chore: improve release pipeline (#451)

* chore: improve release pipeline

* fix pipelines

* fix sccache

* update workflows

* fix workflow

* update workflow

* remove sccache and cross

* bring back sccache

* fix pipelines

* fix nodejs build

* fix pipelines

* move python to abi3 for future proofing

* fix workflow ordering bug

* gate releases via environment - configure go via release

* set release as 1.0.0-beta

.github/actions/setup-rust/action.yml

@@ -0,0 +1,84 @@
+name: 'Setup Rust caching'
+description: 'Swatinem/rust-cache + sccache.'
+
+inputs:
+  shared-key:
+    description: 'Swatinem/rust-cache shared-key.'
+    required: false
+    default: ''
+  key:
+    description: 'Swatinem/rust-cache key.'
+    required: false
+    default: ''
+  workspaces:
+    description: 'Swatinem/rust-cache workspaces.'
+    required: false
+    default: '. -> target'
+  sccache:
+    description: 'Enable sccache as RUSTC_WRAPPER.'
+    required: false
+    default: 'true'
+  zig:
+    description: 'Install ziglang + cargo-zigbuild.'
+    required: false
+    default: 'false'
+  zig-version:
+    description: 'Zig version for mlugg/setup-zig.'
+    required: false
+    default: '0.16.0'
+  glibc-version:
+    description: 'Target glibc for cargo-zigbuild, exported as GLIBC_VERSION.'
+    required: false
+    default: '2.17'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Exclude workspace from Windows Defender
+      if: ${{ runner.os == 'Windows' }}
+      shell: pwsh
+      run: Add-MpPreference -ExclusionPath "${{ github.workspace }}"
+
+    - name: Fast profile on PRs (no LTO)
+      if: ${{ github.event_name == 'pull_request' }}
+      shell: bash
+      run: |
+        echo "CARGO_PROFILE_RELEASE_LTO=false" >> "$GITHUB_ENV"
+        echo "CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16" >> "$GITHUB_ENV"
+
+    - name: Install sccache
+      if: ${{ inputs.sccache == 'true' }}
+      uses: mozilla-actions/sccache-action@v0.0.10
+
+    - name: Enable sccache
+      if: ${{ inputs.sccache == 'true' }}
+      shell: bash
+      run: |
+        echo "SCCACHE_GHA_ENABLED=true" >> "$GITHUB_ENV"
+        echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+
+    - name: Rust cache
+      uses: Swatinem/rust-cache@v2
+      with:
+        shared-key: ${{ inputs.shared-key }}
+        key: ${{ inputs.key }}
+        workspaces: ${{ inputs.workspaces }}
+
+    - name: Install zig
+      if: ${{ inputs.zig == 'true' }}
+      uses: mlugg/setup-zig@v2
+      with:
+        version: ${{ inputs.zig-version }}
+
+    - name: Install cargo-zigbuild
+      if: ${{ inputs.zig == 'true' }}
+      uses: taiki-e/install-action@v2
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      with:
+        tool: cargo-zigbuild
+
+    - name: Export target glibc version
+      if: ${{ inputs.zig == 'true' }}
+      shell: bash
+      run: echo "GLIBC_VERSION=${{ inputs.glibc-version }}" >> "$GITHUB_ENV"

.github/workflows/cargo-version-action-test.yaml

@@ -1,41 +0,0 @@
-name: "Release: Core"
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Version'
-        required: true
-        default: 'patch'
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-
-jobs:
-  cargo_version_test:
-    runs-on: ubuntu-latest
-    name: A job to test cargo version action
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          persist-credentials: false
-
-      - name: Set Git author
-        run: |
-          git config user.name "Bot"
-          git config user.email "bot@gorules.io"
-
-      - name: Cargo version
-        uses: ./actions/cargo-version-action
-        id: semver
-        with:
-          version: ${{ github.event.inputs.version }}
-          tag-prefix: core-v
-
-      - name: Push changes
-        uses: ad-m/github-push-action@v0.6.0
-        with:
-          github_token: ${{ secrets.PAT }}

