release.yml

name: Release

on:
  push:
    tags: ["v*"]

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  IMAGE: ghcr.io/context-graph-ai/contextdb-server

permissions:
  contents: write
  packages: write

jobs:
  verify-version:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - name: Check tag matches Cargo.toml
        run: |
          TAG=${GITHUB_REF#refs/tags/v}
          CARGO=$(sed -n 's/^version = "\(.*\)"/\1/p' crates/contextdb-engine/Cargo.toml)
          if [ "$TAG" != "$CARGO" ]; then
            echo "::error::Tag v$TAG does not match Cargo.toml version $CARGO"
            exit 1
          fi

  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
      - name: Install test tools
        run: sudo apt-get update && sudo apt-get install -y ripgrep
      - run: cargo fmt --all --check
      - run: cargo clippy --workspace --all-targets -- -D warnings
      - run: CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-$PWD/target}/redb" cargo fmt --manifest-path crates/contextdb-redb/Cargo.toml --check
      - run: cargo clippy --manifest-path crates/contextdb-redb/Cargo.toml --target-dir "${CARGO_TARGET_DIR:-$PWD/target}/redb" --all-targets -- -D warnings
      - run: cargo test --workspace
      - run: cargo test --manifest-path crates/contextdb-redb/Cargo.toml --target-dir "${CARGO_TARGET_DIR:-$PWD/target}/redb" --locked
      - run: cargo build --release
      - run: bash scripts/verify-packaged-engine.sh

  publish-crates:
    needs: [verify-version, check]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
      - name: Publish crates in dependency order
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          publish_crate() {
            local crate=$1
            echo "Publishing $crate..."
            local -a publish_args
            if [ "$crate" = "contextdb-redb" ]; then
              publish_args=(--manifest-path "crates/$crate/Cargo.toml")
            else
              publish_args=(-p "$crate")
            fi
            cargo publish "${publish_args[@]}" --allow-dirty || {
              if cargo search "$crate" --limit 1 | grep -q "$(sed -n 's/^version = "\(.*\)"/\1/p' "crates/$crate/Cargo.toml")"; then
                echo "$crate already published, skipping"
              else
                exit 1
              fi
            }
          }

          # The engine's packaged metadata resolves this distinct registry package.
          publish_crate contextdb-redb
          sleep 30

          # Batch 1: leaf crates
          for crate in contextdb-core contextdb-tx contextdb-relational contextdb-graph contextdb-hnsw contextdb-vector; do
            publish_crate "$crate"
            sleep 30
          done

          echo "Rate limit: waiting 10 minutes before next batch..."
          sleep 600

          # Batch 2: engine depends on all above; server depends on engine; cli depends on both
          for crate in contextdb-parser contextdb-planner contextdb-engine contextdb-server contextdb-cli; do
            publish_crate "$crate"
            sleep 30
          done

  build-docker:
    needs: [verify-version, check]
    strategy:
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push digest
        id: build
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          platforms: ${{ matrix.platform }}
          push: true
          tags: ${{ env.IMAGE }}
          cache-from: type=gha,scope=${{ matrix.platform }}
          cache-to: type=gha,scope=${{ matrix.platform }},mode=max
          outputs: type=image,push-by-digest=true,name-canonical=true
      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: docker-digest-${{ strategy.job-index }}
          path: /tmp/digests/*

  publish-docker:
    needs: [build-docker, check]
    runs-on: ubuntu-latest
    steps:
      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          path: /tmp/digests
          pattern: docker-digest-*
          merge-multiple: true
      - name: Create manifest and push
        run: |
          cd /tmp/digests
          docker buildx imagetools create \
            -t $IMAGE:${{ github.ref_name }} \
            -t $IMAGE:latest \
            $(printf "$IMAGE@sha256:%s " *)

  build-binaries:
    needs: verify-version
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            bins: contextdb-cli,contextdb-server
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            bins: contextdb-cli,contextdb-server
          - target: x86_64-apple-darwin
            os: macos-latest
            bins: contextdb-cli
          - target: aarch64-apple-darwin
            os: macos-latest
            bins: contextdb-cli
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
        with:
          target: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          key: ${{ matrix.target }}
      - name: Install cross-compilation tools
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu
          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
      - name: Build
        run: |
          for bin in $(echo "${{ matrix.bins }}" | tr ',' ' '); do
            cargo build --release --target ${{ matrix.target }} -p $bin
          done
      - name: Package
        run: |
          mkdir -p dist
          for bin in $(echo "${{ matrix.bins }}" | tr ',' ' '); do
            # `bin` here is the CRATE name (used above for `-p`); the built
            # executable's own name only differs from its crate's for
            # contextdb-cli, whose [[bin]] target is named `contextdb`.
            case "$bin" in
              contextdb-cli) exe=contextdb ;;
              *) exe="$bin" ;;
            esac
            cp target/${{ matrix.target }}/release/$exe dist/
          done
          tar czf ${{ matrix.target }}.tar.gz -C dist .
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ${{ matrix.target }}
          path: ${{ matrix.target }}.tar.gz

  github-release:
    needs: [build-binaries]
    if: always() && needs.build-binaries.result == 'success'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          path: artifacts
          pattern: '*64*'
      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create ${{ github.ref_name }} \
            --title "${{ github.ref_name }}" \
            --generate-notes \
            artifacts/*/*.tar.gz

  publish-docs:
    needs: verify-version
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
      - name: Install mdBook
        run: cargo install mdbook --version 0.5.2
      - name: Build docs
        run: mdbook build
      - name: Dispatch to website repo
        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3
        with:
          token: ${{ secrets.WEBSITE_DEPLOY_TOKEN }}
          repository: context-graph-ai/contextdb-website
          event-type: docs-update
          client-payload: '{"ref": "${{ github.ref_name }}"}'
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: docs
          path: book/