release.yml

name: release

on:
  push:
    tags: ['v*']

permissions:
  contents: write

env:
  TJS_VERSION: v26.6.0

jobs:
  # Windows binaries: built here, shipped by the release job below so one
  # checksums.txt covers every asset.
  windows:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v5

      - name: Install MinGW-w64
        run: choco install mingw -y --no-progress

      - name: Build (setup.ps1 — fetch tjs.exe + WebView2 header, compile launcher)
        run: powershell -ExecutionPolicy Bypass -File setup.ps1 -SkipPath

      - name: Stamp version
        run: echo "${env:GITHUB_REF_NAME}" | Out-File -Encoding ascii -NoNewline VERSION

      - name: Assemble zip
        run: |
          $stage = "stage"
          New-Item -ItemType Directory -Force "$stage\bin", "$stage\native" | Out-Null
          Copy-Item bin\tjs.exe "$stage\bin\"
          Copy-Item native\launcher-win.exe "$stage\native\"
          Copy-Item -Recurse runtime, template, test, skill "$stage\"
          # tinyjs.cmd serves cmd/PowerShell; the sh wrapper `tinyjs` next to
          # it serves Git Bash (MSYS runs the .exe-less `bin/tjs` as tjs.exe).
          Copy-Item cli.js, tinyjs, tinyjs.cmd, VERSION, README.md, LICENSE "$stage\"
          # `tinyjs update` runs this copy rather than the website's (#30).
          Copy-Item docs\install.ps1 "$stage\"
          New-Item -ItemType Directory -Force out | Out-Null
          # Zip the CONTENTS (no wrapper dir): install.ps1 extracts straight
          # into the install dir.
          Compress-Archive -Path "$stage\*" -DestinationPath out\tinyjs-windows-x86_64.zip

      - name: Smoke test (build pipeline; no GUI on a runner)
        run: |
          $ErrorActionPreference = 'Stop'
          $extract = Join-Path $env:TEMP 'tinyjs-ci'
          Expand-Archive out\tinyjs-windows-x86_64.zip $extract
          & "$extract\tinyjs.cmd" version
          $work = Join-Path $env:TEMP 'tinyjs-ci-work'
          New-Item -ItemType Directory -Force $work | Out-Null
          Set-Location $work
          & "$extract\tinyjs.cmd" new ci-check
          if ($LASTEXITCODE -ne 0) { throw 'new failed' }
          Set-Location ci-check
          & "$extract\tinyjs.cmd" build
          if ($LASTEXITCODE -ne 0) { throw 'build failed' }
          if (-not (Test-Path dist\ci-check.exe)) { throw 'missing dist\ci-check.exe' }
          if (-not (Test-Path dist\launcher.exe)) { throw 'missing dist\launcher.exe' }
          Write-Host 'windows build pipeline OK'
          # GUI smoke: runners have a desktop session + WebView2 runtime, so
          # the self-driving smoke page can exercise the real launcher.
          $env:TINYJS_HTML = "$extract\test\smoke.html"
          $out = & "$extract\tinyjs.cmd" dev 2>&1 | Out-String
          Write-Host $out
          if ($out -notmatch 'SMOKE RESULTS') { throw 'GUI smoke produced no results' }
          if ($out -match 'FAIL') { throw 'GUI smoke has failures' }
          Write-Host 'windows GUI smoke OK'

      - name: Smoke test (Git Bash wrapper)
        shell: bash
        run: |
          out=$("$(cygpath -u "$TEMP")/tinyjs-ci/tinyjs" version)
          echo "$out"
          case "$out" in "tinyjs $GITHUB_REF_NAME "*) ;; *) echo 'sh wrapper broken'; exit 1;; esac

      - uses: actions/upload-artifact@v6
        with:
          name: windows-zip
          path: out/tinyjs-windows-x86_64.zip

