agent-desktop/.github/workflows/release.yml

name: Release

on:
  push:
    branches: [main]

# One release run per commit — never cancel, just queue.
concurrency:
  group: release-${{ github.sha }}

# Deny all permissions at workflow level; each job declares only what it needs.
permissions: {}

env:
  CARGO_TERM_COLOR: always

jobs:
  release-please:
    name: Release Please
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
      pull-requests: write
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
      version: ${{ steps.release.outputs.major }}.${{ steps.release.outputs.minor }}.${{ steps.release.outputs.patch }}
    steps:
      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
        id: release
        with:
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

  build:
    name: Build (${{ matrix.target }})
    needs: release-please
    if: needs.release-please.outputs.release_created == 'true'
    runs-on: macos-latest
    timeout-minutes: 30
    permissions:
      contents: read
    # Both arch targets build in parallel; one failure doesn't block the other.
    strategy:
      fail-fast: false
      matrix:
        target:
          - aarch64-apple-darwin
          - x86_64-apple-darwin
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.release-please.outputs.tag_name }}

      - name: Install Rust toolchain
        run: |
          rustup show
          rustup target add ${{ matrix.target }}          

      - name: Cache cargo registry
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/            
          key: ${{ runner.os }}-${{ matrix.target }}-cargo-${{ hashFiles('**/Cargo.toml') }}
          restore-keys: ${{ runner.os }}-${{ matrix.target }}-cargo-

      - name: Build release binary
        run: cargo build --release --target ${{ matrix.target }}

      - name: Check binary size
        run: |
          SIZE=$(stat -f%z target/${{ matrix.target }}/release/agent-desktop)
          LIMIT=$((15 * 1024 * 1024))
          echo "Binary size: $(du -sh target/${{ matrix.target }}/release/agent-desktop | cut -f1)"
          if [ "$SIZE" -gt "$LIMIT" ]; then
            echo "FAIL: binary exceeds 15MB limit (${SIZE} bytes)"
            exit 1
          fi          

      - name: Create tarball
        run: |
          VERSION=${{ needs.release-please.outputs.version }}
          TARBALL="agent-desktop-v${VERSION}-${{ matrix.target }}.tar.gz"
          tar -czf "${TARBALL}" -C target/${{ matrix.target }}/release agent-desktop
          shasum -a 256 "${TARBALL}" > "${TARBALL}.sha256"          

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: binary-${{ matrix.target }}
          path: |
            agent-desktop-v*.tar.gz
            agent-desktop-v*.tar.gz.sha256            
          retention-days: 1

  publish-github:
    name: Publish to GitHub Release
    needs: [release-please, build]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: binary-*
          merge-multiple: true

      - name: Create checksums file
        run: |
          cat *.sha256 > checksums.txt
          echo "Checksums:"
          cat checksums.txt          

      - name: Upload assets to GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: |
          gh release upload ${{ needs.release-please.outputs.tag_name }} \
            *.tar.gz checksums.txt \
            --clobber          

  publish-npm:
    name: Publish to npm
    needs: [release-please, publish-github]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.release-please.outputs.tag_name }}

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: '24'
          registry-url: https://registry.npmjs.org

      - name: Verify GitHub Release assets
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          ASSETS=$(gh release view ${{ needs.release-please.outputs.tag_name }} --json assets --jq '.assets | length')
          if [ "$ASSETS" -lt 3 ]; then
            echo "FAIL: expected at least 3 assets (2 tarballs + checksums), found ${ASSETS}"
            exit 1
          fi
          echo "OK: ${ASSETS} assets found on release"          

      - name: Prepare npm package
        run: |
          VERSION=${{ needs.release-please.outputs.version }}
          cd npm
          node -e "
            const pkg = require('./package.json');
            pkg.version = '${VERSION}';
            require('fs').writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
          "
          echo "npm package version set to ${VERSION}"
          cp ../README.md README.md
          cp ../CHANGELOG.md CHANGELOG.md 2>/dev/null || true          

      - name: Publish to npm
        run: npm publish --provenance --access public
        working-directory: npm
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  publish-skills:
    name: Publish Skills to ClawHub
    needs: [release-please]
    if: needs.release-please.outputs.release_created == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.release-please.outputs.tag_name }}

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: '24'

      - name: Install ClawHub CLI
        run: npm i -g clawhub

      - name: Authenticate with ClawHub
        run: clawhub login --token "$CLAWHUB_TOKEN" --no-browser
        env:
          CLAWHUB_TOKEN: ${{ secrets.CLAWHUB_TOKEN }}

      - name: Publish all skills to ClawHub
        run: |
          clawhub sync \
            --root skills/ \
            --all \
            --bump patch \
            --changelog "Release ${{ needs.release-please.outputs.tag_name }}"