oxc/.github/workflows/release_apps.yml

name: Release Apps

permissions: {}

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - npm/oxfmt/package.json
      - npm/oxlint/package.json

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    if: github.repository == 'oxc-project/oxc'
    name: Check version
    runs-on: ubuntu-slim
    outputs:
      version_changed: ${{ steps.oxfmt.outputs.version_changed && steps.oxlint.outputs.version_changed }}
      oxfmt_version: ${{ steps.oxfmt.outputs.version }}
      oxlint_version: ${{ steps.oxlint.outputs.version }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - uses: oxc-project/setup-node@f46a72f95efdc55273fcd042d61c84e723b2892c # v1.4.1

      - parallel:
          - uses: $/.github/actions/check-version
            id: oxfmt
            with:
              file-name: npm/oxfmt/package.json
              file-url: https://unpkg.com/oxfmt@latest/package.json
          - uses: $/.github/actions/check-version
            id: oxlint
            with:
              file-name: npm/oxlint/package.json
              file-url: https://unpkg.com/oxlint@latest/package.json

      - name: Validate rule versions
        if: steps.oxlint.outputs.version_changed == 'true'
        env:
          OXLINT_VERSION: ${{ steps.oxlint.outputs.version }}
        run: |
          node .github/scripts/update-rule-versions.mts --release-version "$OXLINT_VERSION" --write
          git diff --exit-code -- crates/oxc_linter/src/rules

  build-oxlint:
    needs: check
    if: needs.check.outputs.version_changed == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            build: pnpm run build-napi-release --target x86_64-pc-windows-msvc

          - os: windows-latest
            target: aarch64-pc-windows-msvc
            build: pnpm run build-napi-release --target aarch64-pc-windows-msvc

          - os: windows-latest
            target: i686-pc-windows-msvc
            build: pnpm run build-napi-release --target i686-pc-windows-msvc

          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            build: pnpm run build-napi-release --target x86_64-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            build: pnpm run build-napi-release --target aarch64-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: armv7-unknown-linux-gnueabihf
            build: pnpm run build-napi-release --target armv7-unknown-linux-gnueabihf --use-napi-cross

          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            build: pnpm run build-napi-release --target x86_64-unknown-linux-musl -x

          - os: ubuntu-latest
            target: aarch64-unknown-linux-musl
            build: pnpm run build-napi-release --target aarch64-unknown-linux-musl -x

          - os: ubuntu-latest
            target: armv7-unknown-linux-musleabihf
            build: pnpm run build-napi-release --target armv7-unknown-linux-musleabihf -x

          - os: macos-latest
            target: x86_64-apple-darwin
            build: pnpm run build-napi-release --target x86_64-apple-darwin

          - os: macos-latest
            target: aarch64-apple-darwin
            build: pnpm run build-napi-release --target aarch64-apple-darwin

          - os: ubuntu-latest
            target: aarch64-linux-android
            build: pnpm run build-napi-release --target aarch64-linux-android

          - os: ubuntu-latest
            target: armv7-linux-androideabi
            build: pnpm run build-napi-release --target armv7-linux-androideabi

          - os: ubuntu-latest
            target: aarch64-unknown-linux-ohos
            build: pnpm run build-napi-release --target aarch64-unknown-linux-ohos

          - os: ubuntu-latest
            target: powerpc64le-unknown-linux-gnu
            build: pnpm run build-napi-release --target powerpc64le-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: riscv64gc-unknown-linux-gnu
            build: |
              sudo apt-get update
              sudo apt-get install gcc-riscv64-linux-gnu g++-riscv64-linux-gnu -y
              export TARGET_CC=riscv64-linux-gnu-gcc
              export CXX=riscv64-linux-gnu-g++
              pnpm run build-napi-release --target riscv64gc-unknown-linux-gnu

          - os: ubuntu-latest
            target: riscv64gc-unknown-linux-musl
            build: pnpm run build-napi-release --target riscv64gc-unknown-linux-musl -x

