cli-release.yml

name: CLI Release

# Triggered by pushing a tag like `cli-v0.1.0`. Builds standalone binaries for
# linux-x64, darwin-x64+arm64, and windows-x64 using Bun's --compile, then
# attaches them to a GitHub Release alongside SHA256SUMS for verification.
#
# Bun cross-compiles from any host, so we run the whole matrix on one Linux
# runner.

on:
  push:
    tags:
      - "cli-v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g. cli-v0.1.0). When run via workflow_dispatch, no GitHub Release is created — artifacts are uploaded for manual download only."
        required: true

jobs:
  compile:
    name: Compile binaries
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write  # npm provenance
    steps:
      - uses: actions/checkout@v6

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "npm"
          registry-url: "https://registry.npmjs.org"
          scope: "@cryptohopper"

      - name: Install CLI deps
        run: npm ci

      - name: Typecheck
        run: npx tsc --noEmit

      - name: Verify package version matches tag
        if: startsWith(github.ref, 'refs/tags/cli-v')
        run: |
          TAG="${GITHUB_REF_NAME#cli-v}"
          PKG=$(node -p "require('./package.json').version")
          if [ "$TAG" != "$PKG" ]; then
            echo "Tag $GITHUB_REF_NAME (→ $TAG) does not match package.json $PKG"
            exit 1
          fi

      - name: Build Node dist (tsup)
        run: npm run build

      - name: Publish to npm with provenance
        if: startsWith(github.ref, 'refs/tags/cli-v')
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Compile (linux-x64)
        run: npm run compile:linux-x64

      - name: Compile (darwin-x64)
        run: npm run compile:darwin-x64

      - name: Compile (darwin-arm64)
        run: npm run compile:darwin-arm64

      - name: Compile (windows-x64)
        run: npm run compile:windows-x64

      - name: Generate SHA256SUMS
        working-directory: dist
        run: |
          sha256sum cryptohopper-linux-x64 cryptohopper-darwin-x64 cryptohopper-darwin-arm64 cryptohopper-windows-x64.exe > SHA256SUMS
          cat SHA256SUMS

      - name: List build artifacts
        working-directory: dist
        run: ls -lh cryptohopper-* SHA256SUMS

      - name: Upload artifacts (workflow_dispatch only)
        if: github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v7
        with:
          name: cryptohopper-cli-binaries
          path: |
            dist/cryptohopper-linux-x64
            dist/cryptohopper-darwin-x64
            dist/cryptohopper-darwin-arm64
            dist/cryptohopper-windows-x64.exe
            dist/SHA256SUMS
          retention-days: 14

      - name: Create GitHub Release
        if: startsWith(github.ref, 'refs/tags/cli-v')
        uses: softprops/action-gh-release@v3
        with:
          name: ${{ github.ref_name }}
          prerelease: ${{ contains(github.ref_name, '-alpha') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-rc') }}
          generate_release_notes: true
          fail_on_unmatched_files: true
          files: |
            dist/cryptohopper-linux-x64
            dist/cryptohopper-darwin-x64
            dist/cryptohopper-darwin-arm64
            dist/cryptohopper-windows-x64.exe
            dist/SHA256SUMS
          body: |
            ## Install

            **npm (any platform with Node 20+)**
            ```bash
            npm i -g @cryptohopper/cli
            # or one-shot:
            npx @cryptohopper/cli login
            ```

            The Bun-compiled binaries below are the recommended path for non-Node users (faster cold start, no Node dependency).

            **macOS (Apple Silicon)**
            ```bash
            curl -L https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/cryptohopper-darwin-arm64 -o /usr/local/bin/cryptohopper
            chmod +x /usr/local/bin/cryptohopper
            ```

            **macOS (Intel)**
            ```bash
            curl -L https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/cryptohopper-darwin-x64 -o /usr/local/bin/cryptohopper
            chmod +x /usr/local/bin/cryptohopper
            ```

            **Linux x64**
            ```bash
            curl -L https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/cryptohopper-linux-x64 -o /usr/local/bin/cryptohopper
            chmod +x /usr/local/bin/cryptohopper
            ```

            **Windows x64**

            Download `cryptohopper-windows-x64.exe`, rename to `cryptohopper.exe`, put it on `%PATH%`.

            > **First-launch warnings:** these binaries are **not yet code-signed**. macOS will block them with a Gatekeeper prompt — right-click → Open the first time, or run `xattr -d com.apple.quarantine /usr/local/bin/cryptohopper`. Windows will show a SmartScreen warning — click "More info" → "Run anyway".

            ## Verify

            ```bash
            sha256sum -c SHA256SUMS
            ```

            Then run `cryptohopper login`.