ci.yml

name: CI
on:
  push:
    branches: [ main ]
    # Source commits keep public history. Release tags separately trigger
    # the versioned SDK build and release workflow.
    tags: [ 'v*' ]
  pull_request: {}
  workflow_dispatch: {}
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        # Use the SDK module's exact toolchain directive for reproducible builds.
        with: { go-version-file: 'bind/clash/go.mod' }
      - run: go build ./...
      - run: go vet ./...
      # vet, not just build: `go build` skips _test.go, so this module's tests can stop
      # compiling with nothing anywhere saying so. They did, and the export could not see
      # it either until the same line was added there.
      - run: cd bind/clash && go build ./... && go vet ./...

  # The artifact this repository exists to produce. Runs on push rather than on
  # every pull request: it is a five-slice gomobile build on a macOS runner, and
  # the Linux job above already catches anything that stops compiling.
  xcframework:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v7
        with:
          # Tags, not just the tip. build_libbox derives the core version from
          # `git describe --tags --match 'v*'`, and checkout's default shallow
          # fetch brings none -- without this the build dies as
          # `git describe: exit status 128` before compiling anything.
          fetch-depth: 0
      - uses: actions/setup-go@v7
        with: { go-version-file: 'bind/clash/go.mod' }
      - name: Make a core version available
        # Incremental source commits retain reachable release tags. The old
        # baseline may have no tag, so an unversioned development build still
        # uses a placeholder; only tag-triggered builds become releases.
        run: |
          if described=$(git describe --tags --abbrev=0 --match 'v*' 2>/dev/null); then
            echo "core version derives from ${described}"
          else
            git tag v0.0.0-clash.0
            echo "No v* tag is reachable from this baseline."
            echo "Stamping v0.0.0-clash.0 for this development build; released"
            echo "artifacts are built from tag pushes and carry a real version."
          fi
      - name: Install the pinned gomobile fork
        # The fork, at the pinned version: upstream gomobile does not build the
        # Apple slice set this artifact ships.
        run: |
          go install github.com/sagernet/gomobile/cmd/gomobile@v0.1.13
          go install github.com/sagernet/gomobile/cmd/gobind@v0.1.13
      - name: Build Clash.xcframework
        run: go run ./cmd/build_libbox -target apple
      - name: Every Apple slice is present
        # gomobile will happily emit a partial xcframework; an artifact missing
        # the simulator slice cannot be built against in Xcode and nothing else
        # here would notice.
        run: |
          for slice in ios-arm64 ios-arm64_x86_64-simulator macos-arm64_x86_64 \
                       tvos-arm64 tvos-arm64_x86_64-simulator; do
            test -d "Clash.xcframework/$slice" || { echo "missing slice: $slice"; exit 1; }
          done
          ls Clash.xcframework
      - name: Package SDK licenses and corresponding source
        run: |
          go run ./cmd/package_licenses -output dist/licenses
          python3 scripts/package_sdk.py --inventory dist/licenses --output dist/sdk
      - uses: actions/upload-artifact@v7
        with:
          name: SDK-Release
          path: |
            dist/sdk/*.zip
            dist/sdk/*.tar.gz
            dist/sdk/SOURCES.json
            dist/sdk/SHA256SUMS
          retention-days: 14
      - uses: actions/upload-artifact@v7
        with:
          name: Clash.xcframework
          path: Clash.xcframework
          # ~450 MB per build, kept briefly: this copy exists so a branch build
          # can be inspected. The durable download is the Release asset below,
          # attached to the tag it was cut from.
          retention-days: 14

  # The Releases page was empty because a tag is not a release: pushing the ref
  # creates neither notes nor a download. Publishing by hand means the artifact
  # people download is whichever build the publisher happened to have, so this
  # attaches the one built above from the tagged commit by this workflow.
  release:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [build, xcframework]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
      - uses: actions/download-artifact@v8
        with:
          name: SDK-Release
          path: dist/sdk
      - name: Verify packaged assets
        working-directory: dist/sdk
        run: sha256sum -c SHA256SUMS
      - name: Write the release notes
        # A file rather than --notes with an inline heredoc: a heredoc nested in
        # command substitution is re-parsed by the shell, and an apostrophe in the
        # prose ("repository's") was enough to make it die on an unterminated
        # quote. Flat printf lines have nothing to re-parse.
        run: |
          core="${GITHUB_REF_NAME#v}"
          core="${core%%-clash.*}"
          {
            printf 'Kernel and gomobile SDK snapshot, upstream core `%s`.\n\n' "$core"
            printf '`Clash.xcframework.zip` is built by this workflow from the tagged\n'
            printf 'commit, and carries all five Apple slices: iOS device and simulator,\n'
            printf 'macOS, tvOS device and simulator.\n\n'
            printf 'Public source changes are retained as incremental commits.\n'
            printf 'Compare release tags to inspect the changes between versions.\n'
            printf '\nThe SDK archive includes LICENSE, NOTICE and dependency licenses.\n'
            printf 'THIRD_PARTY_LICENSES.zip provides the notices separately.\n'
            printf 'SOURCES.json records the exact kernel and dependency sources; the\n'
            printf 'EasyTier source archive includes the embedded core and build scripts.\n'
            printf 'EasyTier-dependencies.zip preserves its pinned Cargo dependency sources;\n'
            printf 'the license bundle includes their notices and exact source inventory.\n'
            printf 'Verify downloads with SHA256SUMS.\n'
          } > notes.md
          cat notes.md
      - name: Publish
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "$GITHUB_REF_NAME" dist/sdk/*.zip dist/sdk/*.tar.gz \
            dist/sdk/SOURCES.json dist/sdk/SHA256SUMS \
            --title "Clash ${GITHUB_REF_NAME}" \
            --notes-file notes.md