          - os: ubuntu-latest
            target: s390x-unknown-linux-gnu
            build: export CFLAGS="-fuse-ld=lld" && pnpm run build-napi-release --target s390x-unknown-linux-gnu --use-napi-cross

    name: Build Oxlint ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    env:
      # `clang` lacks the `__ldar64`/`__stlr64` MSVC intrinsics that mimalloc's
      # atomic.h uses on the ARM64 MSVC C path, so leave TARGET_CC unset on
      # `*-pc-windows-msvc` targets and let cc-rs pick `cl.exe`.
      TARGET_CC: ${{ !contains(matrix.target, 'pc-windows-msvc') && 'clang' || '' }} # for mimalloc
    defaults:
      run:
        shell: bash
    steps:
      - if: ${{ contains(matrix.os, 'windows') }}
        run: git config --system core.longpaths true

      - name: Install cross
        id: install-cross
        uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
        with:
          tool: cross # cross installs the latest rust toolchain
        background: true

      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      # No Rust cache is provided, to avoid cache poisoning attack.

      - parallel:
          - uses: oxc-project/setup-node@f46a72f95efdc55273fcd042d61c84e723b2892c # v1.4.1
          # For cargo-zigbuild in musl builds.
          - uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
            if: ${{ contains(matrix.target, 'musl') }}
            with:
              version: 0.13.0
          - name: Setup OpenHarmony SDK
            if: ${{ contains(matrix.target, 'ohos') }}
            uses: Boshen/setup-ohos-sdk@edb865a89a712f1f15dbad932dfa9cfce849d95c # v1.0.0

      - wait: install-cross

      - name: Add Rust Target
        run: rustup target add ${{ matrix.target }}

      - name: Build oxlint for node.js
        working-directory: apps/oxlint
        run: ${{ matrix.build }}

      - name: Build Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') && !contains(matrix.target, 'riscv64gc-unknown-linux-musl') }}
        run: cross build --release -p oxlint --features allocator --target=${{ matrix.target }}

      - name: Build Rust binary (zigbuild)
        if: ${{ contains(matrix.target, 'riscv64gc-unknown-linux-musl') }}
        run: |
          pip3 install cargo-zigbuild
          cargo zigbuild --release -p oxlint --features allocator --target=${{ matrix.target }}

      - parallel:
          - name: Upload NAPI artifact
            uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
            with:
              if-no-files-found: error
              name: oxlint-bindings-${{ matrix.target }}
              path: |
                apps/oxlint/src-js/*.node
                apps/oxlint/src-js/*.wasm
          # The binaries are zipped to fix permission loss https://github.com/actions/upload-artifact#permission-loss
          - name: Archive Rust binary
            if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
            uses: $/.github/actions/archive-binary
            with:
              source_path: target/${{ matrix.target }}/release/oxlint${{ runner.os == 'Windows' && '.exe' || '' }}
              binary_name: oxlint-${{ matrix.target }}${{ runner.os == 'Windows' && '.exe' || '' }}
              archive_name: rust-oxlint-${{ matrix.target }}

      # For github release
      - name: Upload Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          if-no-files-found: error
          name: rust-oxlint-${{ matrix.target }}
          path: |
            rust-oxlint-**.zip
            rust-oxlint-**.tar.gz

  build-oxlint-freebsd:
    needs: check
    if: needs.check.outputs.version_changed == 'true'
    name: Build Oxlint FreeBSD
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - parallel:
          - uses: oxc-project/setup-node@f46a72f95efdc55273fcd042d61c84e723b2892c # v1.4.1
          - run: rustup target add x86_64-unknown-freebsd
          - name: Install Zig
            uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
            with:
              version: "0.15.2"
          - name: Install cargo-zigbuild
            uses: jaxxstorm/action-install-gh-release@25e24d2d23ae098373794ef1d6faecb48ee52da8 # v3.0.0
            with:
              repo: rust-cross/cargo-zigbuild

      - name: Build oxlint for node.js
        working-directory: apps/oxlint
        run: pnpm run build-napi-release --target x86_64-unknown-freebsd -x

      - name: Build Rust binary
        run: cargo zigbuild --release -p oxlint --features allocator --target=x86_64-unknown-freebsd