  # Linux binaries (x86_64 + arm64): txiki.js has no upstream Linux releases,
  # so tjs is built from source here (cached per version) and shipped both
  # inside the tinyjs tarball and as a standalone tjs-linux-<arch>.gz that
  # setup.sh downloads for source checkouts.
  linux:
    strategy:
      matrix:
        include:
          # 22.04, NOT latest. The linker takes the newest symbol versions the
          # build image offers, so building on 24.04 (glibc 2.39, gcc 13) put
          # GLIBC_2.38 + GLIBCXX_3.4.32 in the shipped binaries and made them
          # refuse to load on Ubuntu 22.04 (glibc 2.35) and Debian 12 (2.36).
          # Nothing here needs a newer toolchain — jammy carries WebKitGTK 2.50,
          # same API surface as noble. See the ABI floor check below.
          - runner: ubuntu-22.04
            arch: x86_64
          - runner: ubuntu-22.04-arm
            arch: arm64
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v5

      - name: Install build deps
        run: |
          sudo apt-get update
          # libx11-dev/libxtst-dev are listed explicitly even though they arrive
          # transitively today: setup.sh treats them as OPTIONAL and drops
          # -DTINYJS_X11 (global hotkeys) with no build error if they're absent,
          # so leaving them to chance means a runner image can quietly ship a
          # release with the feature missing.
          # libpipewire-0.3-dev: Wayland mouseTracking is compiled INTO the
          # launcher (it consumes the ScreenCast portal's stream in-process),
          # so unlike the EQ — which spawns pw-cli tools and can prompt the
          # user to install them at runtime — a launcher built without this
          # ships with the feature permanently absent. Every release before
          # this line did.
          # g++-12: txiki's bundled ada URL parser uses constexpr std::string
          # (C++20, GCC 12+); jammy's default GCC 11 fails hard on it. Using
          # jammy's own gcc-12 does NOT raise the floor: 22.04's libstdc++6
          # runtime is built from GCC 12 and ships GLIBCXX_3.4.30 — the exact
          # ceiling the verify step asserts.
          # libffi-dev: tjs links system libffi. The runner image happens to
          # preinstall it; pinned here so a slimmer image can't break the
          # build — same implicit-dependency trap as libx11/libxtst above.
          sudo apt-get install -y build-essential g++-12 cmake ninja-build pkg-config \
            libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev \
            libwebkit2gtk-4.1-0 libx11-dev libxtst-dev libpipewire-0.3-dev \
            libffi-dev xvfb

      - name: Cache txiki.js build
        id: tjs-cache
        uses: actions/cache@v5
        with:
          path: bin/tjs
          # v2: the key is version+arch only, so it does NOT notice the runner
          # image changing. Without this bump a 22.04 run restores the tjs built
          # on 24.04 and ships the exact binary this move exists to replace —
          # green build, same broken download. Bump on every toolchain change.
          key: tjs-${{ env.TJS_VERSION }}-linux-${{ matrix.arch }}-v2

      - name: Build (setup.sh — build tjs from source if uncached, compile launcher)
        # CC/CXX reach cmake's first configure for the tjs build (see the
        # g++-12 note on the deps step). The launcher line in setup.sh uses
        # plain `c++` and stays on GCC 11 — it's C++17 and compiles there.
        run: TJS_BUILD=1 CC=gcc-12 CXX=g++-12 ./setup.sh