.github/workflows/go.yaml

@@ -4,7 +4,24 @@ env:
   MACOSX_DEPLOYMENT_TARGET: '10.13'
 
 on:
-  workflow_dispatch:
+  push:
+    branches:
+      - master
+    tags-ignore:
+      - '**'
+    paths:
+      - 'bindings/c/**'
+      - 'core/**'
+      - 'test-data/**'
+      - '.github/workflows/go.yaml'
+  pull_request:
+    paths:
+      - 'bindings/c/**'
+      - 'core/**'
+      - 'test-data/**'
+      - '.github/workflows/go.yaml'
+  release:
+    types: [published]
 
 permissions: write-all
 
@@ -39,9 +56,19 @@ jobs:
           toolchain: stable
           override: true
           target: ${{ matrix.settings.target }}
-      - uses: marcopolo/cargo@master
+      - uses: ./.github/actions/setup-rust
+        with:
+          shared-key: go-${{ matrix.settings.target }}
+          zig: ${{ matrix.settings.host == 'ubuntu-latest' }}
+
+      - name: Build (zig, linux)
+        if: ${{ matrix.settings.host == 'ubuntu-latest' }}
+        working-directory: bindings/c
+        run: cargo zigbuild --release --all-features --target ${{ matrix.settings.target }}.${{ env.GLIBC_VERSION }} --locked
+      - name: Build (native)
+        if: ${{ matrix.settings.host != 'ubuntu-latest' }}
+        uses: marcopolo/cargo@master
         with:
-          use-cross: true
           working-directory: bindings/c
           args: --release --all-features --target=${{ matrix.settings.target }} --locked
           command: build
@@ -84,6 +111,8 @@ jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
+    environment: release
+    if: "github.event_name == 'release' && startsWith(github.event.release.tag_name, 'go-v')"
     needs:
       - build
       - copy-common

.github/workflows/miri.yaml

@@ -0,0 +1,28 @@
+name: Miri
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  RUST_BACKTRACE: 1
+  RUSTUP_MAX_RETRIES: 10
+
+jobs:
+  miri:
+    name: cargo miri test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Install Rust
+        run: rustup toolchain install nightly --component miri && rustup default nightly
+      - uses: ./.github/actions/setup-rust
+        with:
+          shared-key: rust-miri
+          sccache: 'false'
+      - run: cargo miri test --workspace --all-features
+        env:
+          MIRIFLAGS: -Zmiri-strict-provenance -Zmiri-symbolic-alignment-check -Zmiri-disable-isolation
+          RUSTFLAGS: ${{ env.RUSTFLAGS }} -Z randomize-layout

.github/workflows/node-version-bump.yaml

@@ -1,60 +0,0 @@
-name: "Release: NodeJS"
-
-env:
-  WORKING_DIRECTORY: bindings/nodejs
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Version'
-        required: true
-        default: 'patch'
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-
-permissions:
-  contents: write
-
-jobs:
-  publish:
-    name: Version
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: ${{ env.WORKING_DIRECTORY }}
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          persist-credentials: false
-
-      - name: Set Git author
-        run: |
-          git config user.name "Bot"
-          git config user.email "bot@gorules.io"
-
-      - name: Setup node
-        uses: actions/setup-node@v3
-        with:
-          node-version: 22
-          check-latest: true
-          cache: yarn
-          cache-dependency-path: 'bindings/nodejs/yarn.lock'
-
-      - name: 'Install dependencies'
-        run: yarn install --immutable --mode=skip-build
-
-      - name: Lerna version
-        run: yarn lerna version ${{ github.event.inputs.version }} --tag-version-prefix="nodejs-" --no-push --yes
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Push changes
-        uses: ad-m/github-push-action@v0.6.0
-        with:
-          github_token: ${{ secrets.PAT}}

