make-release.yml

name: Release SDK

on:
  push:
    tags:
      - "v*"  # Triggers on version tags like v0.1.0, v1.0.0
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (e.g., 0.1.0)'
        required: true
        type: string

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
  VCPKG_DEFAULT_TRIPLET: x64-windows-static-md
  VCPKG_DEFAULT_HOST_TRIPLET: x64-windows-static-md
  VCPKG_TARGET_TRIPLET: x64-windows-static-md

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            name: ubuntu-22.04-x64
          - os: ubuntu-22.04-arm
            name: ubuntu-22.04-arm64
          - os: ubuntu-24.04
            name: ubuntu-24.04-x64
          - os: ubuntu-24.04-arm
            name: ubuntu-24.04-arm64
          - os: macos-26-xlarge
            name: macos-arm64
          - os: macos-26-large
            name: macos-x64
            macos_arch: x86_64
            # Pinned to Windows 2022 for current VS 17 implementation
          - os: windows-2022
            name: windows-x64

    name: Build (${{ matrix.name }})
    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout (with submodules)
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Set Cargo output root
        uses: ./.github/actions/cargo-target-root

      # ---------- Extract version ----------
      - name: Extract version
        id: version
        shell: bash
        run: |
          set -euo pipefail

          if [[ -n "${{ github.event.inputs.version }}" ]]; then
            VERSION="${{ github.event.inputs.version }}"
          elif [[ "${{ github.ref_type }}" == "tag" ]]; then
            # github.ref_name is e.g. "v0.2.4"
            TAG="${{ github.ref_name }}"
            VERSION="${TAG#v}"
          else
            VERSION="0.0.0-dev"
          fi

          # Basic validation: must not be empty, must not start with v, no spaces
          if [[ -z "$VERSION" ]]; then
            echo "ERROR: Derived version is empty"
            exit 1
          fi
          if [[ "$VERSION" == v* ]]; then
            echo "ERROR: Derived version still has leading 'v': $VERSION"
            exit 1
          fi
          if [[ "$VERSION" =~ [[:space:]] ]]; then
            echo "ERROR: Version contains whitespace: '$VERSION'"
            exit 1
          fi

          if [[ "$VERSION" == "0.0.0-dev" ]]; then
            echo "ERROR: refusing to build release with fallback version: $VERSION"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "SDK Version: $VERSION"

      # ---------- vcpkg for Windows ----------
      - name: Export GitHub Actions cache environment variables
        if: runner.os == 'Windows'
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');

      - name: Set up base SDK dependencies
        uses: ./.github/actions/setup-sdk-deps

      # ---------- Rust toolchain ----------
      - name: Install Rust (stable)
        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8
        with:
          toolchain: stable

      - name: Install Rust cross-compilation target
        if: matrix.name == 'macos-x64'
        run: rustup target add x86_64-apple-darwin

      # ---------- Cache Cargo ----------
      # Key the target cache on the client-sdk-rust submodule SHA (Cargo.lock is
      # pinned inside the submodule and froze the old cache). No clean step runs
      # in this workflow, so the combined actions/cache post-job save captures
      # the populated target/ correctly once the key busts on a submodule bump.
      - name: Resolve Rust submodule SHA
        id: rust_sha
        shell: bash
        run: echo "sha=$(git -C client-sdk-rust rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Cache Cargo registry
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
          key: ${{ runner.os }}-${{ matrix.name }}-cargo-registry-${{ hashFiles('client-sdk-rust/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.name }}-cargo-registry-

      # macOS FFI libraries retain GStreamer link paths. Include capture setup
      # in the key so changes to the framework installation invalidate them.
      # Compiled target/ artifacts are glibc-bound and must not restore across
      # Ubuntu major versions (e.g. 24.04 → 22.04 → GLIBC_2.39 not found).
      - name: Cache cargo target
        id: cache-cargo-target
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            client-sdk-rust/target/
            ${{ env.CARGO_TARGET_DIR }}
          key: ${{ matrix.os }}-${{ matrix.name }}-cargo-target-release-standard-${{ hashFiles('CMakeLists.txt', 'build.sh', 'build.cmd', '.github/actions/setup-capture/action.yml', '.github/actions/test-capture-variants/action.yml') }}-${{ steps.rust_sha.outputs.sha }}

      # Restore exact keys only: webrtc-sys cxxbridge artifacts are not
      # compatible across Rust submodule bumps. Avoid downloading a fallback
      # cache that this cleanup would immediately discard.
      - name: Drop stale cargo target on submodule SHA cache miss
        if: steps.cache-cargo-target.outputs.cache-hit != 'true'
        shell: bash
        run: rm -rf client-sdk-rust/target/ "$CARGO_TARGET_DIR"

      # ---------- Build environment setup ----------
      - name: Set Linux build environment
        if: runner.os == 'Linux'
        run: |
          echo "CXXFLAGS=-Wno-deprecated-declarations" >> "$GITHUB_ENV"
          echo "CFLAGS=-Wno-deprecated-declarations" >> "$GITHUB_ENV"

      # ---------- Build both variants in the same CMake tree ----------
      - name: Build standard SDK
        uses: ./.github/actions/build-sdk
        with:
          preset: release-examples
          capture: 'none'
          bundle-dir: sdk-out/livekit-sdk-${{ matrix.name }}-${{ steps.version.outputs.version }}
          version: ${{ steps.version.outputs.version }}
          macos-arch: ${{ matrix.macos_arch || '' }}

      # ---------- Verify exported ABI: no third-party symbol leaks ----------
      - name: Setup Python
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: '3.x'

      - name: Symbol leak check (standard SDK)
        uses: ./.github/actions/check-sdk-symbols
        with:
          bundle-dir: sdk-out/livekit-sdk-${{ matrix.name }}-${{ steps.version.outputs.version }}