      # Five assertions, because every one of these regressions is SILENT — the
      # build succeeds and the break only shows up on a user's machine, which by
      # definition isn't this runner. This is the Linux twin of the macOS
      # "Verify the shipped launcher" step in the release job.
      - name: Verify the shipped binaries
        run: |
          fail=0
          # 1. the ABI floor. Ubuntu 22.04 ships glibc 2.35 and a libstdc++ with
          #    GLIBCXX_3.4.30 / CXXABI_1.3.13; anything above is unloadable
          #    there. A raised floor is not a build error, it's a bad download.
          for f in bin/tjs native/launcher-linux; do
            for pair in "GLIBC 2.35" "GLIBCXX 3.4.30" "CXXABI 1.3.13"; do
              set -- $pair
              # `|| true`: a binary with none of a given prefix makes grep exit
              # 1, and under the runner's `bash -e` that aborts the whole step.
              got=$(objdump -T "$f" | grep -oE "$1_[0-9]+(\.[0-9]+)*" | sed "s/^$1_//" | sort -uV || true)
              top=$(printf '%s\n' $got "$2" | sort -uV | tail -1)
              [ "$top" = "$2" ] ||
                { echo "::error::$f needs $1_$top — floor is $1_$2"; fail=1; }
            done
          done
          # 2/3/4. setup.sh degrades quietly when a dev package is missing: no
          #      XTest means no global hotkeys, no AppIndicator means no tray,
          #      no PipeWire means no Wayland mouseTracking — and the launcher
          #      builds fine every time and answers 'unsupported' at runtime.
          #      Released binaries must have all three. (Real, not theoretical:
          #      amp 0.8.0's arm64 launcher linked no AppIndicator while its
          #      x86_64 sibling did; nothing noticed until an audit.)
          objdump -p native/launcher-linux | grep -q libXtst ||
            { echo "::error::launcher has no XTest — global hotkeys disabled"; fail=1; }
          objdump -p native/launcher-linux | grep -q appindicator ||
            { echo "::error::launcher has no AppIndicator — tray disabled"; fail=1; }
          objdump -p native/launcher-linux | grep -q libpipewire ||
            { echo "::error::launcher has no PipeWire — Wayland mouseTracking disabled"; fail=1; }
          # 5. the arch actually matches the matrix leg, so a runner-label typo
          #    can't publish an x86_64 tarball under the arm64 name. readelf,
          #    not `objdump -f` — objdump reports "architecture: UNKNOWN!" for a
          #    binary its binutils wasn't built to target, which would read as a
          #    failure rather than a mismatch.
          case "${{ matrix.arch }}" in
            x86_64) want=X86-64 ;;
            arm64)  want=AArch64 ;;
          esac
          for f in bin/tjs native/launcher-linux; do
            readelf -h "$f" | grep -q "Machine:.*$want" ||
              { echo "::error::$f is not ${{ matrix.arch }}"; fail=1; }
          done
          echo "--- shipped ABI requirements ---"
          for f in bin/tjs native/launcher-linux; do
            echo "$f: $(objdump -T "$f" | grep -oE '(GLIBC|GLIBCXX|CXXABI)_[0-9.]+' | sort -uV | tr '\n' ' ')"
          done
          exit $fail

      - name: Stamp version
        run: printf '%s' "${GITHUB_REF_NAME}" > VERSION

      - name: Assemble tarball
        run: |
          set -e
          STAGE=/tmp/stage/tinyjs
          mkdir -p "$STAGE/bin" "$STAGE/native" out
          cp bin/tjs "$STAGE/bin/tjs"
          cp native/launcher-linux "$STAGE/native/"
          cp -R runtime template test skill "$STAGE/"
          cp cli.js tinyjs VERSION README.md LICENSE "$STAGE/"
          # `tinyjs update` runs this copy rather than the website's (#30).
          cp docs/install "$STAGE/install"
          tar -czf "out/tinyjs-linux-${{ matrix.arch }}.tar.gz" -C /tmp/stage tinyjs
          gzip -9 -c bin/tjs > "out/tjs-linux-${{ matrix.arch }}.gz"

      - name: Smoke test (build pipeline + GUI under Xvfb)
        run: |
          set -e
          tar -xzf out/tinyjs-linux-${{ matrix.arch }}.tar.gz -C /tmp
          cd "$(mktemp -d)"
          /tmp/tinyjs/tinyjs version
          /tmp/tinyjs/tinyjs new ci-check
          cd ci-check && /tmp/tinyjs/tinyjs build
          test -x dist/ci-check && test -x dist/launcher
          echo "linux build pipeline OK"
          # GUI smoke: the self-driving smoke page in a real window on Xvfb.
          cd ..
          OUT=$(TINYJS_HTML=/tmp/tinyjs/test/smoke.html xvfb-run -a sh -c 'cd ci-check && /tmp/tinyjs/tinyjs dev' 2>&1 || true)
          echo "$OUT"
          echo "$OUT" | grep -q 'SMOKE RESULTS' || { echo 'GUI smoke produced no results'; exit 1; }
          if echo "$OUT" | grep -q 'FAIL'; then echo 'GUI smoke has failures'; exit 1; fi
          echo "linux GUI smoke OK"

