release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  # Ensure CI checks pass before releasing
  ci:
    uses: ./.github/workflows/ci.yml
    permissions:
      contents: read

  build-and-release:
    name: Build release artifacts and publish
    runs-on: ubuntu-latest
    needs: ci
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.78.0"
          targets: wasm32-unknown-unknown

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: intent_settlement,proof_registry

      # Build intent_settlement release wasm
      - name: Build intent_settlement release wasm
        run: cd intent_settlement && cargo build --target wasm32-unknown-unknown --release

      # Build proof_registry release wasm
      - name: Build proof_registry release wasm
        run: cd proof_registry && cargo build --target wasm32-unknown-unknown --release

      # Compute checksums for both wasm binaries
      - name: Compute checksums
        run: |
          set -e

          # Paths to wasm binaries
          INTENT_WASM="intent_settlement/target/wasm32-unknown-unknown/release/vortex_intent_settlement.wasm"
          PROOF_WASM="proof_registry/target/wasm32-unknown-unknown/release/vortex_proof_registry.wasm"

          # Compute SHA-256 for each
          if command -v sha256sum &>/dev/null; then
            SHA_CMD="sha256sum"
          else
            SHA_CMD="shasum -a 256"
          fi

          $SHA_CMD "$INTENT_WASM" | awk '{print $1}' > intent_settlement.wasm.sha256
          $SHA_CMD "$PROOF_WASM" | awk '{print $1}' > proof_registry.wasm.sha256

          # Create combined SHASUMS256.txt
          echo "SHA256 checksums for release ${{ github.ref_name }}" > SHASUMS256.txt
          echo "" >> SHASUMS256.txt
          echo "intent_settlement.wasm:" >> SHASUMS256.txt
          cat intent_settlement.wasm.sha256 >> SHASUMS256.txt
          echo "" >> SHASUMS256.txt
          echo "proof_registry.wasm:" >> SHASUMS256.txt
          cat proof_registry.wasm.sha256 >> SHASUMS256.txt

          # Display for verification
          echo "=== Checksums ==="
          cat SHASUMS256.txt

      # Extract release notes from CHANGELOG.md
      - name: Extract release notes
        id: release_notes
        run: |
          # Extract version from tag (e.g., v1.2.3 -> 1.2.3)
          VERSION="${{ github.ref_name }}"
          VERSION="${VERSION#v}"

          # Try to find and extract the section for this version from CHANGELOG.md
          # Look for ## [VERSION] or ## version pattern
          RELEASE_NOTES=$(awk "
            /^## \[?$VERSION\]?/ {found=1; next}
            found && /^## / {exit}
            found {print}
          " CHANGELOG.md | sed '/^$/d' | head -n -1)

          if [ -z "$RELEASE_NOTES" ]; then
            RELEASE_NOTES="See CHANGELOG.md for details about this release."
          fi

          # Use environment file to handle multiline content safely
          {
            echo 'RELEASE_NOTES<<EOF'
            echo "$RELEASE_NOTES"
            echo 'EOF'
          } >> $GITHUB_ENV

      # Create GitHub Release with artifacts
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v1
        with:
          files: |
            intent_settlement/target/wasm32-unknown-unknown/release/vortex_intent_settlement.wasm
            proof_registry/target/wasm32-unknown-unknown/release/vortex_proof_registry.wasm
            SHASUMS256.txt
          body: ${{ env.RELEASE_NOTES }}
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # Post checksums to job summary for verification
      - name: Post verification summary
        if: success()
        run: |
          cat >> $GITHUB_STEP_SUMMARY <<'EOF'
          ## Release Artifacts

          ✓ Successfully built and published release ${{ github.ref_name }}

          ### Artifacts
          - `vortex_intent_settlement.wasm`
          - `vortex_proof_registry.wasm`
          - `SHASUMS256.txt`

          ### Verification
          Download the `.wasm` files from the release and verify checksums:

          ```bash
          # Download SHASUMS256.txt from the release
          sha256sum -c SHASUMS256.txt
          ```

          Both checksums should print `OK`. These signed artifacts are reproducible
          and match the ones generated by `./verify-build.sh` run locally with Rust 1.78.0.
          EOF