release.yml

name: Package and publish QueryCraft

on:
  workflow_dispatch:
    inputs:
      publish:
        description: Upload client artifacts and create the GitHub Release
        required: true
        default: false
        type: boolean
      source_run_id:
        description: Reuse macOS artifacts from an earlier workflow run
        required: false
        type: string
      publish_drivers:
        description: Build and publish all external database drivers
        required: true
        default: false
        type: boolean
      rebuild_driver:
        description: Rebuild one driver while reusing artifacts from source_run_id
        required: true
        default: none
        type: choice
        options:
          - none
          - mysql
          - postgresql
          - doris
          - redis
          - elasticsearch
          - kafka
  push:
    tags:
      - "v*"

permissions:
  contents: read

concurrency:
  group: querycraft-release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  metadata:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.release.outputs.version }}
      build: ${{ steps.release.outputs.build }}
      publish: ${{ steps.release.outputs.publish }}
      source_run_id: ${{ steps.release.outputs.source_run_id }}
      publish_drivers: ${{ steps.release.outputs.publish_drivers }}
      build_client: ${{ steps.release.outputs.build_client }}
      rebuild_driver: ${{ steps.release.outputs.rebuild_driver }}
      driver_matrix: ${{ steps.release.outputs.driver_matrix }}
    steps:
      - uses: actions/checkout@v7

      - id: release
        env:
          REQUESTED_PUBLISH: ${{ github.event_name == 'push' || inputs.publish }}
          REQUESTED_SOURCE_RUN_ID: ${{ inputs.source_run_id }}
          REQUESTED_PUBLISH_DRIVERS: ${{ github.event_name == 'push' || inputs.publish_drivers }}
          REQUESTED_REBUILD_DRIVER: ${{ inputs.rebuild_driver }}
        run: |
          set -euo pipefail
          version="$(awk -F ' = ' '/^MARKETING_VERSION = / { print $2; exit }' Config/Shared.xcconfig)"
          build="$(awk -F ' = ' '/^CURRENT_PROJECT_VERSION = / { print $2; exit }' Config/Shared.xcconfig)"
          source_run_id="${REQUESTED_SOURCE_RUN_ID:-}"
          rebuild_driver="${REQUESTED_REBUILD_DRIVER:-none}"
          driver_matrix='["mysql","postgresql","doris","redis","elasticsearch","kafka"]'
          case "$rebuild_driver" in
            none) ;;
            mysql|postgresql|doris|redis|elasticsearch|kafka)
              if [[ -z "$source_run_id" || "$REQUESTED_PUBLISH_DRIVERS" != "true" ]]; then
                echo "Rebuilding one driver requires a source run and driver publishing." >&2
                exit 1
              fi
              driver_matrix="$(jq -cn --arg driver "$rebuild_driver" '[$driver]')"
              ;;
            *) echo "Invalid driver rebuild target." >&2; exit 1 ;;
          esac
          build_client=true
          test -n "$version"
          test -n "$build"
          test -f "docs/releases/$version.md"

          if [[ -n "$source_run_id" && ! "$source_run_id" =~ ^[0-9]+$ ]]; then
            echo "Source run ID must be numeric." >&2
            exit 1
          fi
          if [[ -n "$source_run_id" && "$REQUESTED_PUBLISH" != "true" && "$REQUESTED_PUBLISH_DRIVERS" != "true" ]]; then
            echo "Reusing a source run requires application or driver publishing." >&2
            exit 1
          fi
          if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
            [[ "${GITHUB_REF_NAME#v}" == "$version" ]]
          elif [[ "$REQUESTED_PUBLISH" == "true" ]]; then
            test -n "$source_run_id"
            git ls-remote --exit-code origin "refs/tags/v$version" >/dev/null
          elif [[ "$REQUESTED_PUBLISH_DRIVERS" == "true" ]]; then
            git ls-remote --exit-code origin "refs/tags/v$version" >/dev/null
          fi

