docmd-io--docmd/.github/workflows/npm-publish.yml

name: Release docmd to NPM

on:
  release:
    types: [published]
  workflow_dispatch:

permissions:
  contents: read
  id-token: write
  packages: write

# ---------------------------------------------------------------------------
# Job 1: Build Rust native binaries (matrix, one runner per platform)
#
# Each runner compiles the napi-rs addon for its target, then uploads the
# resulting .node file as a workflow artifact. The publish job downloads
# all artifacts and places them in rust-binaries/bin/ before publishing.
# ---------------------------------------------------------------------------
jobs:
  build-native:
    name: Build native (${{ matrix.target }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest        # Apple Silicon runner (M-series)
            target: aarch64-apple-darwin
            binary: docmd-engine-darwin-arm64.node
            lib: libdocmd_engine.dylib

          - os: macos-latest        # Cross-compile Intel binary on ARM64 runner (Faster)
            target: x86_64-apple-darwin
            binary: docmd-engine-darwin-x64.node
            lib: libdocmd_engine.dylib

          - os: ubuntu-latest        # Cross-compile Linux x64 binary on ARM64 runner (Faster)
            target: x86_64-unknown-linux-gnu
            binary: docmd-engine-linux-x64.node
            lib: libdocmd_engine.so

          - os: ubuntu-24.04-arm     # GitHub-hosted ARM64 Linux runner
            target: aarch64-unknown-linux-gnu
            binary: docmd-engine-linux-arm64.node
            lib: libdocmd_engine.so

          - os: windows-latest       # Cross-compile Windows x64 binary on ARM64 runner (Faster)
            target: x86_64-pc-windows-msvc
            binary: docmd-engine-win32-x64.node
            lib: docmd_engine.dll

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v7

      - name: Install Rust toolchain
        run: |
          rustup toolchain install stable --profile minimal --target ${{ matrix.target }}
          rustup default stable

      - name: Cache Rust build
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: packages/engines/rust-binaries/native

      - name: Debug cargo environment
        run: |
          echo "PATH: $PATH"
          which cargo
          cargo --version
          rustup show

      - name: Build native addon
        working-directory: packages/engines/rust-binaries/native
        run: cargo build --release --target ${{ matrix.target }}

      # Copy the built library to bin/ with the correct name
      - name: Collect binary (Unix)
        if: runner.os != 'Windows'
        run: |
          mkdir -p packages/engines/rust-binaries/bin
          cp packages/engines/rust-binaries/native/target/${{ matrix.target }}/release/${{ matrix.lib }} \
             packages/engines/rust-binaries/bin/${{ matrix.binary }}

      - name: Collect binary (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path packages/engines/rust-binaries/bin
          Copy-Item "packages/engines/rust-binaries/native/target/${{ matrix.target }}/release/${{ matrix.lib }}" `
                    "packages/engines/rust-binaries/bin/${{ matrix.binary }}"

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: native-${{ matrix.target }}
          path: packages/engines/rust-binaries/bin/${{ matrix.binary }}
          if-no-files-found: error

  # ---------------------------------------------------------------------------
  # Job 2: Publish all packages to npm
  #
  # Runs after all matrix builds succeed. Downloads every .node artifact into
  # rust-binaries/bin/ so the package contains the binaries when npm publish runs.
  # ---------------------------------------------------------------------------
  publish:
    name: Publish to npm
    needs: build-native
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7

      - name: Install pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'
          cache: 'pnpm'

      - name: Upgrade npm (required for OIDC provenance)
        run: npm install -g npm@11.12.1

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts

      # Download all .node binaries built by the matrix into rust-binaries/bin/
      - name: Download native binaries
        uses: actions/download-artifact@v8
        with:
          pattern: native-*
          path: packages/engines/rust-binaries/bin
          merge-multiple: true

      - name: Verify binaries
        run: ls -lh packages/engines/rust-binaries/bin/

      # Build TypeScript for all packages
      - name: Build packages
        run: pnpm -r run build

      - name: Run verification
        run: pnpm verify --skip-setup

      - name: Copy LICENSE into each package
        run: |
          find packages -mindepth 1 -maxdepth 4 -name "package.json" \
            -not -path "*/node_modules/*" \
            -exec dirname {} \; | xargs -I % cp LICENSE %

      - name: Resolve workspace dependencies
        run: node tools/resolve-ws-deps.js

      - name: Publish to npm
        run: |
          for dir in packages/* packages/legacy/* packages/plugins/* packages/engines/* packages/templates/*; do
            if [ -f "$dir/package.json" ]; then
              # Skip private packages
              if grep -q '"private": true' "$dir/package.json"; then
                echo "::notice::Skipping $dir: private package"
                continue
              fi
              echo "Publishing $dir..."
              exit_code=0
              publish_output=$(npm publish "./$dir" --access public --provenance 2>&1) || exit_code=$?
              if [ $exit_code -ne 0 ]; then
                if echo "$publish_output" | grep -q 'previously published versions\|EPRIVATE'; then
                  echo "::notice::Skipping $dir: Already published or private."
                else
                  echo "::error::Failed to publish $dir"
                  echo "$publish_output"
                  exit 1
                fi
              fi
            fi
          done