upload Rust binary
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          if-no-files-found: error
          name: rust-oxlint-x86_64-unknown-freebsd
          path: |
            rust-oxlint-**.zip
            rust-oxlint-**.tar.gz

  notify-approval:
    needs: [check, build-oxlint, build-oxlint-freebsd, build-oxfmt, build-oxfmt-freebsd]
    if: needs.check.outputs.version_changed == 'true'
    name: Notify Approval
    runs-on: ubuntu-slim
    steps:
      - uses: tsickert/discord-webhook@b217a69502f52803de774ded2b1ab7c282e99645 # v7.0.0
        with:
          webhook-url: ${{ secrets.DISCORD_OXC_CORE_CHANNEL }}
          content: "Requesting approval: https://github.com/oxc-project/oxc/actions/workflows/release_apps.yml"

  publish-oxlint:
    name: Publish Oxlint
    needs: [check, build-oxlint, build-oxlint-freebsd, notify-approval]
    runs-on: ubuntu-slim
    environment: release
    permissions:
      id-token: write # for `pnpm publish --provenance`
    env:
      package_path: npm/oxlint
      plugins_package_path: npm/oxlint-plugins
      plugin_eslint_package_path: npm/oxlint-plugin-eslint
      npm_dir: npm/oxlint-release
      PUBLISH_FLAGS: "--provenance --access public --no-git-checks"
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: artifacts
          pattern: oxlint-bindings-*

      - uses: oxc-project/setup-node@d59b270414aa7d0eed947eed4eb5b0b8a675f01d # v1.4.0

      - name: Generate oxlint JS build
        working-directory: apps/oxlint
        run: pnpm run build-js

      - run: mkdir -p ${npm_dir}

      - run: pnpm napi create-npm-dirs --package-json-path ${package_path}/package.json --npm-dir ${npm_dir}

      - run: pnpm napi artifacts --package-json-path ${package_path}/package.json --build-output-dir apps/oxlint/src-js --npm-dir ${npm_dir}

      - name: Copy dist files to npm package
        run: cp -r apps/oxlint/dist npm/oxlint/dist

      - name: Copy dist files to @oxlint/plugins npm package
        run: |
          cp apps/oxlint/dist-pkg-plugins/* ${plugins_package_path}/

      - name: Copy dist files to oxlint-plugin-eslint npm package
        run: |
          cp -r apps/oxlint/dist-pkg-plugin-eslint/. ${plugin_eslint_package_path}/

      - name: Check Publish
        run: |
          node .github/scripts/check-npm-packages.js "${npm_dir}/*" "${package_path}"
          node .github/scripts/check-npm-packages.js "${plugins_package_path}"
          node .github/scripts/check-npm-packages.js "${plugin_eslint_package_path}"

      - name: Trusted Publish
        run: |
          # Trusted publishing is configured, publish token is not required.
          # Publish sub-packages and adds `optionalDependencies` to main package.
          pnpm napi pre-publish --no-gh-release -t npm --package-json-path ${package_path}/package.json --npm-dir ${npm_dir}
          # Publish `oxlint` package
          bash .github/scripts/publish-if-needed.sh ${package_path} ${PUBLISH_FLAGS}
          # Publish `@oxlint/plugins` package
          bash .github/scripts/publish-if-needed.sh ${plugins_package_path} ${PUBLISH_FLAGS}
          # Publish `oxlint-plugin-eslint` package
          bash .github/scripts/publish-if-needed.sh ${plugin_eslint_package_path} ${PUBLISH_FLAGS}

  build-oxfmt:
    needs: check
    if: needs.check.outputs.version_changed == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            build: pnpm run build-napi-release --target x86_64-pc-windows-msvc

          - os: windows-latest
            target: aarch64-pc-windows-msvc
            build: pnpm run build-napi-release --target aarch64-pc-windows-msvc

          - os: windows-latest
            target: i686-pc-windows-msvc
            build: pnpm run build-napi-release --target i686-pc-windows-msvc

          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            build: pnpm run build-napi-release --target x86_64-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            build: pnpm run build-napi-release --target aarch64-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: armv7-unknown-linux-gnueabihf
            build: pnpm run build-napi-release --target armv7-unknown-linux-gnueabihf --use-napi-cross