          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "build=$build" >> "$GITHUB_OUTPUT"
          echo "publish=$REQUESTED_PUBLISH" >> "$GITHUB_OUTPUT"
          echo "source_run_id=$source_run_id" >> "$GITHUB_OUTPUT"
          echo "publish_drivers=$REQUESTED_PUBLISH_DRIVERS" >> "$GITHUB_OUTPUT"
          echo "build_client=$build_client" >> "$GITHUB_OUTPUT"
          echo "rebuild_driver=$rebuild_driver" >> "$GITHUB_OUTPUT"
          echo "driver_matrix=$driver_matrix" >> "$GITHUB_OUTPUT"

  build_client:
    needs: metadata
    if: needs.metadata.outputs.source_run_id == '' && needs.metadata.outputs.build_client == 'true'
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        include:
          - architecture: x86_64
            runner: macos-15-intel
          - architecture: arm64
            runner: macos-15
    env:
      QUERYCRAFT_UPDATE_BASE_URL: https://querycraft.debug-tools.cc
      QUERYCRAFT_DRIVER_DOWNLOAD_BASE_URL: https://querycraft.debug-tools.cc/drivers
      QUERYCRAFT_BUILD_CLIENT: true
      QUERYCRAFT_BUILD_DRIVERS: false
      QUERYCRAFT_BUILD_UNIVERSAL_UPDATE: false
    steps:
      - uses: actions/checkout@v7

      - name: Select Xcode 26.2
        run: sudo xcode-select -s /Applications/Xcode_26.2.app/Contents/Developer

      - name: Import persistent application signing identity
        env:
          QUERYCRAFT_SIGNING_P12_BASE64: ${{ secrets.QUERYCRAFT_SIGNING_P12_BASE64 }}
          QUERYCRAFT_SIGNING_P12_PASSWORD: ${{ secrets.QUERYCRAFT_SIGNING_P12_PASSWORD }}
        run: |
          export QUERYCRAFT_SIGNING_DIRECTORY="$RUNNER_TEMP/querycraft-signing"
          echo "QUERYCRAFT_SIGNING_DIRECTORY=$QUERYCRAFT_SIGNING_DIRECTORY" >> "$GITHUB_ENV"
          python3 scripts/code-signing.py import-ci

      - name: Install XcodeBuildMCP
        run: npm install --global xcodebuildmcp@2.6.2

      - name: Build and package client artifacts
        env:
          QUERYCRAFT_RELEASE_VERSION: ${{ needs.metadata.outputs.version }}
          QUERYCRAFT_RELEASE_BUILD: ${{ needs.metadata.outputs.build }}
          DERIVED_DATA_ROOT: ${{ runner.temp }}/querycraft-derived-data
        run: scripts/ci/build-release-artifacts.sh "${{ matrix.architecture }}" "artifacts/${{ matrix.architecture }}"

      - name: Remove temporary signing keychain
        if: always()
        run: python3 scripts/code-signing.py cleanup-ci

      - uses: actions/upload-artifact@v7
        with:
          name: querycraft-release-client-${{ matrix.architecture }}
          path: artifacts/${{ matrix.architecture }}/
          if-no-files-found: error
          retention-days: 14

  build_update:
    needs: metadata
    if: needs.metadata.outputs.source_run_id == '' && needs.metadata.outputs.build_client == 'true'
    runs-on: macos-15
    timeout-minutes: 60
    env:
      SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
      QUERYCRAFT_UPDATE_BASE_URL: https://querycraft.debug-tools.cc
      QUERYCRAFT_DRIVER_DOWNLOAD_BASE_URL: https://querycraft.debug-tools.cc/drivers
      QUERYCRAFT_BUILD_CLIENT: false
      QUERYCRAFT_BUILD_DRIVERS: false
      QUERYCRAFT_BUILD_UNIVERSAL_UPDATE: true
    steps:
      - uses: actions/checkout@v7

      - name: Select Xcode 26.2
        run: sudo xcode-select -s /Applications/Xcode_26.2.app/Contents/Developer

