name: Release builds

# Builds self-contained NeuroSploit binaries for every OS/arch and uploads them
# to the matching GitHub Release. Fires automatically on a pushed `v*` tag, or
# manually via "Run workflow" (provide the tag).

on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag to build & attach (e.g. v3.5.2)"
        required: true

permissions:
  contents: write

jobs:
  build:
    name: ${{ matrix.label }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-22.04,      label: linux-x64,    ext: tar.gz, target: "" }
          - { os: ubuntu-24.04-arm,  label: linux-arm64,  ext: tar.gz, target: "" }
          # macOS x64 is cross-built on an Apple-Silicon runner (no scarce Intel runner).
          - { os: macos-14,          label: macos-x64,    ext: tar.gz, target: x86_64-apple-darwin }
          - { os: macos-14,          label: macos-arm64,  ext: tar.gz, target: "" }
          - { os: windows-latest,    label: windows-x64,  ext: zip,    target: "" }
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            neurosploit-rs/target
          key: ${{ matrix.label }}-cargo-${{ hashFiles('neurosploit-rs/Cargo.lock') }}

      - name: Build (release)
        working-directory: neurosploit-rs
        shell: bash
        run: |
          if [ -n "${{ matrix.target }}" ]; then
            cargo build --release --target "${{ matrix.target }}"
          else
            cargo build --release
          fi

      - name: Resolve tag
        id: tag
        shell: bash
        run: echo "tag=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_OUTPUT"

      - name: Package
        shell: bash
        run: |
          set -e
          TAG="${{ steps.tag.outputs.tag }}"
          NAME="neurosploit-${TAG}-${{ matrix.label }}"
          mkdir -p "dist/$NAME"
          cp -R agents_md "dist/$NAME/"
          cat > "dist/$NAME/README.txt" <<EOF
          NeuroSploit ${TAG} — ${{ matrix.label }}
          Run from inside this folder so it finds agents_md/, e.g.:
            ./neurosploit --version
            ./neurosploit run http://testphp.vulnweb.com/ --model anthropic:claude-opus-4-8 -v
          Or set NEUROSPLOIT_BASE to this folder and run neurosploit from anywhere.
          EOF
          BINDIR="neurosploit-rs/target/release"
          if [ -n "${{ matrix.target }}" ]; then BINDIR="neurosploit-rs/target/${{ matrix.target }}/release"; fi
          if [ "${{ runner.os }}" = "Windows" ]; then
            cp "$BINDIR/neurosploit.exe" "dist/$NAME/"
            (cd dist && 7z a "${NAME}.zip" "$NAME" >/dev/null)
          else
            cp "$BINDIR/neurosploit" "dist/$NAME/"
            (cd dist && tar -czf "${NAME}.tar.gz" "$NAME")
          fi

      - name: Upload to release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          TAG="${{ steps.tag.outputs.tag }}"
          gh release upload "$TAG" dist/neurosploit-*.${{ matrix.ext }} --clobber