name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to build (e.g. v0.6.7)"
        required: true
      run_linux:
        description: "Build Linux"
        type: boolean
        default: true
      run_linux_packages:
        description: "Build Linux Packages (.deb, .rpm, .snap, .pkg.tar.zst)"
        type: boolean
        default: true
      run_aur:
        description: "Update AUR packages (dcr & dcr-bin)"
        type: boolean
        default: false 
      run_aur_dev:
        description: "Update Dev AUR packages (dcr-dev, dcr-dev-bin)"
        type: boolean
        default: false
      run_bsd:
        description: "Build BSD"
        type: boolean
        default: true
      run_macos:
        description: "Build macOS"
        type: boolean
        default: true
      run_windows:
        description: "Build Windows"
        type: boolean
        default: true
      run_publish:
        description: "Publish to crates.io"
        type: boolean
        default: false
      run_snap:
        description: "Publish to Snap Store (dcrup)"
        type: boolean
        default: false
      run_brew:
        description: "Update Homebrew tap"
        type: boolean
        default: false

permissions:
  contents: write

jobs:
  # ── Resolve Tag ────────────────────────────────────────────────────────────
  setup:
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.tag.outputs.value }}
      version: ${{ steps.tag.outputs.version }}
      clean_version: ${{ steps.tag.outputs.clean_version }}
      prerelease: ${{ steps.tag.outputs.prerelease }}
    steps:
      - name: Resolve tag
        id: tag
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            TAG="${{ github.event.inputs.tag }}"
          else
            TAG="${GITHUB_REF_NAME}"
          fi
          VERSION="${TAG#v}"
          CLEAN_VERSION="${VERSION%-dev}"
          [[ "$TAG" == *"-"* ]] && PRERELEASE="true" || PRERELEASE="false"
          echo "value=${TAG}"             >> "$GITHUB_OUTPUT"
          echo "version=${VERSION}"       >> "$GITHUB_OUTPUT"
          echo "clean_version=${CLEAN_VERSION}" >> "$GITHUB_OUTPUT"
          echo "prerelease=${PRERELEASE}" >> "$GITHUB_OUTPUT"

  # ── Release Notes ──────────────────────────────────────────────────────────
  notes:
    needs: setup
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.setup.outputs.tag }}

      - name: Prepare Release Notes
        shell: bash
        run: |
          set -euo pipefail
          tag="${{ needs.setup.outputs.version }}"
          notes_file=".github/release-notes.md"
          if grep -q "^## \\[${tag}\\]" CHANGELOG.md; then
            awk -v ver="$tag" '
              $0 ~ "^## \\[" ver "\\]" {found=1; next}
              found && $0 ~ "^## \\[" {exit}
              found {print}
            ' CHANGELOG.md | sed -e '${/^$/d;}' > "$notes_file"
          else
            echo "No CHANGELOG section for $tag." > "$notes_file"
            git log -1 --pretty=format:"%s%n%n%b" >> "$notes_file"
          fi

      - name: Upload Notes Artifact
        uses: actions/upload-artifact@v4
        with:
          name: release-notes
          path: .github/release-notes.md

  # ── Create Release (prevent race conditions) ───────────────────────────────
  create-release:
    needs: [setup, notes]
    runs-on: ubuntu-latest
    steps:
      - name: Download Release Notes
        uses: actions/download-artifact@v4
        with:
          name: release-notes
          path: .github

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.setup.outputs.tag }}
          body_path: .github/release-notes.md
          prerelease: ${{ needs.setup.outputs.prerelease == 'true' }}

  # ── Linux Binaries Matrix ──────────────────────────────────────────────────
  build-linux:
    if: ${{ github.event_name == 'push' || github.event.inputs.run_linux == 'true' }}
    needs: [setup, notes, create-release]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
          - target: aarch64-unknown-linux-gnu
          - target: x86_64-unknown-linux-musl
          - target: aarch64-unknown-linux-musl
          - target: i686-unknown-linux-gnu
          - target: i686-unknown-linux-musl
          - target: armv7-unknown-linux-gnueabihf
          - target: armv7-unknown-linux-musleabihf
          - target: riscv64gc-unknown-linux-gnu
          - target: riscv64gc-unknown-linux-musl
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.setup.outputs.tag }}

      - name: Download Release Notes
        uses: actions/download-artifact@v4
        with:
          name: release-notes
          path: .github

      - name: Install cargo-zigbuild
        run: |
          pip install cargo-zigbuild
          echo "$HOME/.local/bin" >> $GITHUB_PATH

      - name: Setup Zig
        if: matrix.target != 'x86_64-unknown-linux-gnu'
        uses: mlugg/setup-zig@v1
        with:
          version: 0.13.0

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Build
        run: |
          if [ "${{ matrix.target }}" != "x86_64-unknown-linux-gnu" ]; then
            cargo zigbuild --release --target ${{ matrix.target }}
          else
            cargo build --release --target ${{ matrix.target }}
          fi

      - name: Prepare Artifact
        run: |
          ASSET="dcr-${{ matrix.target }}-${{ needs.setup.outputs.version }}"
          cp target/${{ matrix.target }}/release/dcr "$ASSET"
          echo "ASSET_NAME=${ASSET}" >> "$GITHUB_ENV"

