release.yml

# A v* tag runs goreleaser: server binaries + silkd, checksums, changelog.
# SDK packages release separately via sdk-*-v* tags (publish-pypi.yml).
name: release

on:
  push:
    tags: ["v*"]

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: sandboxd/go.mod
      - name: Build silkd (musl static)
        run: |
          rustup target add x86_64-unknown-linux-musl
          sudo apt-get update && sudo apt-get install -y --no-install-recommends musl-tools
          (cd silkd && cargo build --release --target x86_64-unknown-linux-musl)
          strip silkd/target/x86_64-unknown-linux-musl/release/silkd
          mkdir -p dist-extra
          tar -C silkd/target/x86_64-unknown-linux-musl/release \
            -czf "dist-extra/silkd_${GITHUB_REF_NAME#v}_Linux_x86_64.tar.gz" silkd
          tar -C silkd/target/x86_64-unknown-linux-musl/release \
            -czf "dist-extra/silkd_Linux_x86_64.tar.gz" silkd
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Build silkd (musl static, arm64)
        # Emulated cargo build via the carrier Dockerfile — byte-consistent
        # with the image artifact; slow but release-rare.
        # Intermediates live outside the worktree: goreleaser refuses a dirty
        # git state, and only dist-extra/ is gitignored.
        run: |
          docker buildx build --platform linux/arm64 -o type=local,dest=/tmp/silkd-arm64 silkd
          mkdir -p /tmp/silkd-dist && cp /tmp/silkd-arm64/silkd-static /tmp/silkd-dist/silkd
          tar -C /tmp/silkd-dist -czf "dist-extra/silkd_${GITHUB_REF_NAME#v}_Linux_arm64.tar.gz" silkd
          tar -C /tmp/silkd-dist -czf "dist-extra/silkd_Linux_arm64.tar.gz" silkd
      - name: goreleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ github.token }}
          GORELEASER_CURRENT_TAG: ${{ github.ref_name }}