release.yml

name: appimageupdate release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: Existing release tag to rebuild assets for
        required: true

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  attestations: write
  contents: write
  id-token: write

env:
  # Pinned because nightly-2026-09-12 started passing -Wl,--no-rosegment when
  # linking loongarch64, which zig cc rejects as an unsupported linker arg.
  # Lift once zig accepts it or rustc stops emitting it for that target.
  RUST_NIGHTLY: nightly-2026-09-09
  ZIG_VERSION: 0.16.0
  ZIG_SHA256: 70e49664a74374b48b51e6f3fdfbf437f6395d42509050588bd49abe52ba3d00

jobs:
  publish-binaries:
    name: Publish binaries
    runs-on: ${{ matrix.build.RUNNER }}
    strategy:
      fail-fast: false
      matrix:
        build:
          - {
              NAME: x86_64-linux,
              RUNNER: ubuntu-latest,
              TARGET: x86_64-unknown-linux-musl,
            }
          - {
              NAME: aarch64-linux,
              RUNNER: ubuntu-24.04-arm,
              TARGET: aarch64-unknown-linux-musl,
            }
          - {
              NAME: riscv64-linux,
              RUNNER: ubuntu-latest,
              TARGET: riscv64gc-unknown-linux-musl,
              ZIGTARGET: riscv64-linux-musl,
            }
          - {
              NAME: loongarch64-linux,
              RUNNER: ubuntu-latest,
              TARGET: loongarch64-unknown-linux-musl,
              ZIGTARGET: loongarch64-linux-musl,
            }
          - {
              NAME: ppc64-linux,
              RUNNER: ubuntu-latest,
              TARGET: powerpc64-unknown-linux-musl,
              ZIGTARGET: powerpc64-linux-musl,
            }
          - {
              NAME: ppc64le-linux,
              RUNNER: ubuntu-latest,
              TARGET: powerpc64le-unknown-linux-musl,
              ZIGTARGET: powerpc64le-linux-musl,
            }
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.tag || github.ref }}

      - name: Install dependencies
        shell: bash
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends musl-tools b3sum

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
        with:
          toolchain: ${{ env.RUST_NIGHTLY }}
          targets: ${{ matrix.build.TARGET }}
          components: rust-src

      - name: Install zig
        if: ${{ matrix.build.ZIGTARGET }}
        run: |
          curl -fL --retry 3 -o "$RUNNER_TEMP/zig.tar.xz" \
            "https://ziglang.org/download/${ZIG_VERSION}/zig-x86_64-linux-${ZIG_VERSION}.tar.xz"
          echo "${ZIG_SHA256}  $RUNNER_TEMP/zig.tar.xz" | sha256sum -c -
          mkdir -p "$RUNNER_TEMP/zig"
          tar xJf "$RUNNER_TEMP/zig.tar.xz" -C "$RUNNER_TEMP/zig" --strip-components=1

      - name: Create zig cc wrappers
        if: ${{ matrix.build.ZIGTARGET }}
        run: |
          # cc-rs appends a rustc triple as --target=, which zig cc cannot
          # parse, so the wrapper drops it and keeps the zig target
          cat > "$RUNNER_TEMP/zigcc" <<EOF
          #!/bin/bash
          args=()
          for a in "\$@"; do
            case "\$a" in --target=*) ;; *) args+=("\$a") ;; esac
          done
          exec "$RUNNER_TEMP/zig/zig" cc -target ${{ matrix.build.ZIGTARGET }} "\${args[@]}"
          EOF
          printf '#!/bin/bash\nexec "%s" ar "$@"\n' "$RUNNER_TEMP/zig/zig" > "$RUNNER_TEMP/zigar"
          chmod +x "$RUNNER_TEMP/zigcc" "$RUNNER_TEMP/zigar"

      - name: Build
        run: |
          # the profile only asks for panic = "abort" so the crate still builds
          # on stable; nightly upgrades it to immediate-abort here
          export RUSTFLAGS="-Z unstable-options -C panic=immediate-abort"
          if [ -n "${{ matrix.build.ZIGTARGET }}" ]; then
            TARGET_ENV=$(echo "${{ matrix.build.TARGET }}" | tr 'a-z-' 'A-Z_')
            CC_ENV=$(echo "${{ matrix.build.TARGET }}" | tr '-' '_')
            export CARGO_TARGET_${TARGET_ENV}_LINKER="$RUNNER_TEMP/zigcc"
            export CC_${CC_ENV}="$RUNNER_TEMP/zigcc"
            export AR_${CC_ENV}="$RUNNER_TEMP/zigar"
            RUSTFLAGS="$RUSTFLAGS -C target-feature=+crt-static -C link-self-contained=no"
            export ZIG_GLOBAL_CACHE_DIR="$RUNNER_TEMP/zig-cache"
            export ZIG_LOCAL_CACHE_DIR="$RUNNER_TEMP/zig-cache"
          fi
          cargo build --release --locked --target ${{ matrix.build.TARGET }} -Z build-std=std,panic_abort

      - name: Prepare release assets
        shell: bash
        run: |
          mkdir -p release
          cp {LICENSE,README.md} release/
          cp "target/${{ matrix.build.TARGET }}/release/appimageupdate" release/

      - name: Create release artifacts
        shell: bash
        run: |
          cp release/appimageupdate appimageupdate-${{ matrix.build.NAME }}
          b3sum appimageupdate-${{ matrix.build.NAME }} > appimageupdate-${{ matrix.build.NAME }}.b3sum
          tar -cJvf appimageupdate-${{ matrix.build.NAME }}.tar.xz release/
          b3sum appimageupdate-${{ matrix.build.NAME }}.tar.xz > appimageupdate-${{ matrix.build.NAME }}.tar.xz.b3sum

      - name: Upload to release
        uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: appimageupdate-${{ matrix.build.NAME }}*
          file_glob: true
          overwrite: true
          tag: ${{ inputs.tag || github.ref }}

      - name: Attest Build Provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-name: "appimageupdate-${{ matrix.build.NAME }}"
          subject-path: appimageupdate-${{ matrix.build.NAME }}*