      - name: Upload Release Asset
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.setup.outputs.tag }}
          files: ${{ env.ASSET_NAME }}
          body_path: .github/release-notes.md
          prerelease: ${{ needs.setup.outputs.prerelease == 'true' }}

  # ── Linux Packages Matrix (.deb, .rpm, .pkg.tar.zst, .snap) ────────────────
  build-linux-packages:
    if: ${{ github.event_name == 'push' || github.event.inputs.run_linux_packages == 'true' }}
    needs: [setup, notes]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - package_type: deb
            artifact_name: debian-package
          - package_type: rpm
            artifact_name: rpm-package
          - package_type: arch
            artifact_name: arch-package
          - package_type: snap
            artifact_name: snap-package
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.setup.outputs.tag }}

      - name: Setup Rust (For non-container builds)
        if: matrix.package_type != 'arch'
        uses: dtolnay/rust-toolchain@stable

      # ── DEB Build ──
      - name: Build Debian Package
        if: matrix.package_type == 'deb'
        run: |
          cargo install cargo-deb
          cargo build --release
          cargo deb --no-build
          mkdir -p dist-packages && cp target/debian/*.deb dist-packages/

      # ── RPM Build ──
      - name: Build RPM Package
        if: matrix.package_type == 'rpm'
        run: |
          cargo install cargo-generate-rpm
          cargo build --release
          cargo generate-rpm
          mkdir -p dist-packages && cp target/generate-rpm/*.rpm dist-packages/

      # ── Snap Build ──
      - name: Build Snap Package
        if: matrix.package_type == 'snap'
        run: |
          cargo build --release
          mkdir -p packaging/snap/dist/bin
          cp target/release/dcr packaging/snap/dist/bin/

      - name: Snapcraft Build Action
        if: matrix.package_type == 'snap'
        uses: snapcore/action-build@v1
        with:
          path: packaging/snap

      - name: Prepare Snap Output
        if: matrix.package_type == 'snap'
        run: mkdir -p dist-packages && cp packaging/snap/*.snap dist-packages/

      # ── Arch Linux Native Build ──
      - name: Build Arch Package inside Container
        if: matrix.package_type == 'arch'
        run: |
          PKGVER_ORIG='${{ needs.setup.outputs.version }}'
          PKGVER_CLEAN="${PKGVER_ORIG//-/.}"
          TAG='${{ needs.setup.outputs.tag }}'
          SRC_URL="https://github.com/dexoron/dcr/archive/refs/tags/${TAG}.tar.gz"
          SHA256="$(curl -fsSL "$SRC_URL" | sha256sum | awk '{print $1}')"
          mkdir -p arch-build
          cat > arch-build/PKGBUILD <<PKG
          pkgname=dcr
          pkgver=${PKGVER_CLEAN}
          pkgrel=1
          pkgdesc="Cargo-like utility to manage C/C++ projects"
          arch=('x86_64')
          url="https://github.com/dexoron/dcr"
          license=('GPL-3.0-or-later')
          depends=('gcc-libs')
          makedepends=('cargo')
          options=('!lto')
          source=("\$pkgname-\$pkgver.tar.gz::\$url/archive/refs/tags/${TAG}.tar.gz")
          sha256sums=('${SHA256}')
          build() {
            cd "\$srcdir/\$pkgname-${PKGVER_ORIG}"
            unset CFLAGS CXXFLAGS LDFLAGS
            export RUSTFLAGS="-C linker=cc"
            cargo build --release --locked
          }
          package() {
            cd "\$srcdir/\$pkgname-${PKGVER_ORIG}"
            install -Dm755 "target/release/dcr" "\$pkgdir/usr/bin/dcr"
            install -Dm644 LICENSE "\$pkgdir/usr/share/licenses/\$pkgname/LICENSE"
          }
          PKG
          docker run --rm \
            -v ${{ github.workspace }}/arch-build:/build \
            archlinux:latest \
            bash -c "
              pacman -Syu --noconfirm base-devel cargo gcc-libs git && \
              useradd -m builduser && \
              echo 'builduser ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers && \
              chown -R builduser:builduser /build && \
              cd /build && \
              su builduser -c 'makepkg -s --noconfirm'
            "
          mkdir -p dist-packages && cp arch-build/*.pkg.tar.zst dist-packages/

      # ── Upload Artifacts ──
      - name: Upload Package Artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact_name }}
          path: dist-packages/*
          if-no-files-found: ignore

  # ── Publish Packages to Release (Out of Matrix) ────────────────────────────
  publish-dexoron-packages:
    needs: [setup, notes, build-linux-packages, create-release]
    runs-on: ubuntu-latest
    steps:
      - name: Download Release Notes
        uses: actions/download-artifact@v4
        with:
          name: release-notes
          path: .github

      - name: Download Built Packages
        uses: actions/download-artifact@v4
        with:
          path: collected-packages

      - name: Upload Everything to GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.setup.outputs.tag }}
          files: |
            collected-packages/debian-package/*
            collected-packages/rpm-package/*
            collected-packages/arch-package/*
            collected-packages/snap-package/*
          body_path: .github/release-notes.md
          prerelease: ${{ needs.setup.outputs.prerelease == 'true' }}

