name: Build and upload

on:
  release:
    types: [published]
  pull_request:
    branches: [main]
  workflow_dispatch:

jobs:
  configure:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
      smoke_matrix: ${{ steps.set-matrix.outputs.smoke_matrix }}
    steps:
      - name: Set matrix
        id: set-matrix
        run: |
          # Linux: manylinux_2_28 containers → binary works on glibc >= 2.28 (RHEL 8+, Ubuntu 20.04+)
          matrix='{
            "include": [
              {"runner": "ubuntu-22.04", "os": "linux", "arch": "x86_64", "container": "quay.io/pypa/manylinux_2_28_x86_64"},
              {"runner": "ubuntu-22.04-arm", "os": "linux", "arch": "aarch64", "container": "quay.io/pypa/manylinux_2_28_aarch64"},
              {"runner": "macos-15-intel", "os": "darwin", "arch": "x86_64"},
              {"runner": "macos-14", "os": "darwin", "arch": "aarch64"},
              {"runner": "windows-2022", "os": "windows", "arch": "x86_64"}
            ]
          }'
          # TODO: Re-enable macOS standalone artifact smoke tests once the PyInstaller
          # binaries are Developer ID signed and notarized. The direct GitHub zip
          # download path gets Gatekeeper-assessed via quarantine and currently rejects
          # ad-hoc signed binaries, even though vibe-acp continues to work when bundled
          # through the VS Code extension.
          smoke_matrix='{
            "include": [
              {"runner": "ubuntu-24.04", "os": "linux", "arch": "x86_64"},
              {"runner": "ubuntu-24.04", "os": "linux", "arch": "x86_64", "tag": "old-glibc", "container": "almalinux:8"},
              {"runner": "ubuntu-24.04-arm", "os": "linux", "arch": "aarch64"},
              {"runner": "windows-latest", "os": "windows", "arch": "x86_64"}
            ]
          }'
          echo "matrix=$(echo $matrix | jq -c .)" >> $GITHUB_OUTPUT
          echo "smoke_matrix=$(echo $smoke_matrix | jq -c .)" >> $GITHUB_OUTPUT

  build-and-upload:
    needs: configure
    name: "Build and upload: ${{ matrix.os }}-${{ matrix.arch }}"
    permissions:
      contents: read
    strategy:
      matrix: ${{ fromJSON(needs.configure.outputs.matrix) }}
    runs-on: ${{ matrix.runner }}
    container: ${{ matrix.container || '' }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install uv with caching
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          version: "latest"
          enable-cache: true
          cache-dependency-glob: "uv.lock"

      - name: Set up Python
        if: ${{ matrix.os != 'linux' }}
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.12"

      - name: Install Python (Linux)
        if: ${{ matrix.os == 'linux' }}
        shell: bash
        run: bash ./scripts/ci/setup-linux-pyinstaller-build.sh

      - name: Inject Sentry DSN
        shell: bash
        env:
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          REQUIRE_SENTRY_DSN: ${{ github.event_name == 'release' && 'true' || 'false' }}
        run: bash ./scripts/ci/inject-sentry-dsn.sh

      - name: Build PyInstaller binaries
        shell: bash
        run: bash ./scripts/ci/build-pyinstaller-binaries.sh vibe-acp.spec vibe.spec

      - name: Clear executable stack on bundled libraries
        if: ${{ matrix.os == 'linux' }}
        shell: bash
        run: bash ./scripts/ci/clear-linux-execstack.sh dist/vibe-acp-dir dist/vibe-dir

      - name: Get package version
        id: get_version
        shell: bash
        run: echo "version=$(uv version | cut -d' ' -f2)" >> $GITHUB_OUTPUT

      - name: Upload ACP binary as artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: vibe-acp-${{ matrix.os }}-${{ matrix.arch }}-${{ steps.get_version.outputs.version }}
          path: dist/vibe-acp-dir/

      - name: Upload CLI binary as artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: vibe-${{ matrix.os }}-${{ matrix.arch }}-${{ steps.get_version.outputs.version }}
          path: dist/vibe-dir/

  nix-build:
    needs: configure
    name: "Nix build and upload: ${{ matrix.os }}-${{ matrix.arch }}"
    permissions:
      contents: read
    strategy:
      matrix: ${{ fromJSON(needs.configure.outputs.matrix) }}
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout repository
        if: matrix.os != 'windows'
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install Nix
        if: matrix.os != 'windows'
        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6

      - name: Build with Nix
        if: matrix.os != 'windows'
        shell: bash
        run: |
          nix build .#

      - name: Nix Smoke Test
        if: matrix.os != 'windows'
        shell: bash
        run: |
          nix run .# -- --version

  smoke-test:
    needs: [configure, build-and-upload]
    name: "Test: ${{ matrix.os }}-${{ matrix.arch }}${{ matrix.tag && format('-{0}', matrix.tag) || '' }}"
    permissions:
      contents: read
    strategy:
      matrix: ${{ fromJSON(needs.configure.outputs.smoke_matrix) }}
    runs-on: ${{ matrix.runner }}
    container: ${{ matrix.container || '' }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Python
        if: ${{ !matrix.container }}
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.12"

      - name: Set up Python (container)
        if: ${{ matrix.container }}
        run: yum install -y python3.11 python3.11-pip

      - name: Install smoke test deps
        run: ${{ matrix.container && 'python3.11' || 'python' }} -m pip install agent-client-protocol==0.10.1

      - name: Download ACP artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: vibe-acp-${{ matrix.os }}-${{ matrix.arch }}-*
          merge-multiple: true
          path: dist/vibe-acp-dir

      - name: Download CLI artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: vibe-${{ matrix.os }}-${{ matrix.arch }}-*
          merge-multiple: true
          path: dist/vibe-dir

      - name: Run ACP smoke tests
        run: ${{ matrix.container && 'python3.11' || 'python' }} tests/acp/smoke_binary.py dist/vibe-acp-dir

      - name: Run CLI smoke tests
        shell: bash
        env:
          PYTHON_BIN: ${{ matrix.container && 'python3.11' || 'python' }}
        run: bash ./scripts/ci/smoke-pyinstaller-cli.sh dist/vibe-dir

  attach-to-release:
    needs: [build-and-upload, smoke-test]
    runs-on: ubuntu-latest
    if: github.event_name == 'release'
    permissions:
      contents: write
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: artifacts

      - name: Zip artifacts
        run: |
          mkdir release-assets
          for dir in artifacts/*; do
            name=$(basename "$dir")
            if [ -f "$dir/vibe-acp" ] || [ -f "$dir/vibe-acp.exe" ]; then
              chmod -f +x "$dir/vibe-acp" 2>/dev/null || true
              (cd "$dir" && zip -r "../../release-assets/${name}.zip" .)
            elif [ -f "$dir/vibe" ] || [ -f "$dir/vibe.exe" ]; then
              chmod -f +x "$dir/vibe" 2>/dev/null || true
              (cd "$dir" && zip -r "../../release-assets/${name}.zip" .)
            fi
          done

      - name: Attach binaries to release
        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
        with:
          files: release-assets/*.zip
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}