      - name: Import persistent application signing identity
        env:
          QUERYCRAFT_SIGNING_P12_BASE64: ${{ secrets.QUERYCRAFT_SIGNING_P12_BASE64 }}
          QUERYCRAFT_SIGNING_P12_PASSWORD: ${{ secrets.QUERYCRAFT_SIGNING_P12_PASSWORD }}
        run: |
          export QUERYCRAFT_SIGNING_DIRECTORY="$RUNNER_TEMP/querycraft-signing"
          echo "QUERYCRAFT_SIGNING_DIRECTORY=$QUERYCRAFT_SIGNING_DIRECTORY" >> "$GITHUB_ENV"
          python3 scripts/code-signing.py import-ci

      - name: Install XcodeBuildMCP
        run: npm install --global xcodebuildmcp@2.6.2

      - name: Validate signing secret
        run: |
          if [[ -z "$SPARKLE_PRIVATE_KEY" ]]; then
            echo "Required GitHub secret is missing: SPARKLE_PRIVATE_KEY" >&2
            exit 1
          fi

      - name: Build and package universal update
        env:
          QUERYCRAFT_RELEASE_VERSION: ${{ needs.metadata.outputs.version }}
          QUERYCRAFT_RELEASE_BUILD: ${{ needs.metadata.outputs.build }}
          DERIVED_DATA_ROOT: ${{ runner.temp }}/querycraft-derived-data
        run: scripts/ci/build-release-artifacts.sh arm64 artifacts/update

      - name: Remove temporary signing keychain
        if: always()
        run: python3 scripts/code-signing.py cleanup-ci

      - uses: actions/upload-artifact@v7
        with:
          name: querycraft-release-client-update
          path: artifacts/update/
          if-no-files-found: error
          retention-days: 14

  build_drivers:
    needs: metadata
    if: needs.metadata.outputs.publish_drivers == 'true' && (needs.metadata.outputs.source_run_id == '' || needs.metadata.outputs.rebuild_driver != 'none')
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      max-parallel: 10
      matrix:
        database: ${{ fromJSON(needs.metadata.outputs.driver_matrix) }}
        architecture:
          - x86_64
          - arm64
        include:
          - architecture: x86_64
            runner: macos-15-intel
          - architecture: arm64
            runner: macos-15
    env:
      QUERYCRAFT_UPDATE_BASE_URL: https://querycraft.debug-tools.cc
      QUERYCRAFT_DRIVER_DOWNLOAD_BASE_URL: https://querycraft.debug-tools.cc/drivers
      QUERYCRAFT_BUILD_CLIENT: false
      QUERYCRAFT_BUILD_DRIVERS: true
      QUERYCRAFT_BUILD_UNIVERSAL_UPDATE: false
      QUERYCRAFT_DRIVER_TARGET: ${{ matrix.database }}
    steps:
      - uses: actions/checkout@v7

      - name: Select Xcode 26.2
        run: sudo xcode-select -s /Applications/Xcode_26.2.app/Contents/Developer

      - name: Install XcodeBuildMCP
        run: npm install --global xcodebuildmcp@2.6.2

      - name: Install Kafka native dependencies
        if: matrix.database == 'kafka'
        run: |
          brew install librdkafka pkgconf
          echo "LIBRDKAFKA_PREFIX=$(brew --prefix librdkafka)" >> "$GITHUB_ENV"
          echo "LIBZSTD_PREFIX=$(brew --prefix zstd)" >> "$GITHUB_ENV"
          pkg-config --exists rdkafka

      - name: Build and package ${{ matrix.database }} driver
        env:
          QUERYCRAFT_RELEASE_VERSION: ${{ needs.metadata.outputs.version }}
          QUERYCRAFT_RELEASE_BUILD: ${{ needs.metadata.outputs.build }}
          DERIVED_DATA_ROOT: ${{ runner.temp }}/querycraft-derived-data
        run: scripts/ci/build-release-artifacts.sh "${{ matrix.architecture }}" "artifacts/${{ matrix.database }}-${{ matrix.architecture }}"