      - parallel:
          - name: Upload NAPI artifact
            uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
            with:
              if-no-files-found: error
              name: oxlint-bindings-x86_64-unknown-freebsd
              path: apps/oxlint/src-js/*.node
          - name: Archive Rust binary
            uses: $/.github/actions/archive-binary
            with:
              source_path: target/x86_64-unknown-freebsd/release/oxlint
              binary_name: oxlint-x86_64-unknown-freebsd
              archive_name: rust-oxlint-x86_64-unknown-freebsd

      - name: Upload Rust binary
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          if-no-files-found: error
          name: rust-oxlint-x86_64-unknown-freebsd
          path: |
            rust-oxlint-**.zip
            rust-oxlint-**.tar.gz

  notify-approval:
    needs: [check, build-oxlint, build-oxlint-freebsd, build-oxfmt, build-oxfmt-freebsd]
    if: needs.check.outputs.version_changed == 'true'
    name: Notify Approval
    runs-on: ubuntu-slim
    steps:
      - uses: tsickert/discord-webhook@b217a69502f52803de774ded2b1ab7c282e99645 # v7.0.0
        with:
          webhook-url: ${{ secrets.DISCORD_OXC_CORE_CHANNEL }}
          content: "Requesting approval: https://github.com/oxc-project/oxc/actions/workflows/release_apps.yml"

  publish-oxlint:
    name: Publish Oxlint
    needs: [check, build-oxlint, build-oxlint-freebsd, notify-approval]
    runs-on: ubuntu-latest
    environment: release
    permissions:
      id-token: write # for `pnpm publish --provenance`
    env:
      package_path: npm/oxlint
      plugins_package_path: npm/oxlint-plugins
      plugin_eslint_package_path: npm/oxlint-plugin-eslint
      npm_dir: npm/oxlint-release
      PUBLISH_FLAGS: "--provenance --access public --no-git-checks"
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - parallel:
          - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
            with:
              path: artifacts
              pattern: oxlint-bindings-*
          - uses: oxc-project/setup-node@f46a72f95efdc55273fcd042d61c84e723b2892c # v1.4.1

      - name: Generate oxlint JS build
        working-directory: apps/oxlint
        run: pnpm run build-js

      - run: mkdir -p ${npm_dir}

      - run: pnpm napi create-npm-dirs --package-json-path ${package_path}/package.json --npm-dir ${npm_dir}

      - run: pnpm napi artifacts --package-json-path ${package_path}/package.json --build-output-dir apps/oxlint/src-js --npm-dir ${npm_dir}

      - name: Copy dist files to npm package
        run: cp -r apps/oxlint/dist npm/oxlint/dist

      - name: Copy dist files to @oxlint/plugins npm package
        run: |
          cp apps/oxlint/dist-pkg-plugins/* ${plugins_package_path}/

      - name: Copy dist files to oxlint-plugin-eslint npm package
        run: |
          cp -r apps/oxlint/dist-pkg-plugin-eslint/. ${plugin_eslint_package_path}/

      - name: Check Publish
        run: |
          node .github/scripts/check-npm-packages.js "${npm_dir}/*" "${package_path}"
          node .github/scripts/check-npm-packages.js "${plugins_package_path}"
          node .github/scripts/check-npm-packages.js "${plugin_eslint_package_path}"

      - name: Trusted Publish
        run: |
          # Trusted publishing is configured, publish token is not required.
          # Publish sub-packages and adds `optionalDependencies` to main package.
          pnpm napi pre-publish --no-gh-release -t npm --package-json-path ${package_path}/package.json --npm-dir ${npm_dir}
          # npm publish can finish before package metadata and tarballs are available.
          node .github/scripts/wait-for-npm-packages.mjs ${npm_dir}/*
          # Publish `oxlint` package
          bash .github/scripts/publish-if-needed.sh ${package_path} ${PUBLISH_FLAGS}
          # Publish `@oxlint/plugins` package
          bash .github/scripts/publish-if-needed.sh ${plugins_package_path} ${PUBLISH_FLAGS}
          # Publish `oxlint-plugin-eslint` package
          bash .github/scripts/publish-if-needed.sh ${plugin_eslint_package_path} ${PUBLISH_FLAGS}

  build-oxfmt:
    needs: check
    if: needs.check.outputs.version_changed == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            build: pnpm run build-napi-release --target x86_64-pc-windows-msvc