  # ── macOS Matrix ───────────────────────────────────────────────────────────
  build-macos:
    if: ${{ github.event_name == 'push' || github.event.inputs.run_macos == 'true' }}
    needs: [setup, notes, create-release]
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-15-intel
            target: x86_64-apple-darwin
          - os: macos-latest
            target: aarch64-apple-darwin
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.setup.outputs.tag }}

      - name: Download Release Notes
        uses: actions/download-artifact@v4
        with:
          name: release-notes
          path: .github

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Build
        run: cargo build --release --target ${{ matrix.target }}

      - name: Prepare Artifact
        run: |
          ASSET="dcr-${{ matrix.target }}-${{ needs.setup.outputs.version }}"
          cp target/${{ matrix.target }}/release/dcr "$ASSET"
          echo "ASSET_NAME=${ASSET}" >> "$GITHUB_ENV"

      - name: Upload Release Asset
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.setup.outputs.tag }}
          files: ${{ env.ASSET_NAME }}
          body_path: .github/release-notes.md
          prerelease: ${{ needs.setup.outputs.prerelease == 'true' }}

  # ── BSD Systems Matrix ─────────────────────────────────────────────────────
  build-bsd:
    if: ${{ github.event_name == 'push' || github.event.inputs.run_bsd == 'true' }}
    needs: [setup, notes, create-release]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        system: [freebsd, openbsd, netbsd]
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.setup.outputs.tag }}

      - name: Download Release Notes
        uses: actions/download-artifact@v4
        with:
          name: release-notes
          path: .github

      # --- FREEBSD ---
      - name: Build in FreeBSD VM
        if: matrix.system == 'freebsd'
        uses: vmactions/freebsd-vm@v1
        with:
          usesh: true
          run: |
            export PATH="/usr/local/bin:/usr/local/sbin:$PATH"
            pkg install -y rust perl5 gmake
            cargo build --release

      - name: Prepare FreeBSD Artifact
        if: matrix.system == 'freebsd'
        run: |
          ASSET="dcr-x86_64-unknown-freebsd-${{ needs.setup.outputs.version }}"
          cp target/release/dcr "$ASSET"
          echo "BSD_ASSET=${ASSET}" >> "$GITHUB_ENV"

      # --- OPENBSD ---
      - name: Build in OpenBSD VM
        if: matrix.system == 'openbsd'
        uses: vmactions/openbsd-vm@v1
        with:
          usesh: true
          run: |
            export PATH="/usr/local/bin:$PATH"
            pkg_add rust perl gmake
            cargo build --release

      - name: Prepare OpenBSD Artifact
        if: matrix.system == 'openbsd'
        run: |
          ASSET="dcr-x86_64-unknown-openbsd-${{ needs.setup.outputs.version }}"
          cp target/release/dcr "$ASSET"
          echo "BSD_ASSET=${ASSET}" >> "$GITHUB_ENV"

      # --- NETBSD ---
      - name: Build in NetBSD VM
        if: matrix.system == 'netbsd'
        uses: vmactions/netbsd-vm@v1
        with:
          usesh: true
          run: |
            pkg_add rust perl gmake
            mkdir -p /tmp/bin
            ln -sf /usr/pkg/bin/gmake /tmp/bin/make
            export PATH="/tmp/bin:/usr/pkg/bin:/usr/pkg/sbin:$PATH"
            cargo build --release

      - name: Prepare NetBSD Artifact
        if: matrix.system == 'netbsd'
        run: |
          ASSET="dcr-x86_64-unknown-netbsd-${{ needs.setup.outputs.version }}"
          cp target/release/dcr "$ASSET"
          echo "BSD_ASSET=${ASSET}" >> "$GITHUB_ENV"

      # --- UPLOAD TARGET ---
      - name: Upload BSD Asset to Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.setup.outputs.tag }}
          files: ${{ env.BSD_ASSET }}
          body_path: .github/release-notes.md
          prerelease: ${{ needs.setup.outputs.prerelease == 'true' }}

  # ── Windows Matrix ─────────────────────────────────────────────────────────
  build-windows:
    if: ${{ github.event_name == 'push' || github.event.inputs.run_windows == 'true' }}
    needs: [setup, notes, create-release]
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-pc-windows-msvc
          - target: aarch64-pc-windows-msvc
          - target: i686-pc-windows-msvc
          - target: x86_64-pc-windows-gnu
          - target: i686-pc-windows-gnu
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.setup.outputs.tag }}

      - name: Download Release Notes
        uses: actions/download-artifact@v4
        with:
          name: release-notes
          path: .github

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Build
        run: cargo build --release --target ${{ matrix.target }}

      - name: Prepare Artifact
        shell: pwsh
        run: |
          $asset = "dcr-${{ matrix.target }}-${{ needs.setup.outputs.version }}.exe"
          Copy-Item "target/${{ matrix.target }}/release/dcr.exe" "$asset"
          "ASSET_NAME=$asset" >> $env:GITHUB_ENV

      - name: Upload Release Asset
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.setup.outputs.tag }}
          files: ${{ env.ASSET_NAME }}
          body_path: .github/release-notes.md
          prerelease: ${{ needs.setup.outputs.prerelease == 'true' }}
 
