tailwindcss/.github/workflows/release.yml

name: Release

on:
  push:
    branches: [main]
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      channel:
        description: Release channel to publish
        required: true
        default: insiders
        type: choice
        options:
          - insiders
          - release

permissions:
  contents: read

env:
  APP_NAME: tailwindcss-oxide
  NODE_VERSION: 24
  PNPM_VERSION: '11.9.0'
  OXIDE_LOCATION: ./crates/node

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    strategy:
      matrix:
        include:
          # Windows
          - os: windows-latest
            target: x86_64-pc-windows-msvc
          - os: windows-latest
            target: aarch64-pc-windows-msvc
          # macOS
          - os: macos-latest
            target: x86_64-apple-darwin
            strip: strip -x # Must use -x on macOS. This produces larger results on linux.
          - os: macos-latest
            target: aarch64-apple-darwin
            page-size: 14
            strip: strip -x # Must use -x on macOS. This produces larger results on linux.
          # Android
          - os: ubuntu-latest
            target: aarch64-linux-android
            strip: ${ANDROID_NDK_LATEST_HOME}/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip
          - os: ubuntu-latest
            target: armv7-linux-androideabi
            strip: ${ANDROID_NDK_LATEST_HOME}/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip
          # Linux
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            strip: strip
            build-flags: --use-napi-cross
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            strip: aarch64-linux-gnu-strip
            build-flags: --use-napi-cross
          - os: ubuntu-latest
            target: armv7-unknown-linux-gnueabihf
            strip: arm-linux-gnueabihf-strip
            build-flags: --use-napi-cross
          - os: ubuntu-latest
            target: aarch64-unknown-linux-musl
            strip-zig: true
            build-flags: -x
          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            strip: strip
            build-flags: -x

    name: Build ${{ matrix.target }} (oxide)
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Use Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          package-manager-cache: false

      - name: Install gcc-arm-linux-gnueabihf
        if: ${{ matrix.target == 'armv7-unknown-linux-gnueabihf' }}
        run: |
          sudo apt-get update
          sudo apt-get install gcc-arm-linux-gnueabihf g++-arm-linux-gnueabihf -y

      - name: Install binutils-aarch64-linux-gnu
        if: ${{ matrix.target == 'aarch64-unknown-linux-gnu' }}
        run: |
          sudo apt-get update
          sudo apt-get install binutils-aarch64-linux-gnu -y

      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
        if: ${{ contains(matrix.target, 'musl') }}
        with:
          version: 0.14.1
          use-cache: false

      - name: Install cargo-zigbuild
        uses: taiki-e/install-action@65851e10cd6c377f11a60e600abc07cb08643468 # v2
        if: ${{ contains(matrix.target, 'musl') }}
        env:
          GITHUB_TOKEN: ${{ github.token }}
        with:
          tool: cargo-zigbuild

      - name: Setup rust target
        run: rustup target add ${{ matrix.target }}

      - name: Install dependencies
        run: pnpm install --ignore-scripts --frozen-lockfile --filter=!./playgrounds/*

      - name: Build release
        run: pnpm run --filter ${{ env.OXIDE_LOCATION }} build:platform --target=${{ matrix.target }} ${{ matrix.build-flags }}
        env:
          RUST_TARGET: ${{ matrix.target }}
          JEMALLOC_SYS_WITH_LG_PAGE: ${{ matrix.page-size }}

      - name: Strip debug symbols # https://github.com/rust-lang/rust/issues/46034
        if: ${{ matrix.strip || matrix.strip-zig }}
        env:
          STRIP_COMMAND: ${{ matrix.strip }}
          STRIP_ZIG: ${{ matrix.strip-zig }}
        run: |
          if [ "$STRIP_ZIG" = "true" ]; then
            for file in ${{ env.OXIDE_LOCATION }}/*.node; do
              zig objcopy --strip-all "$file" "$file.stripped"
              mv "$file.stripped" "$file"
            done
            exit 0
          fi

          eval "$STRIP_COMMAND ${{ env.OXIDE_LOCATION }}/*.node"