          - os: windows-latest
            target: aarch64-pc-windows-msvc
            build: pnpm run build-napi-release --target aarch64-pc-windows-msvc

          - os: windows-latest
            target: i686-pc-windows-msvc
            build: pnpm run build-napi-release --target i686-pc-windows-msvc

          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            build: pnpm run build-napi-release --target x86_64-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            build: pnpm run build-napi-release --target aarch64-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: armv7-unknown-linux-gnueabihf
            build: pnpm run build-napi-release --target armv7-unknown-linux-gnueabihf --use-napi-cross

          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            build: pnpm run build-napi-release --target x86_64-unknown-linux-musl -x

          - os: ubuntu-latest
            target: aarch64-unknown-linux-musl
            build: pnpm run build-napi-release --target aarch64-unknown-linux-musl -x

          - os: ubuntu-latest
            target: armv7-unknown-linux-musleabihf
            build: pnpm run build-napi-release --target armv7-unknown-linux-musleabihf -x

          - os: macos-latest
            target: x86_64-apple-darwin
            build: pnpm run build-napi-release --target x86_64-apple-darwin

          - os: macos-latest
            target: aarch64-apple-darwin
            build: pnpm run build-napi-release --target aarch64-apple-darwin

          - os: ubuntu-latest
            target: aarch64-linux-android
            build: pnpm run build-napi-release --target aarch64-linux-android

          - os: ubuntu-latest
            target: armv7-linux-androideabi
            build: pnpm run build-napi-release --target armv7-linux-androideabi

          - os: ubuntu-latest
            target: aarch64-unknown-linux-ohos
            build: pnpm run build-napi-release --target aarch64-unknown-linux-ohos

          - os: ubuntu-latest
            target: powerpc64le-unknown-linux-gnu
            build: pnpm run build-napi-release --target powerpc64le-unknown-linux-gnu --use-napi-cross

          - os: ubuntu-latest
            target: riscv64gc-unknown-linux-gnu
            build: |
              sudo apt-get update
              sudo apt-get install gcc-riscv64-linux-gnu g++-riscv64-linux-gnu -y
              export TARGET_CC=riscv64-linux-gnu-gcc
              export CXX=riscv64-linux-gnu-g++
              pnpm run build-napi-release --target riscv64gc-unknown-linux-gnu

          - os: ubuntu-latest
            target: riscv64gc-unknown-linux-musl
            build: pnpm run build-napi-release --target riscv64gc-unknown-linux-musl -x

          - os: ubuntu-latest
            target: s390x-unknown-linux-gnu
            build: export CFLAGS="-fuse-ld=lld" && pnpm run build-napi-release --target s390x-unknown-linux-gnu --use-napi-cross

    name: Build Oxfmt ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    env:
      # `clang` lacks the `__ldar64`/`__stlr64` MSVC intrinsics that mimalloc's
      # atomic.h uses on the ARM64 MSVC C path, so leave TARGET_CC unset on
      # `*-pc-windows-msvc` targets and let cc-rs pick `cl.exe`.
      TARGET_CC: ${{ !contains(matrix.target, 'pc-windows-msvc') && 'clang' || '' }} # for mimalloc
    defaults:
      run:
        shell: bash
    steps:
      - if: ${{ contains(matrix.os, 'windows') }}
        run: git config --system core.longpaths true

      - name: Install cross
        id: install-cross
        uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
        with:
          tool: cross # cross installs the latest rust toolchain
        background: true

      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      # No Rust cache is provided, to avoid cache poisoning attack.

