cli-release-build.yml

name: Build CLI Binary

on:
  workflow_call:
    inputs:
      binary-name:
        required: true
        type: string
        description: 'Name of the CLI binary to build'
      new-version:
        required: true
        type: string
        description: 'Version string for the build'
      artifact-name:
        required: false
        type: string
        description: 'Optional artifact containing staging metadata'
        default: ''
      checkout-ref:
        required: false
        type: string
        description: 'Git ref to checkout'
        default: ''
      env-overrides:
        required: false
        type: string
        description: 'JSON object of environment variable overrides'
        default: '{}'

jobs:
  build-binaries:
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            target: linux-x64
            bun_target: bun-linux-x64
            platform: linux
            arch: x64
          - os: ubuntu-latest
            target: linux-arm64
            bun_target: bun-linux-arm64
            platform: linux
            arch: arm64
            # Cross-compiles on x64 runner; binary can't be executed here.
            smoke_test: false
          - os: macos-15-intel
            target: darwin-x64
            bun_target: bun-darwin-x64
            platform: darwin
            arch: x64
          - os: macos-14
            target: darwin-arm64
            bun_target: bun-darwin-arm64
            platform: darwin
            arch: arm64
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.checkout-ref || github.sha }}

      - uses: ./.github/actions/setup-project

      - name: Download staging metadata
        if: inputs.artifact-name != ''
        uses: actions/download-artifact@v8
        with:
          name: ${{ inputs.artifact-name }}
          path: cli/release-staging/

      - name: Ensure CLI dependencies
        run: bun install --frozen-lockfile --cwd cli

      - name: Fix OpenTUI module symlinks
        shell: bash
        run: |
          set -euo pipefail
          bun - <<'BUN'
          import fs from 'fs';
          import path from 'path';

          const rootDir = process.cwd();
          const rootOpenTui = path.join(rootDir, 'node_modules', '@opentui');
          const cliNodeModules = path.join(rootDir, 'cli', 'node_modules');
          const cliOpenTui = path.join(cliNodeModules, '@opentui');

          if (!fs.existsSync(rootOpenTui)) {
            console.log('Root @opentui packages missing; skipping fix');
            process.exit(0);
          }

          fs.mkdirSync(cliOpenTui, { recursive: true });

          const packages = ['core', 'react'];
          for (const pkg of packages) {
            const target = path.join(rootOpenTui, pkg);
            const link = path.join(cliOpenTui, pkg);

            if (!fs.existsSync(target)) {
              console.log(`Target ${target} missing; skipping ${pkg}`);
              continue;
            }

            let linkStats = null;
            try {
              linkStats = fs.lstatSync(link);
            } catch (error) {
              if (error?.code !== 'ENOENT') {
                throw error;
              }
            }

            if (linkStats) {
              let alreadyLinked = false;
              try {
                const actual = fs.realpathSync(link);
                alreadyLinked = actual === target;
              } catch {
                // Broken symlink or unreadable target; we'll replace it.
              }

              if (alreadyLinked) {
                continue;
              }

              fs.rmSync(link, { recursive: true, force: true });
            }

            const type = process.platform === 'win32' ? 'junction' : 'dir';
            try {
              fs.symlinkSync(target, link, type);
              console.log(`Linked ${link} -> ${target}`);
            } catch (error) {
              if (error?.code === 'EEXIST') {
                fs.rmSync(link, { recursive: true, force: true });
                fs.symlinkSync(target, link, type);
                console.log(`Re-linked ${link} -> ${target}`);
              } else {
                throw error;
              }
            }
          }
          BUN

      - name: Configure environment variables
        env:
          SECRETS_CONTEXT: ${{ toJSON(secrets) }}
          ENV_OVERRIDES: ${{ inputs.env-overrides }}
        shell: bash
        run: |
          VAR_NAMES=$(bun scripts/generate-ci-env.ts --scope client)

          echo "$SECRETS_CONTEXT" | jq -r --argjson vars "$VAR_NAMES" '
            to_entries | .[] | select(.key as $k | $vars | index($k)) | .key + "=" + .value
          ' >> $GITHUB_ENV
          echo "CODEBUFF_GITHUB_ACTIONS=true" >> $GITHUB_ENV
          echo "ICECODE_GITHUB_TOKEN=${{ secrets.ICECODE_GITHUB_TOKEN }}" >> $GITHUB_ENV
          if [ "$ENV_OVERRIDES" != "{}" ]; then
            echo "$ENV_OVERRIDES" | jq -r 'to_entries | .[] | .key + "=" + .value' >> $GITHUB_ENV
          fi

      - name: Build binary
        run: bun run scripts/build-binary.ts ${{ inputs.binary-name }} ${{ inputs.new-version }}
        working-directory: cli
        shell: bash
        env:
          VERBOSE: true
          OVERRIDE_TARGET: ${{ matrix.bun_target }}
          OVERRIDE_PLATFORM: ${{ matrix.platform }}
          OVERRIDE_ARCH: ${{ matrix.arch }}

      - name: Smoke test binary
        if: matrix.smoke_test != false
        shell: bash
        run: |
          cd cli/bin
          if [[ "${{ runner.os }}" == "Windows" ]]; then
            BIN="./${{ inputs.binary-name }}.exe"
          else
            BIN="./${{ inputs.binary-name }}"
          fi

          # Fast path: --version exits synchronously through commander, so it
          # only catches early sync failures. Run it for parity with old CI.
          "$BIN" --version

          # Slow path: keep the binary alive long enough for *async* startup
          # failures (e.g. the Parser.init rejection that crashed the
          # post-OpenTUI-upgrade Windows build) to surface in stdout/stderr.
          bun ../scripts/smoke-binary.ts "$BIN"