      - uses: actions/upload-artifact@v6
        with:
          name: linux-${{ matrix.arch }}
          path: out/*

  release:
    # macos-14 is deprecated in GitHub's runner images, so this had to move
    # regardless. See the deployment-target note on the build step below: the
    # runner version and the floor tinyjs ships are NOT the same number, and
    # they were only ever equal here by accident.
    runs-on: macos-26
    needs: [windows, linux]
    steps:
      - uses: actions/checkout@v5

      # Built WITH on-device AI (tiny.app.ai), which is why this can't be one
      # clang call any more. clang takes `-arch a -arch b` and emits a fat
      # binary itself; swiftc takes a single -target, and passing two does NOT
      # error — the last one silently wins, which would quietly produce a
      # single-arch object. So: build each arch on its own, then lipo. Both
      # slices cross-compile from one runner (a macos-26 arm64 image builds the
      # x86_64 slice fine), so this needs no second job and no Intel runner.
      - name: Build universal launcher (with FoundationModels)
        run: |
          ./native/gen-client.sh
          # Keep in sync with setup.sh's FW — the v0.35.0 tag failed to link
          # here (undefined _OBJC_CLASS_$_UTType) because only setup.sh
          # gained UniformTypeIdentifiers.
          FW="-framework WebKit -framework AppKit -framework Carbon -framework UserNotifications -framework AVFoundation -framework ServiceManagement -framework IOKit -framework Quartz -framework Vision -framework QuickLookThumbnailing -framework Security -framework LocalAuthentication -framework MediaPlayer -framework CoreMedia -framework CoreWLAN -framework CoreAudio -framework AudioToolbox -framework UniformTypeIdentifiers"
          for ARCH in arm64 x86_64; do
            TGT="$ARCH-apple-macos14.0"
            # -mmacosx-version-min / -target macos14.0: REQUIRED, not
            # decoration. Without them the deployment target comes from the
            # host SDK — on this runner that means minos 26.0 and a binary
            # that refuses to launch on anything older, with no build error.
            c++ -std=c++17 -c -x objective-c++ -DTINYJS_AI -mmacosx-version-min=14.0 -arch "$ARCH" \
              -Inative/include native/launcher-macos.cc -o "/tmp/launcher-$ARCH.o"
            swiftc -parse-as-library -target "$TGT" -c native/tiny_ai.swift -o "/tmp/ai-$ARCH.o"
            swiftc "/tmp/launcher-$ARCH.o" "/tmp/ai-$ARCH.o" -o "/tmp/launcher-$ARCH" -lc++ -target "$TGT" $FW \
              -Xlinker -weak_framework -Xlinker ScreenCaptureKit \
              -Xlinker -weak_framework -Xlinker FoundationModels -ldl
          done
          lipo -create /tmp/launcher-arm64 /tmp/launcher-x86_64 -output native/launcher-macos
          codesign --force --sign - native/launcher-macos
          lipo -info native/launcher-macos

