newgrok/.github/workflows/build.yml

# Native release builds of the patched grok binary.
#
# Matrix is host=target (no cross): Windows/Linux amd64 and macOS arm64.
# work/ is derived the same way as `make apply`, but the upstream checkout is
# a depth-1 fetch of the pinned SHA so CI does not clone full grok-build history.
name: Build

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"
  RUST_BACKTRACE: "1"

permissions:
  contents: read

jobs:
  build:
    name: ${{ matrix.artifact }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 180
    defaults:
      run:
        shell: bash
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            artifact: grok-linux-amd64
            exe: xai-grok-pager
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact: grok-windows-amd64
            exe: xai-grok-pager.exe
          - os: macos-14
            target: aarch64-apple-darwin
            artifact: grok-macos-arm64
            exe: xai-grok-pager

    steps:
      - name: Disable CRLF conversion
        run: git config --global core.autocrlf false

      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@1.94.0
        with:
          targets: ${{ matrix.target }}

      - uses: arduino/setup-protoc@v3
        with:
          version: "29.3"
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Apply patches onto pinned upstream
        run: |
          set -euo pipefail
          REV="$(grep -vE '^\s*(#|$)' upstream.rev | head -n1 | tr -d '[:space:]')"
          [[ -n "$REV" ]] || { echo "upstream.rev has no revision" >&2; exit 1; }

          git init work
          git -C work remote add origin https://github.com/xai-org/grok-build.git
          git -C work fetch --depth 1 origin "$REV"
          git -C work checkout --force --detach FETCH_HEAD
          git -C work checkout -B fork
          git -C work tag -f base
          git -C work config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git -C work config user.name "github-actions[bot]"

          shopt -s nullglob
          patches=("$GITHUB_WORKSPACE"/patches/*.patch)
          if ((${#patches[@]})); then
            git -C work am --3way --keep-cr --whitespace=nowarn "${patches[@]}"
          fi
          echo "work/ ready: upstream ${REV:0:12} + ${#patches[@]} patch(es)"

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: work
          key: ${{ matrix.target }}
          cache-targets: false

      - name: Release build
        working-directory: work
        run: cargo build --release --locked -p xai-grok-pager-bin --target ${{ matrix.target }}

      - name: Package
        env:
          TARGET: ${{ matrix.target }}
          ARTIFACT: ${{ matrix.artifact }}
          EXE: ${{ matrix.exe }}
        run: |
          set -euo pipefail
          src="work/target/${TARGET}/release/${EXE}"
          [[ -f "$src" ]] || { echo "missing $src" >&2; ls -la "work/target/${TARGET}/release" >&2; exit 1; }

          mkdir -p dist
          if [[ "$EXE" == *.exe ]]; then
            dest="dist/${ARTIFACT}.exe"
          else
            dest="dist/${ARTIFACT}"
            strip "$src" || true
          fi
          cp "$src" "$dest"

          {
            echo "artifact=$(basename "$dest")"
            echo "target=${TARGET}"
            echo "git=${GITHUB_SHA}"
            echo "upstream=$(grep -vE '^\s*(#|$)' upstream.rev | head -n1 | tr -d '[:space:]')"
            echo "rustc=$(rustc --version)"
          } > "dist/${ARTIFACT}.txt"

          if command -v sha256sum >/dev/null; then
            (cd dist && sha256sum "$(basename "$dest")" "${ARTIFACT}.txt" > "${ARTIFACT}.sha256")
          else
            (cd dist && shasum -a 256 "$(basename "$dest")" "${ARTIFACT}.txt" > "${ARTIFACT}.sha256")
          fi

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: dist/*
          if-no-files-found: error

  release:
    if: startsWith(github.ref, 'refs/tags/')
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - uses: softprops/action-gh-release@v2
        with:
          files: dist/*
          generate_release_notes: true
          fail_on_unmatched_files: true