      - parallel:
          - uses: oxc-project/setup-node@f46a72f95efdc55273fcd042d61c84e723b2892c # v1.4.1
          # For cargo-zigbuild in musl builds.
          - uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
            if: ${{ contains(matrix.target, 'musl') }}
            with:
              version: 0.13.0
          - name: Setup OpenHarmony SDK
            if: ${{ contains(matrix.target, 'ohos') }}
            uses: Boshen/setup-ohos-sdk@edb865a89a712f1f15dbad932dfa9cfce849d95c # v1.0.0

      - wait: install-cross

      - name: Add Rust Target
        run: rustup target add ${{ matrix.target }}

      - name: Build oxfmt for node.js
        working-directory: apps/oxfmt
        run: ${{ matrix.build }}

      - name: Build Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') && !contains(matrix.target, 'riscv64gc-unknown-linux-musl') }}
        run: cross build --release -p oxfmt --no-default-features --features allocator --target=${{ matrix.target }}

      - name: Build Rust binary (zigbuild)
        if: ${{ contains(matrix.target, 'riscv64gc-unknown-linux-musl') }}
        run: |
          pip3 install cargo-zigbuild
          cargo zigbuild --release -p oxfmt --no-default-features --features allocator --target=${{ matrix.target }}

      - parallel:
          - name: Upload NAPI artifact
            uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
            with:
              if-no-files-found: error
              name: oxfmt-bindings-${{ matrix.target }}
              path: |
                apps/oxfmt/src-js/*.node
                apps/oxfmt/src-js/*.wasm
          # The binaries are zipped to fix permission loss https://github.com/actions/upload-artifact#permission-loss
          - name: Archive Rust binary
            if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
            uses: $/.github/actions/archive-binary
            with:
              source_path: target/${{ matrix.target }}/release/oxfmt${{ runner.os == 'Windows' && '.exe' || '' }}
              binary_name: oxfmt-${{ matrix.target }}${{ runner.os == 'Windows' && '.exe' || '' }}
              archive_name: rust-oxfmt-${{ matrix.target }}

      # For github release
      - name: Upload Rust binary
        if: ${{ !contains(matrix.target, 'wasm') && !contains(matrix.target, 'android') && !contains(matrix.target, 'ohos') }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          if-no-files-found: error
          name: rust-oxfmt-${{ matrix.target }}
          path: |
            rust-oxfmt-**.zip
            rust-oxfmt-**.tar.gz

  build-oxfmt-freebsd:
    needs: check
    if: needs.check.outputs.version_changed == 'true'
    name: Build Oxfmt FreeBSD
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - parallel:
          - uses: oxc-project/setup-node@f46a72f95efdc55273fcd042d61c84e723b2892c # v1.4.1
          - run: rustup target add x86_64-unknown-freebsd
          - name: Install Zig
            uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
            with:
              version: "0.15.2"
          - name: Install cargo-zigbuild
            uses: jaxxstorm/action-install-gh-release@25e24d2d23ae098373794ef1d6faecb48ee52da8 # v3.0.0
            with:
              repo: rust-cross/cargo-zigbuild

      - name: Build oxfmt for node.js
        working-directory: apps/oxfmt
        run: pnpm run build-napi-release --target x86_64-unknown-freebsd -x

      - name: Build Rust binary
        run: cargo zigbuild --release -p oxfmt --no-default-features --features allocator --target=x86_64-unknown-freebsd

      - parallel:
          - name: Upload NAPI artifact
            uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
            with:
              if-no-files-found: error
              name: oxfmt-bindings-x86_64-unknown-freebsd
              path: apps/oxfmt/src-js/*.node
          - name: Archive Rust binary
            uses: $/.github/actions/archive-binary
            with:
              source_path: target/x86_64-unknown-freebsd/release/oxfmt
              binary_name: oxfmt-x86_64-unknown-freebsd
              archive_name: rust-oxfmt-x86_64-unknown-freebsd

      - name: Upload Rust binary
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          if-no-files-found: error
          name: rust-oxfmt-x86_64-unknown-freebsd
          path: |
            rust-oxfmt-**.zip
            rust-oxfmt-**.tar.gz

  publish-oxfmt:
    name: Publish Oxfmt
    needs: [check, build-oxfmt, build-oxfmt-freebsd, notify-approval]
    runs-on: ubuntu-latest
    environment: release
    permissions:
      id-token: write # for `pnpm publish --provenance`
    env:
      package_path: npm/oxfmt
      npm_dir: npm/oxfmt-release
      PUBLISH_FLAGS: "--provenance --access public --no-git-checks"
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - parallel:
          - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
            with:
              path: artifacts
              pattern: oxfmt-bindings-*
          - uses: oxc-project/setup-node@f46a72f95efdc55273fcd042d61c84e723b2892c # v1.4.1