      # Three assertions, because every one of these regressions is SILENT —
      # the build still succeeds and the break only shows up on a user's
      # machine, which by definition isn't this runner.
      - name: Verify the shipped launcher
        run: |
          for ARCH in arm64 x86_64; do
            # 1. the floor. A raised minos is unlaunchable for older macOS.
            vtool -arch $ARCH -show-build native/launcher-macos | grep -q "minos 14.0" \
              || { echo "::error::$ARCH slice is not built for the macOS 14 floor"; exit 1; }
            # 2. FoundationModels must stay WEAK. It doesn't exist before macOS
            #    26, so a strong link would make the launcher fail to load for
            #    every user below it — the AI feature taking the whole app down.
            otool -arch $ARCH -L native/launcher-macos | grep FoundationModels | grep -q weak \
              || { echo "::error::$ARCH links FoundationModels strongly"; exit 1; }
            # 3. the AI shim is actually in this slice, so a broken Swift step
            #    can't quietly ship a launcher that answers 'unsupported'.
            nm -arch $ARCH native/launcher-macos | grep -q tiny_ai_generate \
              || { echo "::error::$ARCH has no AI shim linked in"; exit 1; }
          done
          vtool -show-build native/launcher-macos

      - name: Stamp version
        run: echo "${GITHUB_REF_NAME}" > VERSION

      - name: Assemble per-arch tarballs
        run: |
          set -e
          mkdir -p out
          for ARCH in arm64 x86_64; do
            curl -fsSL -o /tmp/tjs-$ARCH.zip \
              "https://github.com/saghul/txiki.js/releases/download/${TJS_VERSION}/txiki-macos-$ARCH.zip"
            unzip -q -o /tmp/tjs-$ARCH.zip -d /tmp/tjs-$ARCH
            # Pinned hash (runtime/txiki.sha256, #26): every user's install
            # ships this binary, so a swapped upstream asset must stop here.
            WANT="$(awk -v k="$TJS_VERSION/txiki-macos-$ARCH" '$2 == k { print $1 }' runtime/txiki.sha256)"
            GOT="$(shasum -a 256 "/tmp/tjs-$ARCH/txiki-macos-$ARCH/tjs" | cut -d' ' -f1)"
            [ -n "$WANT" ] || { echo "::error::no pinned sha256 for $TJS_VERSION/txiki-macos-$ARCH (got $GOT)"; exit 1; }
            [ "$GOT" = "$WANT" ] || { echo "::error::txiki $ARCH sha256 $GOT, expected $WANT"; exit 1; }

            STAGE=/tmp/stage-$ARCH/tinyjs
            mkdir -p "$STAGE/bin" "$STAGE/native"
            cp "/tmp/tjs-$ARCH/txiki-macos-$ARCH/tjs" "$STAGE/bin/tjs"
            chmod +x "$STAGE/bin/tjs"
            cp native/launcher-macos native/make-icon.jxa "$STAGE/native/"
            cp -R runtime template test skill "$STAGE/"
            cp cli.js tinyjs VERSION README.md LICENSE "$STAGE/"
            # `tinyjs update` runs this copy rather than the website's (#30).
            cp docs/install "$STAGE/install"

            tar -czf "out/tinyjs-macos-$ARCH.tar.gz" -C "/tmp/stage-$ARCH" tinyjs
          done

      - name: Fetch Windows zip
        uses: actions/download-artifact@v7
        with:
          name: windows-zip
          path: out

      - name: Fetch Linux tarballs
        uses: actions/download-artifact@v7
        with:
          pattern: linux-*
          merge-multiple: true
          path: out

      - name: Checksums (all assets)
        run: (cd out && shasum -a 256 *.tar.gz *.zip tjs-*.gz > checksums.txt && cat checksums.txt)

      - name: Smoke test (native arch)
        run: |
          tar -xzf out/tinyjs-macos-arm64.tar.gz -C /tmp
          cd "$(mktemp -d)"
          /tmp/tinyjs/tinyjs version
          /tmp/tinyjs/tinyjs new ci-check
          # GUI can't open on a headless runner; verify the build pipeline only.
          cd ci-check && /tmp/tinyjs/tinyjs build
          test -x dist/ci-check && test -d dist/ci-check.app
          codesign --verify --strict --deep dist/ci-check.app
          echo "build + bundle signature OK"

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "${GITHUB_REF_NAME}" out/*.tar.gz out/*.zip out/tjs-*.gz out/checksums.txt \
            --title "tinyjs ${GITHUB_REF_NAME}" \
            --generate-notes