          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            build: pnpm run build-napi-release --target x86_64-unknown-linux-musl -x

          - os: ubuntu-latest
            target: aarch64-unknown-linux-musl
            build: pnpm run build-napi-release --target aarch64-unknown-linux-musl -x

          - os: ubuntu-latest
            target: armv7-unknown-linux-musleabihf
            build: pnpm run build-napi-release --target armv7-unknown-linux-musleabihf -x

          - os: macos-latest
            target: x86_64-apple-darwin
            build: pnpm run build-napi-release --target x86_64-apple-darwin

          - os: macos-latest
            target: aarch64-apple-darwin
            build: pnpm run build-napi-release --target aarch64-apple-darwin

          - os: ubuntu-latest
            target: aarch64-linux-android
            build: pnpm run build-napi-release --target aarch64-linux-android

          - os: ubuntu-latest
            target: armv7-linux-androideabi
            build: pnpm run build-napi-release --target armv7-linux-androideabi

          - os: ubuntu-latest
            target: aarch64-unknown-linux-ohos
            build: pnpm run build-napi-release --target aarch64-unknown-linux-ohos

          - os: ubuntu-latest
            target: powerpc64le-unknown-linux-gnu
            build: pnpm run build-napi-release --target powerpc64le-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: riscv64gc-unknown-linux-gnu
            build: |
              sudo apt-get update
              sudo apt-get install gcc-riscv64-linux-gnu g++-riscv64-linux-gnu -y
              export TARGET_CC=riscv64-linux-gnu-gcc
              export CXX=riscv64-linux-gnu-g++
              pnpm run build-napi-release --target riscv64gc-unknown-linux-gnu

          - os: ubuntu-latest
            target: riscv64gc-unknown-linux-musl
            build: pnpm run build-napi-release --target riscv64gc-unknown-linux-musl -x

          - os: ubuntu-latest
            target: s390x-unknown-linux-gnu
            build: export CFLAGS="-fuse-ld=lld" && pnpm run build-napi-release --target s390x-unknown-linux-gnu --use-napi-cross

    name: Build Oxfmt ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    env:
      # `clang` lacks the `__ldar64`/`__stlr64` MSVC intrinsics that mimalloc's
      # atomic.h uses on the ARM64 MSVC C path, so leave TARGET_CC unset on
      # `*-pc-windows-msvc` targets and let cc-rs pick `cl.exe`.
      TARGET_CC: ${{ !contains(matrix.target, 'pc-windows-msvc') && 'clang' || '' }} # for mimalloc
    defaults:
      run:
        shell: bash
    steps:
      - if: ${{ contains(matrix.os, 'windows') }}
        run: git config --system core.longpaths true

      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Install cross
        uses: taiki-e/install-action@91ddec75689c4c78665b598d188dc821c5a43e5c # v2.85.9
        with:
          tool: cross # cross installs the latest rust toolchain

      # No Rust cache is provided, to avoid cache poisoning attack.

      - name: Add Rust Target
        run: rustup target add ${{ matrix.target }}

      - uses: oxc-project/setup-node@d59b270414aa7d0eed947eed4eb5b0b8a675f01d # v1.4.0

      # For cargo-zigbuild in musl builds.
      - uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
        if: ${{ contains(matrix.target, 'musl') }}
        with:
          version: 0.13.0

      - name: Setup OpenHarmony SDK
        if: ${{ contains(matrix.target, 'ohos') }}
        uses: Boshen/setup-ohos-sdk@edb865a89a712f1f15dbad932dfa9cfce849d95c # v1.0.0

      - name: Build oxfmt for node.js
        working-directory: apps/oxfmt
        run: ${{ matrix.build }}

      - name: Build Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') && !contains(matrix.target, 'riscv64gc-unknown-linux-musl') }}
        run: cross build --release -p oxfmt --no-default-features --features allocator --target=${{ matrix.target }}

      - name: Build Rust binary (zigbuild)
        if: ${{ contains(matrix.target, 'riscv64gc-unknown-linux-musl') }}
        run: |
          pip3 install cargo-zigbuild
          cargo zigbuild --release -p oxfmt --no-default-features --features allocator --target=${{ matrix.target }}