      - name: Test installed standard SDK
        uses: ./.github/actions/test-sdk-bundle
        with:
          bundle-dir: sdk-out/livekit-sdk-${{ matrix.name }}-${{ steps.version.outputs.version }}
          capture: 'none'
          macos-arch: ${{ matrix.macos_arch || '' }}
          version: ${{ steps.version.outputs.version }}

      - name: Set up capture dependencies
        if: matrix.name != 'macos-x64'
        uses: ./.github/actions/setup-capture

      - name: Rebuild with capture
        if: matrix.name != 'macos-x64'
        uses: ./.github/actions/build-sdk
        with:
          preset: release-examples
          capture: 'all'
          bundle-dir: sdk-out/livekit-sdk-${{ matrix.name }}-capture-${{ steps.version.outputs.version }}
          version: ${{ steps.version.outputs.version }}
          macos-arch: ${{ matrix.macos_arch || '' }}

      - name: Symbol leak check (capture SDK)
        if: matrix.name != 'macos-x64'
        uses: ./.github/actions/check-sdk-symbols
        with:
          bundle-dir: sdk-out/livekit-sdk-${{ matrix.name }}-capture-${{ steps.version.outputs.version }}

      - name: Test installed capture SDK
        if: matrix.name != 'macos-x64'
        uses: ./.github/actions/test-sdk-bundle
        with:
          bundle-dir: sdk-out/livekit-sdk-${{ matrix.name }}-capture-${{ steps.version.outputs.version }}
          capture: 'all'
          macos-arch: ${{ matrix.macos_arch || '' }}
          version: ${{ steps.version.outputs.version }}

      # ---------- Upload artifact (raw directory, no pre-compression) ----------
      - name: Upload build artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: livekit-sdk-${{ matrix.name }}-${{ steps.version.outputs.version }}
          path: sdk-out/livekit-sdk-${{ matrix.name }}-${{ steps.version.outputs.version }}

      - name: Upload capture build artifact
        if: matrix.name != 'macos-x64'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: livekit-sdk-${{ matrix.name }}-capture-${{ steps.version.outputs.version }}
          path: sdk-out/livekit-sdk-${{ matrix.name }}-capture-${{ steps.version.outputs.version }}

  # ---------- Release Job ----------
  release:
    name: Create GitHub Release
    runs-on: ubuntu-24.04
    needs:
      - build
    permissions:
      contents: write
    if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
    outputs:
      version: ${{ steps.version.outputs.version }}

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Extract version
        id: version
        shell: bash
        run: |
          set -euo pipefail
          if [[ -n "${{ github.event.inputs.version }}" ]]; then
            VERSION="${{ github.event.inputs.version }}"
          elif [[ "${{ github.ref_type }}" == "tag" ]]; then
            TAG="${{ github.ref_name }}"
            VERSION="${TAG#v}"
          else
            VERSION="0.0.0-dev"
          fi

          if [[ -z "$VERSION" ]]; then
            echo "ERROR: Derived version is empty"
            exit 1
          fi
          if [[ "$VERSION" == v* ]]; then
            echo "ERROR: Derived version still has leading 'v': $VERSION"
            exit 1
          fi
          if [[ "$VERSION" =~ [[:space:]] ]]; then
            echo "ERROR: Version contains whitespace: '$VERSION'"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "SDK Version: $VERSION"

      - name: Download all artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: ${{ github.workspace }}/artifacts

      - name: List downloaded artifacts
        run: |
          echo "Downloaded artifacts structure:"
          find ${{ github.workspace }}/artifacts -type f | head -100

      # ---------- Create archives in release job ----------
      - name: Create release archives
        shell: bash
        run: |
          mkdir -p release-assets
          VERSION="${{ steps.version.outputs.version }}"
          cd ${{ github.workspace }}/artifacts
          
          # List what we have
          echo "Artifacts downloaded:"
          ls -la
          
          # Standard and capture-enabled Ubuntu and macOS bundles.
          for platform in ubuntu-22.04-x64 ubuntu-22.04-arm64 ubuntu-24.04-x64 ubuntu-24.04-arm64 macos-arm64 macos-x64; do
            for suffix in "" "-capture"; do
              # Intel macOS ships only the standard SDK.
              if [[ "$platform" == macos-x64 && "$suffix" == -capture ]]; then continue; fi
              dirName="livekit-sdk-${platform}${suffix}-${VERSION}"
              test -d "${dirName}"
              tar -czf "${{ github.workspace }}/release-assets/${dirName}.tar.gz" "${dirName}"
              echo "Created: ${dirName}.tar.gz"
            done
          done

          # Standard and capture-enabled Windows bundles.
          for suffix in "" "-capture"; do
            dirName="livekit-sdk-windows-x64${suffix}-${VERSION}"
            test -d "${dirName}"
            zip -r "${{ github.workspace }}/release-assets/${dirName}.zip" "${dirName}"
          done

      - name: List release assets
        run: ls -la ${{ github.workspace }}/release-assets/

      - name: Create GitHub Release
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          tag_name: v${{ steps.version.outputs.version }}
          name: v${{ steps.version.outputs.version }}
          draft: true
          files: ${{ github.workspace }}/release-assets/*
          generate_release_notes: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # Build docs for validation and retain them as a workflow artifact. Publishing
  # is triggered separately by the GitHub release's authoritative state.
  docs:
    name: Generate Documentation
    needs: release
    permissions:
      contents: read
      actions: read
    uses: ./.github/workflows/docs.yml
    with:
      version: ${{ needs.release.outputs.version }}
      upload_artifact: true
      artifact_name: livekit-cpp-docs-${{ github.run_id }}