      - name: Generate oxfmt JS build
        working-directory: apps/oxfmt
        run: pnpm run build-js

      - run: mkdir -p ${npm_dir}

      - run: pnpm napi create-npm-dirs --package-json-path ${package_path}/package.json --npm-dir ${npm_dir}

      - run: pnpm napi artifacts --package-json-path ${package_path}/package.json --build-output-dir apps/oxfmt/src-js --npm-dir ${npm_dir}

      - name: Copy dist files to npm package
        run: cp -r apps/oxfmt/dist npm/oxfmt/dist

      - name: Check Publish
        run: node .github/scripts/check-npm-packages.js "${npm_dir}/*" "${package_path}"

      - name: Trusted Publish
        run: |
          # Trusted publishing is configured, publish token is not required.
          # Publish sub-packages and adds `optionalDependencies` to main package.
          pnpm napi pre-publish --no-gh-release -t npm --package-json-path ${package_path}/package.json --npm-dir ${npm_dir}
          # npm publish can finish before package metadata and tarballs are available.
          node .github/scripts/wait-for-npm-packages.mjs ${npm_dir}/*
          bash .github/scripts/publish-if-needed.sh ${package_path} ${PUBLISH_FLAGS}

  github-release:
    name: GitHub Releases
    needs:
      [
        check,
        build-oxlint,
        build-oxlint-freebsd,
        build-oxfmt,
        build-oxfmt-freebsd,
        publish-oxlint,
        publish-oxfmt,
      ]
    permissions:
      contents: write # for `gh release create`
    runs-on: ubuntu-latest
    steps:
      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        with:
          client-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          permission-contents: write

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          token: ${{ steps.app-token.outputs.token }}
          fetch-depth: 0 # for changelog
          filter: blob:none
          persist-credentials: true

      - uses: oxc-project/setup-rust@3d6fb132fbe7cdcb66bf8ec193911c2945369d12 # v1.0.17
        with:
          restore-cache: false
          tools: cargo-release-oxc

      - name: Generate changelog
        run: |
          mkdir -p target
          cargo release-oxc changelog --release oxfmt --release oxlint

      - name: Tag Oxlint and Oxfmt
        env:
          NEEDS_CHECK_OUTPUTS_OXFMT_VERSION: ${{ needs.check.outputs.oxfmt_version }}
          NEEDS_CHECK_OUTPUTS_OXLINT_VERSION: ${{ needs.check.outputs.oxlint_version }}
        run: |
          git tag oxfmt_v${NEEDS_CHECK_OUTPUTS_OXFMT_VERSION} ${{ github.sha }}
          git tag oxlint_v${NEEDS_CHECK_OUTPUTS_OXLINT_VERSION} ${{ github.sha }}
          git push origin oxlint_v${NEEDS_CHECK_OUTPUTS_OXLINT_VERSION} oxfmt_v${NEEDS_CHECK_OUTPUTS_OXFMT_VERSION}

      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: ./release-artifacts
          pattern: rust-*
          merge-multiple: true

      - name: Remove rust- prefix from filenames
        run: |
          cd release-artifacts
          for file in rust-*; do
            mv "$file" "${file#rust-}"
          done
          ls

      - name: Create Oxfmt GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          GIT_TAG: oxfmt_v${{ needs.check.outputs.oxfmt_version }}
          TITLE: oxfmt v${{ needs.check.outputs.oxfmt_version }}
        run: gh release create "${GIT_TAG}" ./release-artifacts/oxfmt-* --title "${TITLE}" --notes-file ./target/OXFMT_CHANGELOG --verify-tag --latest=false

      - name: Create Oxlint GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          GIT_TAG: oxlint_v${{ needs.check.outputs.oxlint_version }}
          TITLE: oxlint v${{ needs.check.outputs.oxlint_version }}
        run: gh release create "${GIT_TAG}" ./release-artifacts/oxlint-* --title "${TITLE}" --notes-file ./target/OXLINT_CHANGELOG --verify-tag --latest