      - name: Upload NAPI artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          if-no-files-found: error
          name: oxfmt-bindings-${{ matrix.target }}
          path: |
            apps/oxfmt/src-js/*.node
            apps/oxfmt/src-js/*.wasm

      # The binaries are zipped to fix permission loss https://github.com/actions/upload-artifact#permission-loss
      - name: Archive Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
        uses: ./.github/actions/archive-binary
        with:
          source_path: target/${{ matrix.target }}/release/oxfmt${{ runner.os == 'Windows' && '.exe' || '' }}
          binary_name: oxfmt-${{ matrix.target }}${{ runner.os == 'Windows' && '.exe' || '' }}
          archive_name: rust-oxfmt-${{ matrix.target }}

      # For github release
      - name: Upload Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          if-no-files-found: error
          name: rust-oxfmt-${{ matrix.target }}
          path: |
            rust-oxfmt-**.zip
            rust-oxfmt-**.tar.gz

  build-oxfmt-freebsd:
    needs: check
    if: needs.check.outputs.version_changed == 'true'
    name: Build Oxfmt FreeBSD
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - name: Build
        id: build
        uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0
        env:
          DEBUG: napi:*
          RUSTUP_IO_THREADS: 1
        with:
          operating_system: freebsd
          version: "14.2"
          memory: 8G
          cpu_count: 3
          environment_variables: "DEBUG RUSTUP_IO_THREADS"
          shell: bash
          run: |
            sudo pkg install -y -f curl libnghttp2 node22 npm cmake ca_root_nss
            curl https://sh.rustup.rs -sSf --output rustup.sh
            sh rustup.sh -y --profile minimal --default-toolchain stable
            source "$HOME/.cargo/env"
            echo "~~~~ rustc --version ~~~~"
            rustc --version
            echo "~~~~ node -v ~~~~"
            node -v
            pwd
            ls -lah
            whoami
            env
            export COREPACK_INTEGRITY_KEYS=0
            sudo corepack enable
            pnpm install --ignore-scripts # postinstall: The current platform (freebsd) and architecture (x64) is not supported.
            cd apps/oxfmt
            pnpm run build-napi-release --target x86_64-unknown-freebsd
            cd ../..
            cargo build --release -p oxfmt --no-default-features --features allocator --target=x86_64-unknown-freebsd
            rm -rf node_modules
            rm -rf target/x86_64-unknown-freebsd/release/build
            rm -rf target/x86_64-unknown-freebsd/release/deps
            rm -rf target/x86_64-unknown-freebsd/release/incremental

      - name: Upload NAPI artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          if-no-files-found: error
          name: oxfmt-bindings-x86_64-unknown-freebsd
          path: apps/oxfmt/src-js/*.node

      - name: Archive Rust binary
        uses: ./.github/actions/archive-binary
        with:
          source_path: target/x86_64-unknown-freebsd/release/oxfmt
          binary_name: oxfmt-x86_64-unknown-freebsd
          archive_name: rust-oxfmt-x86_64-unknown-freebsd

      - name: Upload Rust binary
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          if-no-files-found: error
          name: rust-oxfmt-x86_64-unknown-freebsd
          path: |
            rust-oxfmt-**.zip
            rust-oxfmt-**.tar.gz

  publish-oxfmt:
    name: Publish Oxfmt
    needs: [check, build-oxfmt, build-oxfmt-freebsd, notify-approval]
    runs-on: ubuntu-slim
    environment: release
    permissions:
      id-token: write # for `pnpm publish --provenance`
    env:
      package_path: npm/oxfmt
      npm_dir: npm/oxfmt-release
      PUBLISH_FLAGS: "--provenance --access public --no-git-checks"
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: artifacts
          pattern: oxfmt-bindings-*

      - uses: oxc-project/setup-node@d59b270414aa7d0eed947eed4eb5b0b8a675f01d # v1.4.0

      - name: Generate oxfmt JS build
        working-directory: apps/oxfmt
        run: pnpm run build-js

      - run: mkdir -p ${npm_dir}

      - run: pnpm napi create-npm-dirs --package-json-path ${package_path}/package.json --npm-dir ${npm_dir}