  # ── Arch User Repository (dcr) ───────────────────────────────────
  publish-aur:
    if: ${{ (github.event_name == 'push' && needs.setup.outputs.prerelease == 'false') || github.event.inputs.run_aur == 'true' }}
    needs: [setup]
    runs-on: ubuntu-latest
    environment: aur
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Derive checksum
        id: meta
        shell: bash
        run: |
          set -euo pipefail
          SRC_URL="https://github.com/dexoron/dcr/archive/refs/tags/${{ needs.setup.outputs.tag }}.tar.gz"
          SHA256="$(curl -fsSL "$SRC_URL" | sha256sum | awk '{print $1}')"
          echo "source_url=$SRC_URL" >> "$GITHUB_OUTPUT"
          echo "sha256=$SHA256" >> "$GITHUB_OUTPUT"

      - name: Render AUR metadata
        shell: bash
        run: |
          set -euo pipefail
          PKGVER_ORIG='${{ needs.setup.outputs.version }}'
          PKGVER_CLEAN="${PKGVER_ORIG//-/.}"
          SRC_URL='${{ steps.meta.outputs.source_url }}'
          SHA256='${{ steps.meta.outputs.sha256 }}'

          mkdir -p packages/aur/dcr
          cat > packages/aur/dcr/PKGBUILD <<PKG
          pkgname=dcr
          pkgver=${PKGVER_CLEAN}
          pkgrel=1
          pkgdesc="Cargo-like utility to manage C/C++ projects"
          arch=('x86_64' 'aarch64')
          url="https://github.com/dexoron/dcr"
          license=('GPL-3.0-or-later')
          depends=('gcc-libs')
          makedepends=('cargo')
          options=('!lto')
          optdepends=(
            'gcc: build C/C++ projects with GCC'
            'clang: build C/C++ projects with Clang'
          )
          source=("\$pkgname-\$pkgver.tar.gz::${SRC_URL}")
          sha256sums=('${SHA256}')

          build() {
            cd "\$srcdir/\$pkgname-${PKGVER_ORIG}"
            unset CFLAGS CXXFLAGS LDFLAGS
            export RUSTFLAGS="-C linker=cc"
            cargo build --release --locked
          }

          package() {
            cd "\$srcdir/\$pkgname-${PKGVER_ORIG}"
            install -Dm755 "target/release/dcr" "\$pkgdir/usr/bin/dcr"
            install -Dm644 LICENSE "\$pkgdir/usr/share/licenses/\$pkgname/LICENSE"
          }
          PKG

          cat > packages/aur/dcr/.SRCINFO <<SRC
          pkgbase = dcr
            pkgdesc = Cargo-like utility to manage C/C++ projects
            pkgver = ${PKGVER_CLEAN}
            pkgrel = 1
            url = https://github.com/dexoron/dcr
            arch = x86_64
            arch = aarch64
            license = GPL-3.0-or-later
            makedepends = cargo
            depends = gcc-libs
            optdepends = gcc: build C/C++ projects with GCC
            optdepends = clang: build C/C++ projects with Clang
            options = !lto
            source = dcr-${PKGVER_CLEAN}.tar.gz::${SRC_URL}
            sha256sums = ${SHA256}

          pkgname = dcr
          SRC

      - name: Push to AUR
        env:
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
          AUR_PACKAGE: dcr
        shell: bash
        run: |
          set -euo pipefail
          install -d -m 700 ~/.ssh
          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts

          export GIT_SSH_COMMAND='ssh -i ~/.ssh/aur -o IdentitiesOnly=yes'
          
          mkdir -p aur-repo
          cd aur-repo
          git init
          git remote add origin "ssh://aur@aur.archlinux.org/${AUR_PACKAGE}.git"
          
          git fetch origin master || true
          git checkout master || git checkout -b master
          
          cp ../packages/aur/dcr/PKGBUILD .
          cp ../packages/aur/dcr/.SRCINFO .

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          if git rev-parse --verify HEAD >/dev/null 2>&1; then
            if git diff --quiet; then
              echo "No AUR changes"
              exit 0
            fi
          fi

          git add PKGBUILD .SRCINFO
          git commit -m "dcr ${{ needs.setup.outputs.version }}"
          git push -u origin master

  # ── Arch User Repository (dcr-bin) ────────────────────────────────
  publish-aur-bin:
    if: ${{ (github.event_name == 'push' && needs.setup.outputs.prerelease == 'false') || github.event.inputs.run_aur == 'true' }}
    needs: [setup, build-linux]
    runs-on: ubuntu-latest
    environment: aur
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Derive checksum
        id: meta
        shell: bash
        run: |
          set -euo pipefail
          TAG="${{ needs.setup.outputs.tag }}"
          VER="${{ needs.setup.outputs.version }}"
          BASE_URL="https://github.com/dexoron/dcr/releases/download/${TAG}"
          for arch in x86_64 aarch64 i686 armv7h riscv64; do
            case "$arch" in
              x86_64)  triple="x86_64-unknown-linux-musl" ;;
              aarch64) triple="aarch64-unknown-linux-musl" ;;
              i686)    triple="i686-unknown-linux-musl" ;;
              armv7h)  triple="armv7-unknown-linux-musleabihf" ;;
              riscv64) triple="riscv64gc-unknown-linux-musl" ;;
            esac
            url="${BASE_URL}/dcr-${triple}-${VER}"
            sha256="$(curl -fsSL "$url" | sha256sum | awk '{print $1}')"
            echo "${arch}_url=${url}" >> "$GITHUB_OUTPUT"
            echo "${arch}_sha256=${sha256}" >> "$GITHUB_OUTPUT"
          done

