idx-cli/.github/workflows/release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing release tag to build and attach binaries to (for example v0.2.3)"
        required: true
  pull_request:
    paths:
      - ".github/workflows/release.yml"
      - "Cargo.toml"
      - "crates/*/Cargo.toml"
      - "Cargo.lock"
      - "package.json"
      - "npm/idx-mcp/package.json"
      - "scripts/install.js"
      - "install.sh"

# Read-only by default; only the publish job writes the release.
permissions:
  contents: read

env:
  RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}

jobs:
  build:
    name: Build ${{ matrix.asset }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            asset: linux-x64
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-musl
            asset: linux-arm64
          - os: macos-15
            target: aarch64-apple-darwin
            asset: darwin-arm64
          - os: macos-15
            target: x86_64-apple-darwin
            asset: darwin-x64

    steps:
      - name: Check out source
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}

      - name: Install Rust toolchain and target
        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
        with:
          targets: ${{ matrix.target }}

      - name: Install musl toolchain
        if: endsWith(matrix.target, '-linux-musl')
        run: sudo apt-get update && sudo apt-get install --yes musl-tools

      - name: Build release binary
        shell: bash
        run: |
          target="${{ matrix.target }}"
          if [[ "$target" == *-linux-musl ]]; then
            # Bundled SQLite and ring compile C code; build it against musl too.
            export "CC_${target//-/_}=musl-gcc"
          fi
          cargo build --release --locked --target "$target" -p idx-cli -p idx-mcp
          for bin in idx idx-mcp; do
            cp "target/${{ matrix.target }}/release/$bin" "$bin-${{ matrix.asset }}"
            chmod 0755 "$bin-${{ matrix.asset }}"
          done

      - name: Check binaries run
        if: matrix.target != 'x86_64-apple-darwin'
        run: |
          ./idx-${{ matrix.asset }} --help >/dev/null
          ./idx-mcp-${{ matrix.asset }} --help >/dev/null

      - name: Upload target artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: idx-${{ matrix.asset }}
          path: |
            idx-${{ matrix.asset }}
            idx-mcp-${{ matrix.asset }}
          if-no-files-found: error

  publish:
    name: Attach binaries to release
    needs: build
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Check out install script and changelog
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}
          sparse-checkout: |
            install.sh
            CHANGELOG.md
            scripts/changelog.sh
          sparse-checkout-cone-mode: false
          path: src

      - name: Download target artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          pattern: idx-*
          merge-multiple: true

      - name: Write checksums
        run: |
          sha256sum \
            idx-linux-x64 idx-linux-arm64 idx-darwin-arm64 idx-darwin-x64 \
            idx-mcp-linux-x64 idx-mcp-linux-arm64 idx-mcp-darwin-arm64 idx-mcp-darwin-x64 \
            > SHA256SUMS

      - name: Attach binaries to the version tag
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          files: |
            idx-linux-x64
            idx-linux-arm64
            idx-darwin-arm64
            idx-darwin-x64
            idx-mcp-linux-x64
            idx-mcp-linux-arm64
            idx-mcp-darwin-arm64
            idx-mcp-darwin-x64
            SHA256SUMS
            src/install.sh

      # The notes are the tag's CHANGELOG.md section. A tag from before
      # CHANGELOG.md (or without its version in it) keeps the notes it has.
      - name: Read release notes from CHANGELOG.md
        id: notes
        env:
          CHANGELOG_ROOT: src
        run: |
          if [ -f src/scripts/changelog.sh ] && bash src/scripts/changelog.sh notes "$RELEASE_TAG" > notes.md; then
            echo "found=true" >> "$GITHUB_OUTPUT"
          else
            echo "::warning::${RELEASE_TAG} has no CHANGELOG.md section at that tag; release notes left unchanged"
          fi

      - name: Publish release notes
        if: steps.notes.outputs.found == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release edit "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --notes-file notes.md