      - run: pnpm napi artifacts --package-json-path ${package_path}/package.json --build-output-dir apps/oxfmt/src-js --npm-dir ${npm_dir}

      - name: Copy dist files to npm package
        run: cp -r apps/oxfmt/dist npm/oxfmt/dist

      - name: Check Publish
        run: node .github/scripts/check-npm-packages.js "${npm_dir}/*" "${package_path}"

      - name: Trusted Publish
        run: |
          # Trusted publishing is configured, publish token is not required.
          # Publish sub-packages and adds `optionalDependencies` to main package.
          pnpm napi pre-publish --no-gh-release -t npm --package-json-path ${package_path}/package.json --npm-dir ${npm_dir}
          bash .github/scripts/publish-if-needed.sh ${package_path} ${PUBLISH_FLAGS}

  github-release:
    name: GitHub Release
    needs:
      [
        check,
        build-oxlint,
        build-oxlint-freebsd,
        build-oxfmt,
        build-oxfmt-freebsd,
        publish-oxlint,
        publish-oxfmt,
      ]
    permissions:
      contents: write # for `gh release create`
    runs-on: ubuntu-latest
    steps:
      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        with:
          client-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          token: ${{ steps.app-token.outputs.token }}
          fetch-depth: 0 # for changelog
          filter: blob:none
          persist-credentials: true

      - uses: oxc-project/setup-rust@3d6fb132fbe7cdcb66bf8ec193911c2945369d12 # v1.0.17
        with:
          restore-cache: false
          tools: cargo-release-oxc

      - name: Generate changelog
        id: run
        run: |
          mkdir -p target
          cargo release-oxc changelog --release oxfmt --release oxlint
          {
            echo "## Table of Contents"
            echo ""
            echo "- [Oxlint v${NEEDS_CHECK_OUTPUTS_OXLINT_VERSION}](#oxlint-v${NEEDS_CHECK_OUTPUTS_OXLINT_VERSION})"
            echo "- [Oxfmt v${NEEDS_CHECK_OUTPUTS_OXFMT_VERSION}](#oxfmt-v${NEEDS_CHECK_OUTPUTS_OXFMT_VERSION})"
            echo ""
            echo "## Oxlint v${NEEDS_CHECK_OUTPUTS_OXLINT_VERSION}"
            cat ./target/OXLINT_CHANGELOG
            echo ""
            echo ""
            echo "## Oxfmt v${NEEDS_CHECK_OUTPUTS_OXFMT_VERSION}"
            cat ./target/OXFMT_CHANGELOG
          } > ./target/RELEASE_BODY.md
        env:
          NEEDS_CHECK_OUTPUTS_OXLINT_VERSION: ${{ needs.check.outputs.oxlint_version }}
          NEEDS_CHECK_OUTPUTS_OXFMT_VERSION: ${{ needs.check.outputs.oxfmt_version }}

      - name: tag oxlint and oxfmt
        env:
          NEEDS_CHECK_OUTPUTS_OXFMT_VERSION: ${{ needs.check.outputs.oxfmt_version }}
          NEEDS_CHECK_OUTPUTS_OXLINT_VERSION: ${{ needs.check.outputs.oxlint_version }}
        run: |
          git tag oxfmt_v${NEEDS_CHECK_OUTPUTS_OXFMT_VERSION} ${{ github.sha }}
          git tag oxlint_v${NEEDS_CHECK_OUTPUTS_OXLINT_VERSION} ${{ github.sha }}
          git push origin oxlint_v${NEEDS_CHECK_OUTPUTS_OXLINT_VERSION} oxfmt_v${NEEDS_CHECK_OUTPUTS_OXFMT_VERSION}

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: ./release-artifacts
          pattern: rust-*
          merge-multiple: true

      - name: Remove rust- prefix from filenames
        run: |
          cd release-artifacts
          for file in rust-*; do
            mv "$file" "${file#rust-}"
          done
          ls

