redwoodjs__local-ci/.github/workflows/native-binaries.yml

name: Native Binaries

# Manual validation only while native npm/package releases are deferred.
# Release publishing should move into release.yml with Machinen-style
# artifact staging and package-shape verification before it is enabled.
on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  validate:
    name: Validate Rust workspace
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Setup Rust
        run: |
          if ! command -v rustup >/dev/null 2>&1; then
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
              | sh -s -- -y --profile minimal --default-toolchain stable
            echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
            export PATH="$HOME/.cargo/bin:$PATH"
          fi
          rustup toolchain install stable --profile minimal --component clippy --component rustfmt
          rustup default stable

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Run clippy
        run: cargo clippy --workspace --all-targets -- -D warnings

      - name: Run tests
        run: cargo test --workspace --all-targets

  build:
    name: Build ${{ matrix.name }}
    needs: validate
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux-x64
            runner: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - name: linux-arm64
            runner: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
          - name: macos-x64
            runner: macos-13
            target: x86_64-apple-darwin
          - name: macos-arm64
            runner: macos-15
            target: aarch64-apple-darwin
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Setup Rust
        run: |
          if ! command -v rustup >/dev/null 2>&1; then
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
              | sh -s -- -y --profile minimal --default-toolchain stable
            echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
            export PATH="$HOME/.cargo/bin:$PATH"
          fi
          rustup toolchain install stable --profile minimal
          rustup default stable
          target="${{ matrix.target }}"
          if [ -n "$target" ]; then
            rustup target add "$target"
          else
            echo "No matrix target resolved; skipping native binary build leg."
          fi

      - name: Build release binary
        if: ${{ matrix.target != '' }}
        run: cargo build --release -p agent-ci --target ${{ matrix.target }}

      - name: Stage binary
        if: ${{ matrix.target != '' }}
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p dist/${{ matrix.name }}
          cp target/${{ matrix.target }}/release/agent-ci dist/${{ matrix.name }}/agent-ci
          chmod +x dist/${{ matrix.name }}/agent-ci

      - name: Ad-hoc sign macOS binary
        if: ${{ matrix.target != '' && startsWith(matrix.name, 'macos-') }}
        run: codesign --force --sign - dist/${{ matrix.name }}/agent-ci

      - name: Package archive and checksum
        if: ${{ matrix.target != '' }}
        shell: bash
        run: |
          set -euo pipefail
          version="${GITHUB_REF_NAME:-dev}"
          archive="agent-ci-${version}-${{ matrix.name }}.tar.gz"
          tar -C dist/${{ matrix.name }} -czf "dist/${archive}" agent-ci
          (cd dist && shasum -a 256 "${archive}" > "${archive}.sha256")
          echo "archive=${archive}" >> "$GITHUB_ENV"

      - name: Upload native binary artifact
        if: ${{ matrix.target != '' }}
        uses: actions/upload-artifact@v4
        with:
          name: agent-ci-${{ matrix.name }}
          path: |
            dist/${{ env.archive }}
            dist/${{ env.archive }}.sha256
          if-no-files-found: error