.github/workflows/node.yaml

@@ -24,14 +24,18 @@ on:
       - 'core/**'
       - 'test-data/**'
       - '.github/workflows/node.yaml'
+  # Stable publish is driven by the GitHub Release that release-please creates
+  # for the `nodejs` component (tag `nodejs-v<version>`).
+  release:
+    types: [ published ]
 
 permissions:
   contents: write
 
 jobs:
   build:
-    if: "!contains(github.event.head_commit.message, 'skip ci')"
-
+    # On release events, only build for this component's tag.
+    if: "(github.event_name != 'release' || startsWith(github.event.release.tag_name, 'nodejs-v')) && !contains(github.event.head_commit.message, 'skip ci')"
     strategy:
       fail-fast: false
       matrix:
@@ -59,56 +63,45 @@ jobs:
               yarn build --target aarch64-apple-darwin
               strip -x ./*.node
 
-          - host: ubuntu-22.04
+          - host: ubuntu-latest
             target: 'x86_64-unknown-linux-gnu'
+            zig: true
             build: |
               set -e
-              rustup install 1.88.0
-              rustup default 1.88.0
               rustup target add x86_64-unknown-linux-gnu
-              yarn build --target x86_64-unknown-linux-gnu
-              strip ./*.node
+              mkdir -p ../../target
+              ln -sfn x86_64-unknown-linux-gnu ../../target/x86_64-unknown-linux-gnu.$GLIBC_VERSION
+              yarn build --target x86_64-unknown-linux-gnu.$GLIBC_VERSION --cross-compile
+              mv -f zen-engine.linux-x64-gnu.$GLIBC_VERSION.node zen-engine.linux-x64-gnu.node
+              strip zen-engine.linux-x64-gnu.node
 
-          - host: ubuntu-22.04-arm
+          - host: ubuntu-latest
             target: 'aarch64-unknown-linux-gnu'
+            zig: true
             build: |
               set -e
-              rustup install 1.88.0
-              rustup default 1.88.0
               rustup target add aarch64-unknown-linux-gnu
-              yarn build --target aarch64-unknown-linux-gnu
-              strip ./*.node
+              mkdir -p ../../target
+              ln -sfn aarch64-unknown-linux-gnu ../../target/aarch64-unknown-linux-gnu.$GLIBC_VERSION
+              yarn build --target aarch64-unknown-linux-gnu.$GLIBC_VERSION --cross-compile
+              mv -f zen-engine.linux-arm64-gnu.$GLIBC_VERSION.node zen-engine.linux-arm64-gnu.node
 
           - host: ubuntu-latest
             target: 'x86_64-unknown-linux-musl'
-            docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-alpine
+            zig: true
             build: |
               set -e
-              apk add --no-cache gcc musl-dev libgcc linux-headers
-              cd bindings/nodejs
-              export CC_x86_64_unknown_linux_musl=gcc
-              export CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER=gcc
-              rustup install 1.88.0
-              rustup default 1.88.0
               rustup target add x86_64-unknown-linux-musl
-              yarn build --target x86_64-unknown-linux-musl
+              yarn build --target x86_64-unknown-linux-musl --cross-compile
               strip ./*.node
 
           - host: ubuntu-latest
             target: 'aarch64-unknown-linux-musl'
-            docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-alpine
+            zig: true
             build: |
               set -e
-              apk add --no-cache gcc musl-dev libgcc linux-headers
-              cd bindings/nodejs
-              # Set environment variables for the Rust toolchain
-              export CC_aarch64_unknown_linux_musl=aarch64-linux-musl-gcc
-              export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-musl-gcc
-              rustup install 1.88.0
-              rustup default 1.88.0
               rustup target add aarch64-unknown-linux-musl
-              yarn build --target aarch64-unknown-linux-musl
-              /aarch64-linux-musl-cross/bin/aarch64-linux-musl-strip *.node
+              yarn build --target aarch64-unknown-linux-musl --cross-compile
 