      - name: Upload artifacts
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: bindings-${{ matrix.target }}
          path: ${{ env.OXIDE_LOCATION }}/*.node

  build-freebsd:
    name: Build x86_64-unknown-freebsd (OXIDE)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
      - name: Build FreeBSD
        uses: cross-platform-actions/action@cdc9ee69ef84a5f2e59c9058335d9c57bcb4ac86 # v0.25.0
        env:
          DEBUG: napi:*
          RUSTUP_HOME: /usr/local/rustup
          CARGO_HOME: /usr/local/cargo
          RUSTUP_IO_THREADS: 1
          RUST_TARGET: x86_64-unknown-freebsd
        with:
          operating_system: freebsd
          version: '14.0'
          memory: 13G
          cpu_count: 3
          environment_variables: 'DEBUG RUSTUP_IO_THREADS'
          shell: bash
          run: |
            sudo pkg install -y -f curl node libnghttp2 npm
            sudo npm install -g pnpm@${{ env.PNPM_VERSION }} --unsafe-perm=true
            curl -sSf https://static.rust-lang.org/rustup/archive/1.27.1/x86_64-unknown-freebsd/rustup-init --output rustup-init
            chmod +x rustup-init
            ./rustup-init -y --profile minimal
            source "$HOME/.cargo/env"
            echo "~~~~ rustc --version ~~~~"
            rustc --version
            echo "~~~~ node -v ~~~~"
            node -v
            echo "~~~~ pnpm --version ~~~~"
            pnpm --version
            pnpm install --ignore-scripts --frozen-lockfile --filter=!./playgrounds/* || true
            pnpm run --filter ${{ env.OXIDE_LOCATION }} build:platform
            strip -x ${{ env.OXIDE_LOCATION }}/*.node
            ls -la ${{ env.OXIDE_LOCATION }}
      - name: Upload artifacts
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: bindings-x86_64-unknown-freebsd
          path: ${{ env.OXIDE_LOCATION }}/*.node

  release:
    runs-on: macos-14
    timeout-minutes: 15
    name: Build and publish Tailwind CSS

    permissions:
      contents: read
      # https://docs.npmjs.com/generating-provenance-statements#publishing-packages-with-provenance-via-github-actions
      id-token: write

    needs:
      - build
      - build-freebsd

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 20
          persist-credentials: false

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Use Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          registry-url: 'https://registry.npmjs.org'
          package-manager-cache: false

      # npm trusted publishing validates the caller workflow filename, so all npm publishes live here.
      # This workflow rebuilds the publish artifacts instead of depending on prepare-release.yml.
      - name: Resolve release metadata
        env:
          INPUT_CHANNEL: ${{ github.event.inputs.channel || '' }}
        run: |
          if [[ "${{ github.event_name }}" == "release" || "$INPUT_CHANNEL" == "release" ]]; then
            release_channel=$(node ./scripts/release-channel.js)

            echo "RELEASE_KIND=release" >> $GITHUB_ENV
            echo "RELEASE_CHANNEL=$release_channel" >> $GITHUB_ENV
            echo "FEATURES_ENV=stable" >> $GITHUB_ENV
          else
            sha_short=$(git rev-parse --short HEAD)

            echo "RELEASE_KIND=insiders" >> $GITHUB_ENV
            echo "RELEASE_CHANNEL=insiders" >> $GITHUB_ENV
            echo "SHA_SHORT=$sha_short" >> $GITHUB_ENV
            echo "INSIDERS_VERSION=0.0.0-insiders.$sha_short" >> $GITHUB_ENV
          fi

      - name: Setup WASM target
        run: rustup target add wasm32-wasip1-threads

      - name: Install dependencies
        run: pnpm --filter=!./playgrounds/* install --frozen-lockfile

      - name: Download artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          path: ${{ env.OXIDE_LOCATION }}