      - name: Create tarball
        shell: bash
        run: |
          BINARY_FILE="${{ inputs.binary-name }}"
          if [[ "${{ runner.os }}" == "Windows" ]]; then
            BINARY_FILE="${{ inputs.binary-name }}.exe"
          fi
          # Bundle the binary alongside tree-sitter.wasm — the CLI loads
          # the wasm as a sibling file at runtime since bun --compile
          # asset embedding wasn't reliable on Windows.
          tar -czf ${{ inputs.binary-name }}-${{ matrix.target }}.tar.gz -C cli/bin "$BINARY_FILE" tree-sitter.wasm

      - name: Upload binary artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ inputs.binary-name }}-${{ matrix.target }}
          path: ${{ inputs.binary-name }}-${{ matrix.target }}.tar.gz

  build-windows-binary:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.checkout-ref || github.sha }}

      - uses: ./.github/actions/setup-project

      - name: Download staging metadata
        if: inputs.artifact-name != ''
        uses: actions/download-artifact@v8
        with:
          name: ${{ inputs.artifact-name }}
          path: cli/release-staging/

      - name: Ensure CLI dependencies
        run: bun install --frozen-lockfile --cwd cli

      - name: Fix OpenTUI module symlinks
        shell: bash
        run: |
          set -euo pipefail
          bun - <<'BUN'
          import fs from 'fs';
          import path from 'path';

          const rootDir = process.cwd();
          const rootOpenTui = path.join(rootDir, 'node_modules', '@opentui');
          const cliNodeModules = path.join(rootDir, 'cli', 'node_modules');
          const cliOpenTui = path.join(cliNodeModules, '@opentui');

          if (!fs.existsSync(rootOpenTui)) {
            console.log('Root @opentui packages missing; skipping fix');
            process.exit(0);
          }

          fs.mkdirSync(cliOpenTui, { recursive: true });

          const packages = ['core', 'react'];
          for (const pkg of packages) {
            const target = path.join(rootOpenTui, pkg);
            const link = path.join(cliOpenTui, pkg);

            if (!fs.existsSync(target)) {
              console.log(`Target ${target} missing; skipping ${pkg}`);
              continue;
            }

            let linkStats = null;
            try {
              linkStats = fs.lstatSync(link);
            } catch (error) {
              if (error?.code !== 'ENOENT') {
                throw error;
              }
            }

            if (linkStats) {
              let alreadyLinked = false;
              try {
                const actual = fs.realpathSync(link);
                alreadyLinked = actual === target;
              } catch {
                // Broken symlink or unreadable target; we'll replace it.
              }

              if (alreadyLinked) {
                continue;
              }

              fs.rmSync(link, { recursive: true, force: true });
            }

            const type = process.platform === 'win32' ? 'junction' : 'dir';
            try {
              fs.symlinkSync(target, link, type);
              console.log(`Linked ${link} -> ${target}`);
            } catch (error) {
              if (error?.code === 'EEXIST') {
                fs.rmSync(link, { recursive: true, force: true });
                fs.symlinkSync(target, link, type);
                console.log(`Re-linked ${link} -> ${target}`);
              } else {
                throw error;
              }
            }
          }
          BUN

      - name: Configure environment variables
        env:
          SECRETS_CONTEXT: ${{ toJSON(secrets) }}
          ENV_OVERRIDES: ${{ inputs.env-overrides }}
        shell: bash
        run: |
          VAR_NAMES=$(bun scripts/generate-ci-env.ts --scope client)

          echo "$SECRETS_CONTEXT" | jq -r --argjson vars "$VAR_NAMES" '
            to_entries | .[] | select(.key as $k | $vars | index($k)) | .key + "=" + .value
          ' >> $GITHUB_ENV
          echo "CODEBUFF_GITHUB_ACTIONS=true" >> $GITHUB_ENV
          echo "ICECODE_GITHUB_TOKEN=${{ secrets.ICECODE_GITHUB_TOKEN }}" >> $GITHUB_ENV
          if [ "$ENV_OVERRIDES" != "{}" ]; then
            echo "$ENV_OVERRIDES" | jq -r 'to_entries | .[] | .key + "=" + .value' >> $GITHUB_ENV
          fi

      - name: Prepare Windows Bun compile runtime
        uses: ./.github/actions/setup-bun-compile-runtime
        with:
          target: bun-windows-x64

      - name: Build binary
        run: bun run scripts/build-binary.ts ${{ inputs.binary-name }} ${{ inputs.new-version }}
        working-directory: cli
        shell: bash
        env:
          VERBOSE: true
          OVERRIDE_TARGET: bun-windows-x64
          OVERRIDE_PLATFORM: win32
          OVERRIDE_ARCH: x64

      - name: Smoke test binary
        shell: bash
        run: |
          cd cli/bin
          BIN="./${{ inputs.binary-name }}.exe"

          # Sync check — exits via commander before async tasks fire.
          "$BIN" --version

          # Long-running check — gives async startup failures time to surface.
          # This is the step that would have caught the post-OpenTUI-upgrade
          # tree-sitter wasm crash on Windows.
          bun ../scripts/smoke-binary.ts "$BIN"

      - name: Create tarball
        shell: bash
        run: |
          BINARY_FILE="${{ inputs.binary-name }}.exe"
          # Bundle tree-sitter.wasm next to the binary; see the
          # equivalent matrix-job tar step for context.
          tar -czf ${{ inputs.binary-name }}-win32-x64.tar.gz -C cli/bin "$BINARY_FILE" tree-sitter.wasm

      - name: Upload binary artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ inputs.binary-name }}-win32-x64
          path: ${{ inputs.binary-name }}-win32-x64.tar.gz