      - name: wait 3 minutes for smoke test
        run: sleep 180s

  smoke:
    needs: [check, github-release]
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
          - os: ubuntu-latest
          - os: ubuntu-latest
            container: node:24-alpine # musl
          - os: macos-latest
    name: Smoke Test ${{ matrix.os }} ${{ matrix.container }}
    runs-on: ${{ matrix.os }}
    container: ${{ matrix.container }}
    env:
      RELEASE_EMBED_TITLE: oxlint v${{ needs.check.outputs.oxlint_version }} & oxfmt v${{ needs.check.outputs.oxfmt_version }}
      RELEASE_EMBED_DESCRIPTION: New releases are available! Check the changelogs for details.
      RELEASE_EMBED_URL: https://github.com/${{ github.repository }}/releases
    steps:
      - name: Test
        # These commands should be run on these defaults:
        # - windows: pwsh
        # - ubuntu: bash
        # - alpine: sh
        # - macos: bash
        run: | # zizmor: ignore[template-injection]
          echo "" > test.js
          ldd --version || true
          npx oxfmt@${{ needs.check.outputs.oxfmt_version }} ./test.js
          npx oxlint@${{ needs.check.outputs.oxlint_version }} ./test.js

      - if: ${{ matrix.os == 'windows-latest' }}
        uses: tsickert/discord-webhook@b217a69502f52803de774ded2b1ab7c282e99645 # v7.0.0
        with:
          webhook-url: ${{ secrets.DISCORD_OXC_CORE_CHANNEL }}
          embed-title: ${{ env.RELEASE_EMBED_TITLE }}
          embed-description: ${{ env.RELEASE_EMBED_DESCRIPTION }}
          embed-url: ${{ env.RELEASE_EMBED_URL }}

      - if: ${{ matrix.os == 'windows-latest' }}
        uses: tsickert/discord-webhook@b217a69502f52803de774ded2b1ab7c282e99645 # v7.0.0
        with:
          webhook-url: ${{ secrets.DISCORD_OXC_RELEASES_CHANNEL }}
          embed-title: ${{ env.RELEASE_EMBED_TITLE }}
          embed-description: ${{ env.RELEASE_EMBED_DESCRIPTION }}
          embed-url: ${{ env.RELEASE_EMBED_URL }}

  bump:
    needs: [check, smoke]
    name: Bump oxlint dependents
    runs-on: ubuntu-slim
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        with:
          client-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          permission-actions: write
          owner: oxc-project
          repositories: |
            eslint-plugin-oxlint
            oxlint-migrate
            mirrors-oxlint
            mirrors-oxfmt

      - name: Bump oxc-project/eslint-plugin-oxlint
        uses: benc-uk/workflow-dispatch@d004979be141727c7a17c28f603e2facc40d0855 # v1.3.3
        with:
          repo: oxc-project/eslint-plugin-oxlint
          workflow: bump_oxlint.yml
          token: ${{ steps.app-token.outputs.token }}
          ref: main
          inputs: '{ "version": "${{ needs.check.outputs.oxlint_version }}" }'

      - name: Bump oxc-project/oxlint-migrate
        uses: benc-uk/workflow-dispatch@d004979be141727c7a17c28f603e2facc40d0855 # v1.3.3
        with:
          repo: oxc-project/oxlint-migrate
          workflow: bump_oxlint.yml
          token: ${{ steps.app-token.outputs.token }}
          ref: main
          inputs: '{ "version": "${{ needs.check.outputs.oxlint_version }}" }'

      - name: Bump oxc-project/mirrors-oxlint
        uses: benc-uk/workflow-dispatch@d004979be141727c7a17c28f603e2facc40d0855 # v1.3.3
        with:
          repo: oxc-project/mirrors-oxlint
          workflow: main.yml
          token: ${{ steps.app-token.outputs.token }}
          ref: main

      - name: Bump oxc-project/mirrors-oxfmt
        uses: benc-uk/workflow-dispatch@d004979be141727c7a17c28f603e2facc40d0855 # v1.3.3
        with:
          repo: oxc-project/mirrors-oxfmt
          workflow: main.yml
          token: ${{ steps.app-token.outputs.token }}
          ref: main