release.yml

# tags a v* push. builds a release binary per platform, runs the suites
# that can run there, publishes a tarball each. no release goes out with
# a failing suite on the platform that built it.
name: release

on:
  push:
    tags:
      - 'v*'

jobs:
  release-linux:
    name: build and publish (linux x86-64)
    runs-on: ubuntu-24.04
    # Pinned rather than floating. ubuntu-latest migrates without warning --
    # it is scheduled to become 26.04 -- and a new runner image means new
    # preinstalled compilers, which is how a green build goes red with no
    # code changing. Bump deliberately, after watching a full run go green
    # on the new image.
    permissions:
      contents: write

    steps:
    - uses: actions/checkout@v5
      # v4 targets Node 20, which the runners now shim with a deprecation
      # notice on every job. v5 targets the current runtime.

    - name: configure ccache
      run: |
        sudo apt-get update && sudo apt-get install -y ccache
        ccache --max-size=50M
        ccache -z

    - name: release build
      run: make clean && make release

    - name: language tests
      run: make test

    - name: unit tests
      run: make unit

    # a release is the one build where the sanitizers are not optional.
    # `make test` alone is the language suite and never sees asan, so a
    # regression that only shows up there would ship.
    #
    # no `make clean` before this. stress builds into its own object tree
    # and leaves ./flint alone, and a clean here deletes the binary two steps
    # before it gets packaged. which it did, once.
    - name: gc stress and sanitizers
      run: make stress

    # The binary alone is not a usable release: `import encoding` looks for
    # lib/ beside the executable, so a tarball with only `flint` in it fails
    # every import that is not a source-relative module. The library ships
    # in the same tarball for exactly that reason.
    - name: package
      run: |
        mkdir -p stage
        cp flint stage/flint
        cp -r lib stage/lib
        cp README.md SPEC.md RELEASES.md LICENSE stage/
        tar -czvf flint-${{ github.ref_name }}-linux-x86_64.tar.gz -C stage .

    - name: smoke test the artifact
      run: |
        # unpack what was just built and use it the way a person would, so a
        # tarball that cannot import its own standard library fails here
        # rather than in someone else's shell.
        rm -rf verify && mkdir verify
        tar -xzf flint-${{ github.ref_name }}-linux-x86_64.tar.gz -C verify
        chmod +x verify/flint
        cd verify
        ./flint --version
        ./flint -e 'import encoding
        print(encoding.base64_encode("flint"))'

    - name: publish
      uses: softprops/action-gh-release@v2
      with:
        files: flint-${{ github.ref_name }}-linux-x86_64.tar.gz
        generate_release_notes: false
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  release-macos:
    name: build and publish (macOS arm64)
    # arm64 only: the hosted x86_64 macOS runners are retired, and a
    # cross-compiled artifact this workflow cannot run is an artifact that
    # ships untested. the tarball says arm64 because that is what ran it.
    runs-on: macos-14
    permissions:
      contents: write

    steps:
    - uses: actions/checkout@v5

    - name: release build
      run: make clean && make release

    - name: language tests
      run: make test

    - name: unit tests
      run: make unit

    # the native suite builds real shared objects and loads them: the same
    # dlopen path the tarball's users get, including the rust modules.
    - name: native tests
      run: make native-test

    - name: package
      run: |
        mkdir -p stage
        cp flint stage/flint
        cp -r lib stage/lib
        cp README.md SPEC.md RELEASES.md LICENSE stage/
        tar -czvf flint-${{ github.ref_name }}-macos-arm64.tar.gz -C stage .

    - name: smoke test the artifact
      run: |
        rm -rf verify && mkdir verify
        tar -xzf flint-${{ github.ref_name }}-macos-arm64.tar.gz -C verify
        chmod +x verify/flint
        cd verify
        ./flint --version
        ./flint -e 'import encoding
        print(encoding.base64_encode("flint"))'

    - name: publish
      uses: softprops/action-gh-release@v2
      with:
        files: flint-${{ github.ref_name }}-macos-arm64.tar.gz
        generate_release_notes: false
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  release-windows:
    name: build and publish (windows x86-64)
    # mingw64, not msys and not msvc: the codebase is C11 with the POSIX
    # gaps closed by _WIN32 branches, validated against mingw-w64 headers
    # by the CI probe. the tarball says what built it.
    runs-on: windows-latest
    defaults:
      run:
        shell: msys2 {0}
    permissions:
      contents: write

    steps:
    - uses: actions/checkout@v5
    - uses: msys2/setup-msys2@v2
      with:
        msystem: MINGW64
        update: true
        install: >-
          base-devel
          mingw-w64-x86_64-gcc
          mingw-w64-x86_64-make

    # CC names the mingw compiler explicitly so a PATH change cannot
    # silently substitute the emulated msys gcc, which would prove
    # nothing about Windows.
    - name: release build
      run: make clean && make release CC=x86_64-w64-mingw32-gcc

    # the suites that can pass here: spawning and signals are refused by
    # design, and the suite asserts the refusals. the language suite is
    # the artifact's test.
    - name: language tests
      run: make test CC=x86_64-w64-mingw32-gcc

    - name: unit tests
      run: make unit CC=x86_64-w64-mingw32-gcc

    - name: package
      run: |
        mkdir -p stage
        cp flint.exe stage/flint.exe
        cp -r lib stage/lib
        cp README.md SPEC.md RELEASES.md LICENSE stage/
        tar -czvf flint-${{ github.ref_name }}-windows-x86_64.tar.gz -C stage .

    - name: smoke test the artifact
      run: |
        rm -rf verify && mkdir verify
        tar -xzf flint-${{ github.ref_name }}-windows-x86_64.tar.gz -C verify
        cd verify
        ./flint.exe --version
        ./flint.exe -e 'import encoding
        print(encoding.base64_encode("flint"))'

    - name: publish
      uses: softprops/action-gh-release@v2
      with:
        files: flint-${{ github.ref_name }}-windows-x86_64.tar.gz
        generate_release_notes: false
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}