      - name: Create GitHub Release
        id: release
        env:
          GH_TOKEN: ${{ github.token }}
          GIT_TAG: apps_v${{ needs.check.outputs.oxlint_version }}
          GIT_TARGET: ${{ github.sha }}
          TITLE: "oxlint v${{ needs.check.outputs.oxlint_version }} & oxfmt v${{ needs.check.outputs.oxfmt_version }}"
        run: gh release create ${GIT_TAG} ./release-artifacts/* --title "${TITLE}" --notes-file ./target/RELEASE_BODY.md --target ${GIT_TARGET}

      - name: wait 3 minutes for smoke test
        run: sleep 180s

  smoke:
    needs: [check, github-release]
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
          - os: ubuntu-latest
          - os: ubuntu-latest
            container: node:24-alpine # musl
          - os: macos-latest
    name: Smoke Test ${{ matrix.os }} ${{ matrix.container }}
    runs-on: ${{ matrix.os }}
    container: ${{ matrix.container }}
    env:
      RELEASE_EMBED_TITLE: oxlint v${{ needs.check.outputs.oxlint_version }} & oxfmt v${{ needs.check.outputs.oxfmt_version }}
      RELEASE_EMBED_DESCRIPTION: A new release is available! Check the changelog for details.
      RELEASE_EMBED_URL: https://github.com/${{ github.repository }}/releases/tag/apps_v${{ needs.check.outputs.oxlint_version }}
    steps:
      - name: Test
        # These commands should be run on these defaults:
        # - windows: pwsh
        # - ubuntu: bash
        # - alpine: sh
        # - macos: bash
        run: | # zizmor: ignore[template-injection]
          echo "" > test.js
          ldd --version || true
          npx oxfmt@${{ needs.check.outputs.oxfmt_version }} ./test.js
          npx oxlint@${{ needs.check.outputs.oxlint_version }} ./test.js

      - if: ${{ matrix.os == 'windows-latest' }}
        uses: tsickert/discord-webhook@b217a69502f52803de774ded2b1ab7c282e99645 # v7.0.0
        with:
          webhook-url: ${{ secrets.DISCORD_OXC_CORE_CHANNEL }}
          embed-title: ${{ env.RELEASE_EMBED_TITLE }}
          embed-description: ${{ env.RELEASE_EMBED_DESCRIPTION }}
          embed-url: ${{ env.RELEASE_EMBED_URL }}

      - if: ${{ matrix.os == 'windows-latest' }}
        uses: tsickert/discord-webhook@b217a69502f52803de774ded2b1ab7c282e99645 # v7.0.0
        with:
          webhook-url: ${{ secrets.DISCORD_OXC_RELEASES_CHANNEL }}
          embed-title: ${{ env.RELEASE_EMBED_TITLE }}
          embed-description: ${{ env.RELEASE_EMBED_DESCRIPTION }}
          embed-url: ${{ env.RELEASE_EMBED_URL }}

  bump:
    needs: [check, smoke]
    name: Bump oxlint dependents
    runs-on: ubuntu-slim
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        with:
          client-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: oxc-project
          repositories: |
            eslint-plugin-oxlint
            oxlint-migrate
            mirrors-oxlint
            mirrors-oxfmt

      - name: Bump oxc-project/eslint-plugin-oxlint
        uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1.3.2
        with:
          repo: oxc-project/eslint-plugin-oxlint
          workflow: bump_oxlint.yml
          token: ${{ steps.app-token.outputs.token }}
          ref: main
          inputs: '{ "version": "${{ needs.check.outputs.oxlint_version }}" }'

      - name: Bump oxc-project/oxlint-migrate
        uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1.3.2
        with:
          repo: oxc-project/oxlint-migrate
          workflow: bump_oxlint.yml
          token: ${{ steps.app-token.outputs.token }}
          ref: main
          inputs: '{ "version": "${{ needs.check.outputs.oxlint_version }}" }'

      - name: Bump oxc-project/mirrors-oxlint
        uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1.3.2
        with:
          repo: oxc-project/mirrors-oxlint
          workflow: main.yml
          token: ${{ steps.app-token.outputs.token }}
          ref: main

      - name: Bump oxc-project/mirrors-oxfmt
        uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1.3.2
        with:
          repo: oxc-project/mirrors-oxfmt
          workflow: main.yml
          token: ${{ steps.app-token.outputs.token }}
          ref: main