      - name: Render AUR Metadata
        shell: bash
        run: |
          set -euo pipefail
          PKGVER_ORIG='${{ needs.setup.outputs.version }}'
          PKGVER_CLEAN="${PKGVER_ORIG//-/.}"
          mkdir -p packages/aur/dcr-bin
          cat > packages/aur/dcr-bin/PKGBUILD <<PKG
          pkgname=dcr-bin
          pkgver=${PKGVER_CLEAN}
          pkgrel=1
          pkgdesc="Cargo-like utility to manage C/C++ projects (pre-compiled musl binary)"
          arch=('x86_64' 'aarch64' 'i686' 'armv7h' 'riscv64')
          url="https://github.com/dexoron/dcr"
          license=('GPL-3.0-or-later')
          provides=('dcr')
          conflicts=('dcr')
          optdepends=(
            'gcc: build C/C++ projects with GCC'
            'clang: build C/C++ projects with Clang'
          )
          source_x86_64=("dcr-\$pkgver::${{ steps.meta.outputs.x86_64_url }}")
          sha256sums_x86_64=('${{ steps.meta.outputs.x86_64_sha256 }}')
          source_aarch64=("dcr-\$pkgver::${{ steps.meta.outputs.aarch64_url }}")
          sha256sums_aarch64=('${{ steps.meta.outputs.aarch64_sha256 }}')
          source_i686=("dcr-\$pkgver::${{ steps.meta.outputs.i686_url }}")
          sha256sums_i686=('${{ steps.meta.outputs.i686_sha256 }}')
          source_armv7h=("dcr-\$pkgver::${{ steps.meta.outputs.armv7h_url }}")
          sha256sums_armv7h=('${{ steps.meta.outputs.armv7h_sha256 }}')
          source_riscv64=("dcr-\$pkgver::${{ steps.meta.outputs.riscv64_url }}")
          sha256sums_riscv64=('${{ steps.meta.outputs.riscv64_sha256 }}')

          package() {
            install -Dm755 "\$srcdir/dcr-\$pkgver" "\$pkgdir/usr/bin/dcr"
          }
          PKG

          cat > packages/aur/dcr-bin/.SRCINFO <<SRC
          pkgbase = dcr-bin
            pkgdesc = Cargo-like utility to manage C/C++ projects (pre-compiled musl binary)
            pkgver = ${PKGVER_CLEAN}
            pkgrel = 1
            url = https://github.com/dexoron/dcr
            arch = x86_64
            arch = aarch64
            arch = i686
            arch = armv7h
            arch = riscv64
            license = GPL-3.0-or-later
            provides = dcr
            conflicts = dcr
            optdepends = gcc: build C/C++ projects with GCC
            optdepends = clang: build C/C++ projects with Clang
            source_x86_64 = dcr-${PKGVER_CLEAN}::${{ steps.meta.outputs.x86_64_url }}
            sha256sums_x86_64 = ${{ steps.meta.outputs.x86_64_sha256 }}
            source_aarch64 = dcr-${PKGVER_CLEAN}::${{ steps.meta.outputs.aarch64_url }}
            sha256sums_aarch64 = ${{ steps.meta.outputs.aarch64_sha256 }}
            source_i686 = dcr-${PKGVER_CLEAN}::${{ steps.meta.outputs.i686_url }}
            sha256sums_i686 = ${{ steps.meta.outputs.i686_sha256 }}
            source_armv7h = dcr-${PKGVER_CLEAN}::${{ steps.meta.outputs.armv7h_url }}
            sha256sums_armv7h = ${{ steps.meta.outputs.armv7h_sha256 }}
            source_riscv64 = dcr-${PKGVER_CLEAN}::${{ steps.meta.outputs.riscv64_url }}
            sha256sums_riscv64 = ${{ steps.meta.outputs.riscv64_sha256 }}

          pkgname = dcr-bin
          SRC

      - name: Push to AUR
        env:
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
          AUR_PACKAGE: dcr-bin
        shell: bash
        run: |
          set -euo pipefail
          install -d -m 700 ~/.ssh
          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts

          export GIT_SSH_COMMAND='ssh -i ~/.ssh/aur -o IdentitiesOnly=yes'
          
          mkdir -p aur-repo
          cd aur-repo
          git init
          git remote add origin "ssh://aur@aur.archlinux.org/${AUR_PACKAGE}.git"
          
          git fetch origin master || true
          git checkout master || git checkout -b master
          
          cp ../packages/aur/dcr-bin/PKGBUILD .
          cp ../packages/aur/dcr-bin/.SRCINFO .

