mcp/.hanzo/workflows/release.yml

# Builds the hanzo-mcp binary for every target the installer offers, and
# attaches each with its checksum.
#
# There was no such lane. hanzo.yml declares a TypeScript gate and publish.yml
# ships the npm package; neither produces a binary, so the tarballs on the
# rust-v1.1.23 release arrived some other way and only ever covered Linux.
# hanzo.sh offers `mcp` as a native download, so on macOS it asked for a file
# nobody had built.
#
# Tagged rust-v*, because the binary is the Rust crate in rust/ — its
# Cargo.toml is the one that calls itself hanzo-mcp.
#
# .hanzo/workflows, with every other pipeline in this repository. The forge
# reads the FIRST of .hanzo/workflows and .github/workflows that exists, so a
# file left in the other directory is a pipeline that never runs.
name: release

on:
  push:
    tags: ['rust-v*']
  workflow_dispatch:

permissions:
  contents: write

jobs:
  # The release has to exist before anything can be attached to it, and four
  # matrix jobs racing to create it is three failures and a coin toss. One job,
  # first, and the builds wait on it.
  open:
    runs-on: linux-amd64
    steps:
      # The runner image carries no gh CLI; the release action speaks the API.
      - uses: softprops/action-gh-release@v2
        with:
          name: hanzo-mcp ${{ github.ref_name }}
          generate_release_notes: true

  build:
    needs: open
    strategy:
      # One target failing leaves the others published rather than the release
      # empty. A missing target is a missing file somebody can chase; a missing
      # release is an install that breaks for everyone.
      fail-fast: false
      matrix:
        include:
          - target: linux-amd64
            triple: x86_64-unknown-linux-gnu
          # The org's runners are linux-amd64 only, so arm64 is cross-built here:
          # zig is the C toolchain ring needs. darwin waits for a macOS runner.
          - target: linux-arm64
            triple: aarch64-unknown-linux-gnu
            zig: true
    runs-on: linux-amd64
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.triple }}

      - name: Build
        working-directory: rust
        run: |
          set -eu
          rustup target add "${{ matrix.triple }}" 2>/dev/null || true
          if [ "${{ matrix.zig || false }}" = true ]; then
            python3 -m venv "$RUNNER_TEMP/zig"
            "$RUNNER_TEMP/zig/bin/pip" install --quiet ziglang cargo-zigbuild
            export PATH="$RUNNER_TEMP/zig/bin:$PATH"
            cargo zigbuild --release --locked --bin hanzo-mcp --target "${{ matrix.triple }}"
          else
            cargo build --release --locked --bin hanzo-mcp --target "${{ matrix.triple }}"
          fi

      # The name the installer asks for, and the checksum it refuses to install
      # without. Both are part of the contract in hanzo.sh, not decoration.
      - name: Package
        run: |
          set -eu
          asset="hanzo-mcp-${{ matrix.target }}.tar.gz"
          tar -C "rust/target/${{ matrix.triple }}/release" -czf "$asset" hanzo-mcp
          if command -v sha256sum >/dev/null 2>&1; then
            # "<hash>  <name>", the line `sha256sum -c` reads: install.sh verifies
            # the download with exactly that, and a bare hash fails it.
            sha256sum "$asset" > "$asset.sha256"
          else
            shasum -a 256 "$asset" > "$asset.sha256"
          fi
          ls -l "$asset" "$asset.sha256"

      - name: Attach
        uses: softprops/action-gh-release@v2
        with:
          files: |
            hanzo-mcp-${{ matrix.target }}.tar.gz
            hanzo-mcp-${{ matrix.target }}.tar.gz.sha256