name: release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    name: ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            target: x86_64-unknown-linux-gnu
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          key: release-${{ matrix.target }}

      - name: Build
        run: cargo build --release --locked --target ${{ matrix.target }}

      - name: Pack
        run: |
          set -euo pipefail
          bin="target/${{ matrix.target }}/release/onionwire"
          strip "$bin"
          asset="onionwire-${{ matrix.target }}"
          mkdir -p dist
          cp "$bin" "dist/${asset}"
          (cd dist && sha256sum "${asset}" > "${asset}.sha256")
          ls -l dist

      - uses: actions/upload-artifact@v4
        with:
          name: onionwire-${{ matrix.target }}
          path: dist/*
          if-no-files-found: error

  publish:
    needs: build
    runs-on: ubuntu-24.04
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: Checksums
        run: |
          set -euo pipefail
          cd dist
          ls -l
          cat *.sha256

      - uses: softprops/action-gh-release@v2
        with:
          files: dist/*
          generate_release_notes: true
          fail_on_unmatched_files: true
          body: |
            Prebuilt Linux binaries. No `tor` package required.

            ```bash
            # x86_64 — keep the asset filename so sha256sum -c matches
            curl -fL -O https://github.com/sirius0xdev/onionwire/releases/download/${{ github.ref_name }}/onionwire-x86_64-unknown-linux-gnu
            curl -fL -O https://github.com/sirius0xdev/onionwire/releases/download/${{ github.ref_name }}/onionwire-x86_64-unknown-linux-gnu.sha256
            sha256sum -c onionwire-x86_64-unknown-linux-gnu.sha256
            chmod +x onionwire-x86_64-unknown-linux-gnu
            ./onionwire-x86_64-unknown-linux-gnu --version
            ./onionwire-x86_64-unknown-linux-gnu
            ```

            See the README install guide for aarch64, checksums, and building from source.