      - uses: actions/upload-artifact@v7
        with:
          name: querycraft-release-driver-${{ matrix.database }}-${{ matrix.architecture }}
          path: artifacts/${{ matrix.database }}-${{ matrix.architecture }}/
          if-no-files-found: error
          retention-days: 14

  publish:
    needs:
      - metadata
      - build_client
      - build_update
      - build_drivers
    if: >-
      ${{
        always() &&
        needs.metadata.result == 'success' &&
        (
          needs.metadata.outputs.publish == 'true' ||
          needs.metadata.outputs.publish_drivers == 'true'
        ) &&
        (
          (
            needs.metadata.outputs.source_run_id != '' &&
            (
              needs.metadata.outputs.rebuild_driver == 'none' ||
              needs.build_drivers.result == 'success'
            )
          ) ||
          (
            (
              needs.metadata.outputs.build_client != 'true' ||
              (
                needs.build_client.result == 'success' &&
                needs.build_update.result == 'success'
              )
            ) &&
            (
              needs.metadata.outputs.publish_drivers != 'true' ||
              needs.build_drivers.result == 'success'
            )
          )
        )
      }}
    runs-on: ubuntu-latest
    environment: production
    permissions:
      actions: read
      contents: write
    env:
      QUERYCRAFT_RESOURCE_DEPLOY_URL: ${{ vars.QUERYCRAFT_RESOURCE_DEPLOY_URL || 'https://querycraft.debug-tools.cc/admin/resources/deploy' }}
      QUERYCRAFT_RESOURCE_DEPLOY_TOKEN: ${{ secrets.QUERYCRAFT_RESOURCE_DEPLOY_TOKEN }}
      QUERYCRAFT_UPDATE_BASE_URL: https://querycraft.debug-tools.cc
      QUERYCRAFT_DEPLOY_CLIENT: ${{ needs.metadata.outputs.publish }}
      QUERYCRAFT_DEPLOY_DRIVERS: ${{ needs.metadata.outputs.publish_drivers }}
      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@v7

      - name: Install publish dependencies
        run: |
          sudo apt-get update
          sudo apt-get install --yes libxml2-utils

      - uses: actions/download-artifact@v8
        if: needs.metadata.outputs.source_run_id == ''
        with:
          pattern: querycraft-release-*
          path: dist
          merge-multiple: true

      - uses: actions/download-artifact@v8
        if: needs.metadata.outputs.source_run_id != ''
        with:
          pattern: querycraft-release-*
          path: dist
          merge-multiple: true
          github-token: ${{ github.token }}
          run-id: ${{ needs.metadata.outputs.source_run_id }}

      - name: Download rebuilt driver artifacts
        uses: actions/download-artifact@v8
        if: needs.metadata.outputs.source_run_id != '' && needs.metadata.outputs.rebuild_driver != 'none'
        with:
          pattern: querycraft-release-driver-${{ needs.metadata.outputs.rebuild_driver }}-*
          path: dist
          merge-multiple: true

      - name: Publish selected resources
        run: scripts/deploy-release-artifacts.sh "${{ needs.metadata.outputs.version }}" dist

      - name: Synchronize canonical published download URLs
        run: python3 scripts/ci/sync-published-release-metadata.py dist

      - name: Create or update GitHub client release
        if: needs.metadata.outputs.publish == 'true'
        env:
          RELEASE_TAG: v${{ needs.metadata.outputs.version }}
        run: |
          set -euo pipefail
          if ! gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            gh release create "$RELEASE_TAG" \
              --verify-tag \
              --title "QueryCraft ${{ needs.metadata.outputs.version }}" \
              --notes-file "docs/releases/${{ needs.metadata.outputs.version }}.md"
          fi
          gh release upload "$RELEASE_TAG" --clobber \
            dist/QueryCraft-*.dmg \
            dist/QueryCraft-*.zip \
            dist/appcast.xml \
            dist/release-notes.md

      - name: Update GitHub driver assets
        if: needs.metadata.outputs.publish_drivers == 'true'
        env:
          RELEASE_TAG: v${{ needs.metadata.outputs.version }}
        run: |
          set -euo pipefail
          gh release view "$RELEASE_TAG" >/dev/null
          gh release upload "$RELEASE_TAG" --clobber \
            dist/*-driver-*.zip \
            dist/*-x86_64.json \
            dist/*-arm64.json