      - name: Move artifacts
        run: |
          cd ${{ env.OXIDE_LOCATION }}
          cp bindings-x86_64-pc-windows-msvc/* ./npm/win32-x64-msvc/
          cp bindings-aarch64-pc-windows-msvc/* ./npm/win32-arm64-msvc/
          cp bindings-x86_64-apple-darwin/* ./npm/darwin-x64/
          cp bindings-aarch64-apple-darwin/* ./npm/darwin-arm64/
          cp bindings-aarch64-linux-android/* ./npm/android-arm64/
          cp bindings-armv7-linux-androideabi/* ./npm/android-arm-eabi/
          cp bindings-aarch64-unknown-linux-gnu/* ./npm/linux-arm64-gnu/
          cp bindings-aarch64-unknown-linux-musl/* ./npm/linux-arm64-musl/
          cp bindings-armv7-unknown-linux-gnueabihf/* ./npm/linux-arm-gnueabihf/
          cp bindings-x86_64-unknown-linux-gnu/* ./npm/linux-x64-gnu/
          cp bindings-x86_64-unknown-linux-musl/* ./npm/linux-x64-musl/
          cp bindings-x86_64-unknown-freebsd/* ./npm/freebsd-x64/

      - name: 'Version based on commit: ${{ env.INSIDERS_VERSION }}'
        if: env.RELEASE_KIND == 'insiders'
        run: pnpm run version-packages ${INSIDERS_VERSION}

      - name: Build Tailwind CSS
        if: env.RELEASE_KIND == 'insiders'
        run: pnpm run build

      - name: Build Tailwind CSS
        if: env.RELEASE_KIND == 'release'
        run: pnpm run build
        env:
          FEATURES_ENV: ${{ env.FEATURES_ENV }}

      - name: Run pre-publish optimizations scripts
        run: node ./scripts/pre-publish-optimizations.mjs

      - name: Lock pre-release versions
        run: node ./scripts/lock-pre-release-versions.mjs

      - name: Upload npm package tarballs
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: npm-package-tarballs
          path: dist/*.tgz

      - name: Publish
        run: |
          pnpm --recursive --filter="!@tailwindcss/oxide-wasm32-wasi" publish --tag ${RELEASE_CHANNEL} --no-git-checks
          # The wasm package needs a special npm config that isn't read when pnpm --recursive is used
          pushd crates/node/npm/wasm32-wasi; pnpm publish --tag ${RELEASE_CHANNEL} --no-git-checks --config.node-linker=hoisted; popd;

      - name: Trigger Tailwind Play update
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        with:
          github-token: ${{ secrets.TAILWIND_PLAY_TOKEN }}
          script: |
            await github.rest.actions.createWorkflowDispatch({
              owner: 'tailwindlabs',
              repo: 'upgrades',
              ref: 'main',
              workflow_id: 'upgrade-tailwindcss.yml'
            })

  notify:
    if: ${{ always() && (needs.build.result == 'failure' || needs.build-freebsd.result == 'failure' || needs.release.result == 'failure') }}
    needs:
      - build
      - build-freebsd
      - release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Resolve release label
        id: release
        env:
          INPUT_CHANNEL: ${{ github.event.inputs.channel || '' }}
          RELEASE_TAG: ${{ github.event.release.tag_name || '' }}
        run: |
          if [[ "${{ github.event_name }}" == "release" ]]; then
            tag_name="${RELEASE_TAG:-${GITHUB_REF_NAME}}"
            echo "label=release ${tag_name}" >> $GITHUB_OUTPUT
          elif [[ "$INPUT_CHANNEL" == "release" ]]; then
            version=$(node -p "require('./packages/tailwindcss/package.json').version")
            echo "label=release v${version}" >> $GITHUB_OUTPUT
          else
            sha_short=$(git rev-parse --short HEAD)
            echo "label=insiders release 0.0.0-insiders.${sha_short}" >> $GITHUB_OUTPUT
          fi

      - name: Notify Discord
        uses: discord-actions/message@5c7149c81a83146e5d01f142be1bf87a61831c4d # v2
        with:
          webhookUrl: ${{ secrets.DISCORD_WEBHOOK_URL }}
          message: 'The [most recent ${{ github.workflow }} workflow](<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}>) for `${{ steps.release.outputs.label }}` has failed.'