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          if git rev-parse --verify HEAD >/dev/null 2>&1; then
            if git diff --quiet; then
              echo "No AUR changes"
              exit 0
            fi
          fi

          git add PKGBUILD .SRCINFO
          git commit -m "dcr-bin ${{ needs.setup.outputs.version }}"
          git push -u origin master


  # ── Arch User Repository (dcr-dev) ────────────────────────────────
  publish-aur-dev:
    if: ${{ (github.event_name == 'push' && needs.setup.outputs.prerelease == 'true') || github.event.inputs.run_aur_dev == 'true' }}
    needs: [setup]
    runs-on: ubuntu-latest
    environment: aur
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Derive checksum
        id: meta
        shell: bash
        run: |
          set -euo pipefail
          SRC_URL="https://github.com/dexoron/dcr/archive/refs/tags/${{ needs.setup.outputs.tag }}.tar.gz"
          SHA256="$(curl -fsSL "$SRC_URL" | sha256sum | awk '{print $1}')"
          echo "source_url=$SRC_URL" >> "$GITHUB_OUTPUT"
          echo "sha256=$SHA256" >> "$GITHUB_OUTPUT"

      - name: Render AUR metadata
        shell: bash
        run: |
          set -euo pipefail
          PKGVER_ORIG='${{ needs.setup.outputs.version }}'
          PKGVER_CLEAN='${{ needs.setup.outputs.clean_version }}'
          SRC_URL='${{ steps.meta.outputs.source_url }}'
          SHA256='${{ steps.meta.outputs.sha256 }}'

          mkdir -p packages/aur/dcr-dev
          cat > packages/aur/dcr-dev/PKGBUILD <<PKG
          pkgname=dcr-dev
          pkgver=${PKGVER_CLEAN}
          pkgrel=1
          pkgdesc="Cargo-like utility to manage C/C++ projects (development release)"
          arch=('x86_64' 'aarch64')
          url="https://github.com/dexoron/dcr"
          license=('GPL-3.0-or-later')
          depends=('gcc-libs')
          makedepends=('cargo')
          options=('!lto')
          provides=('dcr')
          conflicts=('dcr')
          optdepends=(
            'gcc: build C/C++ projects with GCC'
            'clang: build C/C++ projects with Clang'
          )
          source=("\$pkgname-\$pkgver.tar.gz::${SRC_URL}")
          sha256sums=('${SHA256}')

          build() {
            cd "\$srcdir/dcr-${PKGVER_ORIG}"
            unset CFLAGS CXXFLAGS LDFLAGS
            export RUSTFLAGS="-C linker=cc"
            cargo build --release --locked
          }

          package() {
            cd "\$srcdir/dcr-${PKGVER_ORIG}"
            install -Dm755 "target/release/dcr" "\$pkgdir/usr/bin/dcr"
            install -Dm644 LICENSE "\$pkgdir/usr/share/licenses/\$pkgname/LICENSE"
          }
          PKG

          cat > packages/aur/dcr-dev/.SRCINFO <<SRC
          pkgbase = dcr-dev
            pkgdesc = Cargo-like utility to manage C/C++ projects (development release)
            pkgver = ${PKGVER_CLEAN}
            pkgrel = 1
            url = https://github.com/dexoron/dcr
            arch = x86_64
            arch = aarch64
            license = GPL-3.0-or-later
            makedepends = cargo
            depends = gcc-libs
            provides = dcr
            conflicts = dcr
            optdepends = gcc: build C/C++ projects with GCC
            optdepends = clang: build C/C++ projects with Clang
            options = !lto
            source = dcr-${PKGVER_CLEAN}.tar.gz::${SRC_URL}
            sha256sums = ${SHA256}

          pkgname = dcr-dev
          SRC

      - name: Push to AUR
        env:
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
          AUR_PACKAGE: dcr-dev
        shell: bash
        run: |
          set -euo pipefail
          install -d -m 700 ~/.ssh
          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts

          export GIT_SSH_COMMAND='ssh -i ~/.ssh/aur -o IdentitiesOnly=yes'
          
          mkdir -p aur-repo
          cd aur-repo
          git init
          git remote add origin "ssh://aur@aur.archlinux.org/${AUR_PACKAGE}.git"
          
          git fetch origin master || true
          git checkout master || git checkout -b master
          
          cp ../packages/aur/dcr-dev/PKGBUILD .
          cp ../packages/aur/dcr-dev/.SRCINFO .

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          if git rev-parse --verify HEAD >/dev/null 2>&1; then
            if git diff --quiet; then
              echo "No AUR changes"
              exit 0
            fi
          fi

          git add PKGBUILD .SRCINFO
          git commit -m "dcr-dev ${{ needs.setup.outputs.version }}"
          git push -u origin master

