release.yml

name: Release

on:
  push:
    tags:
      - 'v[0-9]*.[0-9]*.[0-9]*'

jobs:
  build:
    strategy:
      matrix:
        include:
          - runner: macos-latest
            target: aarch64-apple-darwin
            node_target: darwin-arm64
          - runner: macos-15-intel
            target: x86_64-apple-darwin
            node_target: darwin-x64
          - runner: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            node_target: linux-x64
          - runner: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            node_target: linux-arm64
          - runner: windows-2022
            target: x86_64-pc-windows-gnu
            node_target: win32-x64
    runs-on: ${{ matrix.runner }}
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      # Windows cgo build needs a GCC toolchain (pg_query_go uses -std=gnu99)
      - name: Set up MinGW (Windows)
        if: runner.os == 'Windows'
        uses: msys2/setup-msys2@v2
        with:
          msystem: MINGW64
          install: mingw-w64-x86_64-gcc
          path-type: inherit
      - name: Build
        run: |
          ext=""
          [ "${{ runner.os }}" = "Windows" ] && ext=".exe"
          CGO_ENABLED=1 go build \
            -ldflags "-X github.com/boringsql/dryrun/internal/buildinfo.Version=${GITHUB_REF_NAME}" \
            -o "dryrun${ext}" \
            ./cmd/dryrun
      - name: Archive (tar.xz)
        if: runner.os != 'Windows'
        run: tar -cJf dry_run_cli-${{ matrix.target }}.tar.xz dryrun
      - name: Archive (zip)
        if: runner.os == 'Windows'
        run: 7z a dry_run_cli-${{ matrix.target }}.zip dryrun.exe
      - uses: actions/upload-artifact@v4
        with:
          name: tar-${{ matrix.target }}
          path: dry_run_cli-${{ matrix.target }}.*
          retention-days: 1
      # raw binary for the npm platform packages
      - uses: actions/upload-artifact@v4
        with:
          name: bin-${{ matrix.node_target }}
          path: dryrun${{ runner.os == 'Windows' && '.exe' || '' }}
          retention-days: 1

  release:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          pattern: tar-*
          merge-multiple: true
          path: dist/
      - name: Checksums
        run: cd dist && shasum -a 256 *.tar.xz *.zip > checksums.txt
      - name: Publish release
        run: |
          gh release create "$GITHUB_REF_NAME" \
            --title "$GITHUB_REF_NAME" \
            --generate-notes \
            dist/*.tar.xz dist/*.zip dist/checksums.txt
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  npm-publish:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org
      - uses: actions/download-artifact@v4
        with:
          pattern: bin-*
          path: bins/
      - name: Stage binaries
        run: |
          for t in darwin-arm64 darwin-x64 linux-x64 linux-arm64; do
            mkdir -p npm/packages/$t/bin
            cp bins/bin-$t/dryrun npm/packages/$t/bin/dryrun
            chmod +x npm/packages/$t/bin/dryrun
          done
          mkdir -p npm/packages/win32-x64/bin
          cp bins/bin-win32-x64/dryrun.exe npm/packages/win32-x64/bin/dryrun.exe
      - name: Set versions
        run: node npm/scripts/set-version.mjs "${GITHUB_REF_NAME#v}"
      - name: Publish platform packages
        run: |
          for t in darwin-arm64 darwin-x64 linux-x64 linux-arm64 win32-x64; do
            npm publish --access public ./npm/packages/$t
          done
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
      - name: Publish launcher package
        run: npm publish --access public ./npm/dryrun
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  # Metadata only: the registry resolves @boringsql/dryrun on npm and checks its
  # mcpName against server.json's name, so npm-publish must land first.
  mcp-registry:
    needs: npm-publish
    runs-on: ubuntu-latest
    permissions:
      id-token: write # OIDC; no stored registry credential
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Stamp version into server.json
        run: node npm/scripts/set-version.mjs "${GITHUB_REF_NAME#v}"
      - name: Install mcp-publisher
        run: |
          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
      - name: Validate server.json
        run: ./mcp-publisher validate
      - name: Authenticate to MCP registry
        run: ./mcp-publisher login github-oidc
      - name: Publish to MCP registry
        # npm needs a moment to serve the version the registry is about to fetch
        run: |
          for attempt in 1 2 3; do
            ./mcp-publisher publish && exit 0
            echo "publish attempt $attempt failed; retrying in 30s"
            sleep 30
          done
          exit 1