buzz/.github/workflows/sprig.yml

name: Sprig

# Builds and publishes Sprig — one deploy-anywhere Linux multicall binary for:
#   sprout-acp       ACP harness that bridges Sprout events to the LLM agent
#   sprout-agent     ACP-compliant agent (spawns MCP, calls LLMs)
#   sprout-dev-mcp   Developer MCP server (multicall: rg, tree, sprout,
#                    git-credential-nostr, git-sign-nostr)
#
# Targets: x86_64-unknown-linux-musl and aarch64-unknown-linux-musl (static
# musl so the tarball runs on any modern Linux without libc surprises).
#
# Triggers:
#   - push to main     → updates rolling `sprig-latest` release
#   - tag `sprig-v*`  → versioned release
#   - workflow_dispatch → manual canary build (no release publish unless asked)

on:
  push:
    branches: [main]
    tags: ["sprig-v*"]
  workflow_dispatch:
    inputs:
      publish:
        description: "Publish to the rolling release (otherwise artifacts only)"
        type: boolean
        default: false

permissions:
  contents: read

jobs:
  build:
    name: Build (${{ matrix.target }})
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        target:
          - x86_64-unknown-linux-musl
          - aarch64-unknown-linux-musl
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1

      - name: Install cross
        uses: taiki-e/install-action@6c1f7cf125e42770ff087ea443901b487cc5471a # v2.79.5
        with:
          tool: cross@0.2.5

      - name: Resolve version
        id: ver
        run: |
          set -euo pipefail
          WORKSPACE_VERSION=$(cargo metadata --no-deps --format-version=1 \
            | jq -r '.packages[] | select(.name=="sprig") | .version')

          REF="${GITHUB_REF#refs/tags/}"
          if [[ "$GITHUB_REF" == refs/tags/sprig-v* ]]; then
            VERSION="${REF#sprig-v}"
            CHANNEL="tag"
          else
            SHORT_SHA="${GITHUB_SHA::7}"
            VERSION="${WORKSPACE_VERSION}+git.${SHORT_SHA}"
            CHANNEL="rolling"
          fi
          {
            echo "workspace_version=$WORKSPACE_VERSION"
            echo "version=$VERSION"
            echo "channel=$CHANNEL"
          } >> "$GITHUB_OUTPUT"
          echo "Resolved version=$VERSION channel=$CHANNEL"

      - name: Build & package Sprig
        id: pkg
        env:
          TARGET: ${{ matrix.target }}
          VERSION: ${{ steps.ver.outputs.version }}
          CHANNEL: ${{ steps.ver.outputs.channel }}
          GIT_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          if [[ "$CHANNEL" == "tag" ]]; then
            ARCHIVE_BASENAME="sprig-${VERSION}-${TARGET}"
          else
            ARCHIVE_BASENAME="sprig-${TARGET}"
          fi
          ARCHIVE_BASENAME="$ARCHIVE_BASENAME" \
            ./scripts/build-sprig.sh "$VERSION" "$TARGET"
          ARCHIVE="dist/${ARCHIVE_BASENAME}.tar.gz"
          test -f "$ARCHIVE"
          echo "archive=$ARCHIVE" >> "$GITHUB_OUTPUT"
          echo "archive_name=${ARCHIVE_BASENAME}.tar.gz" >> "$GITHUB_OUTPUT"

      - name: Upload workflow artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: sprig-${{ matrix.target }}
          path: |
            ${{ steps.pkg.outputs.archive }}
            ${{ steps.pkg.outputs.archive }}.sha256
          if-no-files-found: error
          retention-days: 30

  publish:
    name: Publish rolling release
    needs: build
    if: |
      github.event_name == 'push' && github.ref == 'refs/heads/main'
      || (github.event_name == 'workflow_dispatch' && inputs.publish)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Download all Sprig artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: dist
          pattern: sprig-*
          merge-multiple: true

      - name: List assets
        run: ls -lh dist/

      - name: Update rolling release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO: ${{ github.repository }}
          SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          TAG="sprig-latest"
          TITLE="Sprig (rolling)"
          NOTES="Rolling Linux build of Sprig (all-in-one sprout-acp + sprout-agent + sprout-dev-mcp), tracking \`main\` (\`${SHA}\`)."

          if gh api "repos/${REPO}/git/refs/tags/${TAG}" >/dev/null 2>&1; then
            gh api -X PATCH "repos/${REPO}/git/refs/tags/${TAG}" \
              -f sha="${SHA}" -F force=true >/dev/null
          else
            gh api -X POST "repos/${REPO}/git/refs" \
              -f ref="refs/tags/${TAG}" -f sha="${SHA}" >/dev/null
          fi

          if ! gh release view "$TAG" >/dev/null 2>&1; then
            gh release create "$TAG" \
              --prerelease \
              --target "${SHA}" \
              --title "$TITLE" \
              --notes "$NOTES"
          else
            gh release edit "$TAG" \
              --prerelease \
              --target "${SHA}" \
              --title "$TITLE" \
              --notes "$NOTES"
          fi
          gh release upload "$TAG" dist/* --clobber

  publish-tag:
    name: Publish tagged release
    needs: build
    if: startsWith(github.ref, 'refs/tags/sprig-v')
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Download all Sprig artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: dist
          pattern: sprig-*
          merge-multiple: true

      - name: Resolve tag version
        id: ver
        run: |
          REF="${GITHUB_REF#refs/tags/}"
          VERSION="${REF#sprig-v}"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "tag=$REF" >> "$GITHUB_OUTPUT"

      - name: Create tagged release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ steps.ver.outputs.tag }}
          VERSION: ${{ steps.ver.outputs.version }}
        run: |
          set -euo pipefail
          gh release create "$TAG" \
            --title "Sprig v${VERSION}" \
            --notes "Sprig v${VERSION} — Linux all-in-one builds of sprout-acp + sprout-agent + sprout-dev-mcp." \
            dist/*