  # ── Arch User Repository (dcr-dev-bin) ────────────────────────────
  publish-aur-dev-bin:
    if: ${{ (github.event_name == 'push' && needs.setup.outputs.prerelease == 'true') || github.event.inputs.run_aur_dev == 'true' }}
    needs: [setup, build-linux]
    runs-on: ubuntu-latest
    environment: aur
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Derive checksum
        id: meta
        shell: bash
        run: |
          set -euo pipefail
          TAG="${{ needs.setup.outputs.tag }}"
          VER="${{ needs.setup.outputs.version }}"
          BASE_URL="https://github.com/dexoron/dcr/releases/download/${TAG}"
          for arch in x86_64 aarch64 i686 armv7h riscv64; do
            case "$arch" in
              x86_64)  triple="x86_64-unknown-linux-musl" ;;
              aarch64) triple="aarch64-unknown-linux-musl" ;;
              i686)    triple="i686-unknown-linux-musl" ;;
              armv7h)  triple="armv7-unknown-linux-musleabihf" ;;
              riscv64) triple="riscv64gc-unknown-linux-musl" ;;
            esac
            url="${BASE_URL}/dcr-${triple}-${VER}"
            sha256="$(curl -fsSL "$url" | sha256sum | awk '{print $1}')"
            echo "${arch}_url=${url}" >> "$GITHUB_OUTPUT"
            echo "${arch}_sha256=${sha256}" >> "$GITHUB_OUTPUT"
          done

      - name: Render AUR Metadata
        shell: bash
        run: |
          set -euo pipefail
          PKGVER_ORIG='${{ needs.setup.outputs.version }}'
          PKGVER_CLEAN='${{ needs.setup.outputs.clean_version }}'
          mkdir -p packages/aur/dcr-dev-bin
          cat > packages/aur/dcr-dev-bin/PKGBUILD <<PKG
          pkgname=dcr-dev-bin
          pkgver=${PKGVER_CLEAN}
          pkgrel=1
          pkgdesc="Cargo-like utility to manage C/C++ projects (pre-compiled musl binary dev release)"
          arch=('x86_64' 'aarch64' 'i686' 'armv7h' 'riscv64')
          url="https://github.com/dexoron/dcr"
          license=('GPL-3.0-or-later')
          provides=('dcr')
          conflicts=('dcr')
          optdepends=(
            'gcc: build C/C++ projects with GCC'
            'clang: build C/C++ projects with Clang'
          )
          source_x86_64=("dcr-\$pkgver::${{ steps.meta.outputs.x86_64_url }}")
          sha256sums_x86_64=('${{ steps.meta.outputs.x86_64_sha256 }}')
          source_aarch64=("dcr-\$pkgver::${{ steps.meta.outputs.aarch64_url }}")
          sha256sums_aarch64=('${{ steps.meta.outputs.aarch64_sha256 }}')
          source_i686=("dcr-\$pkgver::${{ steps.meta.outputs.i686_url }}")
          sha256sums_i686=('${{ steps.meta.outputs.i686_sha256 }}')
          source_armv7h=("dcr-\$pkgver::${{ steps.meta.outputs.armv7h_url }}")
          sha256sums_armv7h=('${{ steps.meta.outputs.armv7h_sha256 }}')
          source_riscv64=("dcr-\$pkgver::${{ steps.meta.outputs.riscv64_url }}")
          sha256sums_riscv64=('${{ steps.meta.outputs.riscv64_sha256 }}')

          package() {
            install -Dm755 "\$srcdir/dcr-\$pkgver" "\$pkgdir/usr/bin/dcr"
          }
          PKG

          cat > packages/aur/dcr-dev-bin/.SRCINFO <<SRC
          pkgbase = dcr-dev-bin
            pkgdesc = Cargo-like utility to manage C/C++ projects (pre-compiled musl binary dev release)
            pkgver = ${PKGVER_CLEAN}
            pkgrel = 1
            url = https://github.com/dexoron/dcr
            arch = x86_64
            arch = aarch64
            arch = i686
            arch = armv7h
            arch = riscv64
            license = GPL-3.0-or-later
            provides = dcr
            conflicts = dcr
            optdepends = gcc: build C/C++ projects with GCC
            optdepends = clang: build C/C++ projects with Clang
            source_x86_64 = dcr-${PKGVER_CLEAN}::${{ steps.meta.outputs.x86_64_url }}
            sha256sums_x86_64 = ${{ steps.meta.outputs.x86_64_sha256 }}
            source_aarch64 = dcr-${PKGVER_CLEAN}::${{ steps.meta.outputs.aarch64_url }}
            sha256sums_aarch64 = ${{ steps.meta.outputs.aarch64_sha256 }}
            source_i686 = dcr-${PKGVER_CLEAN}::${{ steps.meta.outputs.i686_url }}
            sha256sums_i686 = ${{ steps.meta.outputs.i686_sha256 }}
            source_armv7h = dcr-${PKGVER_CLEAN}::${{ steps.meta.outputs.armv7h_url }}
            sha256sums_armv7h = ${{ steps.meta.outputs.armv7h_sha256 }}
            source_riscv64 = dcr-${PKGVER_CLEAN}::${{ steps.meta.outputs.riscv64_url }}
            sha256sums_riscv64 = ${{ steps.meta.outputs.riscv64_sha256 }}

          pkgname = dcr-dev-bin
          SRC

      - name: Push to AUR
        env:
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
          AUR_PACKAGE: dcr-dev-bin
        shell: bash
        run: |
          set -euo pipefail
          install -d -m 700 ~/.ssh
          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts

          export GIT_SSH_COMMAND='ssh -i ~/.ssh/aur -o IdentitiesOnly=yes'
          
          mkdir -p aur-repo
          cd aur-repo
          git init
          git remote add origin "ssh://aur@aur.archlinux.org/${AUR_PACKAGE}.git"
          
          git fetch origin master || true
          git checkout master || git checkout -b master
          
          cp ../packages/aur/dcr-dev-bin/PKGBUILD .
          cp ../packages/aur/dcr-dev-bin/.SRCINFO .