           - host: ubuntu-latest
             target: 'wasm32-wasip1-threads'
@@ -117,9 +110,6 @@ jobs:
               tar -xvf wasi-sdk-27.0-x86_64-linux.tar.gz
             build: |
               set -e
-              rustup install 1.88.0
-              rustup default 1.88.0
-              rustup target add wasm32-wasip1-threads
               export WASI_SDK_PATH="$(pwd)/wasi-sdk-27.0-x86_64-linux"
               export CMAKE_BUILD_PARALLEL_LEVEL=2
               export TARGET_CXXFLAGS="--target=wasm32-wasi-threads --sysroot=$(pwd)/wasi-sdk-27.0-x86_64-linux/share/wasi-sysroot -pthread -mllvm -wasm-enable-sjlj -lsetjmp"
@@ -137,7 +127,6 @@ jobs:
 
       - name: Setup node
         uses: actions/setup-node@v3
-        if: ${{ !matrix.settings.docker }}
         with:
           node-version: 22
           check-latest: true
@@ -146,20 +135,16 @@ jobs:
 
       - name: Install
         uses: dtolnay/rust-toolchain@stable
-        if: ${{ !matrix.settings.docker }}
         with:
           toolchain: stable
           targets: ${{ matrix.settings.target }}
 
-      - name: Cache cargo registry
-        uses: actions/cache@v3
+      - name: Rust cache + sccache (+ zig for linux legs)
+        uses: ./.github/actions/setup-rust
         with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-            .cargo-cache
-          key: ${{ matrix.settings.host }}-${{ matrix.settings.target }}-cargo-registry-v2
+          shared-key: nodejs-${{ matrix.settings.target }}
+          key: ${{ matrix.settings.target }}
+          zig: ${{ matrix.settings.zig }}
 
       - name: Setup toolchain
         run: ${{ matrix.settings.setup }}
@@ -169,22 +154,13 @@ jobs:
       - name: 'Install dependencies'
         run: yarn install --immutable --mode=skip-build
 
-      - name: Build in docker
-        uses: stefan-gorules/docker-run-action@v1
-        if: ${{ matrix.settings.docker }}
-        with:
-          image: ${{ matrix.settings.docker }}
-          options: --user 0:0 -v ${{ github.workspace }}/.cargo-cache/.cargo/git:/usr/local/cargo/git -v ${{ github.workspace }}/.cargo-cache/.cargo/registry:/usr/local/cargo/registry -v ${{ github.workspace }}:/build -w /build
-          run: ${{ matrix.settings.build }}
-
       - name: 'Build'
         run: ${{ matrix.settings.build }}
-        if: ${{ !matrix.settings.docker }}
         shell: bash
 
       - name: 'Check'
-        if: ${{ matrix.settings.target != 'x86_64-pc-windows-msvc' }}
         run: ls -la
+        shell: bash
 
       - name: Upload artifact ${{ matrix.settings.target }}
         if: ${{ matrix.settings.target != 'wasm32-wasip1-threads' }}
@@ -205,8 +181,8 @@ jobs:
             bindings/nodejs/zen-engine.wasi*
             bindings/nodejs/wasi-worker*
 
-  test-macOS-windows-binding:
-    name: Test bindings on ${{ matrix.settings.target }} - node@${{ matrix.node }}
+  test:
+    name: Test ${{ matrix.settings.target }} - node@${{ matrix.node }}
     needs:
       - build
     defaults:
@@ -215,14 +191,26 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        node: [ '20', '22' ]
         settings:
+          # Native runners
           - host: macos-15-intel
             target: 'x86_64-apple-darwin'
           - host: macos-latest
             target: 'aarch64-apple-darwin'
           - host: windows-latest
             target: 'x86_64-pc-windows-msvc'
-        node: [ '20', '22' ]
+          # Linux: run inside the matching libc container; arm adds QEMU
+          - host: ubuntu-latest
+            target: 'x86_64-unknown-linux-gnu'
+            image: 'node:{0}-slim'
+          - host: ubuntu-latest
+            target: 'x86_64-unknown-linux-musl'
+            image: 'node:{0}-alpine'
+          - host: ubuntu-latest
+            target: 'aarch64-unknown-linux-musl'
+            image: 'node:{0}-alpine'
+            arm: true
     runs-on: ${{ matrix.settings.host }}
 
     steps:
@@ -238,7 +226,22 @@ jobs:
           cache: yarn
           cache-dependency-path: 'bindings/nodejs/yarn.lock'
 