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          if git rev-parse --verify HEAD >/dev/null 2>&1; then
            if git diff --quiet; then
              echo "No AUR changes"
              exit 0
            fi
          fi

          git add PKGBUILD .SRCINFO
          git commit -m "dcr-dev-bin ${{ needs.setup.outputs.version }}"
          git push -u origin master


  # ── crates.io ──────────────────────────────────────────────────────────────
  publish-crates:
    if: |
      (github.event_name == 'push' && needs.setup.outputs.prerelease == 'false') ||
      (github.event_name == 'workflow_dispatch' && github.event.inputs.run_publish == 'true')
    needs: [setup, build-linux, build-macos, build-windows, build-bsd]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.setup.outputs.tag }}

      - uses: dtolnay/rust-toolchain@stable

      - name: Publish to crates.io
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: cargo publish

  # ── Homebrew tap ───────────────────────────────────────────────────────────
  publish-brew:
    if: |
      (github.event_name == 'push' && needs.setup.outputs.prerelease == 'false') ||
      (github.event_name == 'workflow_dispatch' && github.event.inputs.run_brew == 'true')
    needs: [setup, build-linux, build-macos]
    runs-on: ubuntu-latest
    steps:
      - name: Download release assets and compute sha256
        id: sha
        run: |
          VERSION="${{ needs.setup.outputs.version }}"
          BASE="https://github.com/dexoron/dcr/releases/download/v${VERSION}"

          download_sha() {
            curl -fsSL "${BASE}/$1" | sha256sum | awk '{print $1}'
          }

          echo "linux_x86=$(download_sha "dcr-x86_64-unknown-linux-gnu-${VERSION}")"     >> "$GITHUB_OUTPUT"
          echo "linux_arm=$(download_sha "dcr-aarch64-unknown-linux-gnu-${VERSION}")"    >> "$GITHUB_OUTPUT"
          echo "macos_x86=$(download_sha "dcr-x86_64-apple-darwin-${VERSION}")"          >> "$GITHUB_OUTPUT"
          echo "macos_arm=$(download_sha "dcr-aarch64-apple-darwin-${VERSION}")"         >> "$GITHUB_OUTPUT"

      - name: Checkout homebrew-dexoron
        uses: actions/checkout@v4
        with:
          repository: dexoron/homebrew-dexoron
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}

      - name: Update Formula/dcr.rb
        run: |
          VERSION="${{ needs.setup.outputs.version }}"
          cat > Formula/dcr.rb <<FORMULA
          class Dcr < Formula
            desc "Cargo-like utility to manage C/C++ projects"
            homepage "https://dcr.dexoron.su"
            version "${VERSION}"

            on_macos do
              on_intel do
                url "https://github.com/dexoron/dcr/releases/download/v#{version}/dcr-x86_64-apple-darwin-#{version}"
                sha256 "${{ steps.sha.outputs.macos_x86 }}"
              end
              on_arm do
                url "https://github.com/dexoron/dcr/releases/download/v#{version}/dcr-aarch64-apple-darwin-#{version}"
                sha256 "${{ steps.sha.outputs.macos_arm }}"
              end
            end

            on_linux do
              on_intel do
                url "https://github.com/dexoron/dcr/releases/download/v#{version}/dcr-x86_64-unknown-linux-gnu-#{version}"
                sha256 "${{ steps.sha.outputs.linux_x86 }}"
              end
              on_arm do
                url "https://github.com/dexoron/dcr/releases/download/v#{version}/dcr-aarch64-unknown-linux-gnu-#{version}"
                sha256 "${{ steps.sha.outputs.linux_arm }}"
              end
            end

            def install
              bin.install Dir["dcr*"].first => "dcr"
            end

            test do
              system "#{bin}/dcr", "--version"
            end
          end
          FORMULA

      - name: Commit and push
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Formula/dcr.rb
          git diff --staged --quiet && echo "No changes" && exit 0
          git commit -m "dcr ${{ needs.setup.outputs.version }}"
          git push
  
  # ── Snap Store (dcrup) ─────────────────────────────────────────────────────
  publish-snap:
    if: |
      (github.event_name == 'push' && needs.setup.outputs.prerelease == 'false') ||
      (github.event_name == 'workflow_dispatch' && github.event.inputs.run_snap == 'true')
    needs: [setup, build-linux-packages]
    runs-on: ubuntu-latest
    steps:
      - name: Download Built Packages
        uses: actions/download-artifact@v4
        with:
          name: snap-package
          path: dist-packages

      - name: Resolve Snap File
        id: snap-file
        run: |
          snap_file=$(ls dist-packages/*.snap 2>/dev/null | head -1)
          if [ -z "$snap_file" ]; then
            echo "No .snap file found in dist-packages/"
            exit 1
          fi
          echo "snap=$snap_file" >> "$GITHUB_OUTPUT"

      - name: Publish to Snap Store
        uses: snapcore/action-publish@v1
        env:
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
        with:
          snap: ${{ steps.snap-file.outputs.snap }}
          release: stable