+      - name: Set up QEMU
+        if: ${{ matrix.settings.arm }}
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: arm64
+      - if: ${{ matrix.settings.arm }}
+        run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
+
+      - name: Install dependencies (arm64/musl)
+        if: ${{ matrix.settings.arm }}
+        run: |
+          yarn config set supportedArchitectures.cpu "arm64"
+          yarn config set supportedArchitectures.libc "musl"
+          yarn install --immutable --mode=skip-build
       - name: Install dependencies
+        if: ${{ !matrix.settings.arm }}
         run: yarn install --immutable --mode=skip-build
 
       - name: Download artifacts
@@ -255,254 +258,35 @@ jobs:
         run: yarn artifacts
         shell: bash
 
-      - name: Test bindings
+      - name: Test bindings (native)
+        if: ${{ !matrix.settings.image }}
         run: |
           yarn install
           yarn link
           yarn test
-  test-linux-x64-gnu-binding:
-    name: Test bindings on Linux-x64-gnu - node@${{ matrix.node }}
-    needs:
-      - build
-    defaults:
-      run:
-        working-directory: ${{ env.WORKING_DIRECTORY }}
-    strategy:
-      fail-fast: false
-      matrix:
-        node: [ '20', '22' ]
-    runs-on: ubuntu-latest
 
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Setup node
-        uses: actions/setup-node@v3
-        with:
-          node-version: ${{ matrix.node }}
-          check-latest: true
-          cache: yarn
-          cache-dependency-path: 'bindings/nodejs/yarn.lock'
-
-      - name: Install dependencies
-        run: yarn install --immutable --mode=skip-build
-
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: bindings-x86_64-unknown-linux-gnu
-          path: artifacts
-
-      - name: List artifacts
-        run: |
-          ls -la ../../artifacts
-        shell: bash
-
-      - name: Create dirs
-        run: yarn createNpmDirs
-        shell: bash
-
-      - name: Move artifacts
-        run: yarn artifacts
-        shell: bash
-
-      - name: List folder
-        run: ls ./
-        shell: bash
-
-      - name: Test bindings
+      - name: Test bindings (docker)
+        if: ${{ matrix.settings.image }}
         uses: stefan-gorules/docker-run-action@v1
         with:
-          image: node:${{ matrix.node }}-slim
-          options: -v ${{ github.workspace }}:/workspace
+          image: ${{ format(matrix.settings.image, matrix.node) }}
+          options: ${{ matrix.settings.arm && format('--platform linux/arm64 -v {0}:/workspace', github.workspace) || format('-v {0}:/workspace', github.workspace) }}
           run: |
             cd workspace/bindings/nodejs
             yarn install
             yarn link
             yarn test
-  test-linux-x64-musl-binding:
-    name: Test bindings on Linux-x64-musl - node@${{ matrix.node }}
-    needs:
-      - build
-    defaults:
-      run:
-        working-directory: ${{ env.WORKING_DIRECTORY }}
-    strategy:
-      fail-fast: false
-      matrix:
-        node: [ '20', '22' ]
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Setup node
-        uses: actions/setup-node@v3
-        with:
-          node-version: ${{ matrix.node }}
-          check-latest: true
-          cache: yarn
-          cache-dependency-path: 'bindings/nodejs/yarn.lock'
-
-      - name: Install dependencies
-        run: yarn install --immutable --mode=skip-build
-
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: bindings-x86_64-unknown-linux-musl
-          path: artifacts
-
-      - name: Create dirs
-        run: yarn createNpmDirs
-        shell: bash
-
-      - name: Move artifacts
-        run: yarn artifacts
-        shell: bash
-
-      - name: List folder
-        run: ls ./
-        shell: bash
-
-      - name: Test bindings
-        uses: stefan-gorules/docker-run-action@v1
-        with:
-          image: node:${{ matrix.node }}-alpine
-          options: -v ${{ github.workspace }}:/workspace
-          run: |
-            cd workspace/bindings/nodejs
-            yarn install
-            yarn link
-            yarn test
-  test-linux-aarch64-musl-binding:
-    name: Test bindings on Linux-aarch64-musl - node@${{ matrix.node }}
-    needs:
-      - build
-    defaults:
-      run:
-        working-directory: ${{ env.WORKING_DIRECTORY }}
-    strategy:
-      fail-fast: false
-      matrix:
-        node: [ '20', '22' ]
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v3
-      - name: Setup node
-        uses: actions/setup-node@v3
-        with:
-          node-version: ${{ matrix.node }}
-          check-latest: true
-          cache: yarn
-          cache-dependency-path: 'bindings/nodejs/yarn.lock'
-
-      - name: Install dependencies
-        run: |
-          yarn config set supportedArchitectures.cpu "arm64"
-          yarn config set supportedArchitectures.libc "musl"
-          yarn install --immutable --mode=skip-build
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-        with:
-          platforms: arm64
-      - run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
-
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: bindings-aarch64-unknown-linux-musl
-          path: artifacts
-
-      - name: Create dirs
-        run: yarn createNpmDirs
-        shell: bash
-
-      - name: Move artifacts
-        run: yarn artifacts
-        shell: bash
-
-      - name: List folder
-        run: ls ./
-        shell: bash
-
-      - name: Test bindings
-        uses: stefan-gorules/docker-run-action@v1
-        with:
-          options: --platform linux/arm64 -v ${{ github.workspace }}:/workspace
-          image: node:${{ matrix.node }}-alpine
-          run: |
-            cd workspace/bindings/nodejs
-            yarn install
-            yarn link
-            yarn test
-  #  test-linux-aarch64-gnu-binding:
-  #    name: Test bindings on aarch64-unknown-linux-gnu - node@${{ matrix.node }}
-  #    needs:
-  #      - build
-  #    defaults:
-  #      run:
-  #        working-directory: ${{ env.WORKING_DIRECTORY }}
-  #    strategy:
-  #      fail-fast: false
-  #      matrix:
-  #        node: ['14', '16', '18']
-  #    runs-on: ubuntu-latest
-  #
-  #    steps:
-  #      - uses: actions/checkout@v3
-  #      - run: docker run --rm --privileged multiarch/qemu-user-static:register --reset
-  #      - name: List directory
-  #        run: |
-  #          ls -la &&
-  #          pwd
-  #
-  #      - name: Download artifacts
-  #        uses: actions/download-artifact@v4
-  #        with:
-  #          name: bindings-aarch64-unknown-linux-gnu
-  #          path: artifacts
-  #
-  #      - name: Install dependencies
-  #        run: |
-  #          yarn config set supportedArchitectures.cpu "arm64"
-  #          yarn config set supportedArchitectures.libc "glibc"
-  #          yarn install --immutable --mode=skip-build
-  #      - name: Move artifacts
-  #        run: yarn artifacts
-  #        shell: bash
-  #
-  #      - name: List folder
-  #        run: ls ./
-  #        shell: bash
-  #
-  #      - name: Setup and run tests
-  #        uses: stefan-gorules/docker-run-action@v1
-  #        with:
-  #          image: ghcr.io/napi-rs/napi-rs/nodejs:aarch64-${{ matrix.node }}
-  #          options: -v ${{ github.workspace }}:/workspace -w /workspace
-  #          run: |
-  #            ls -la
-  #            cd bindings/nodejs
-  #            yarn install
-  #            yarn link
-  #            yarn test
-
   release:
     name: Release
     runs-on: ubuntu-latest
+    environment: release
+    # Publishes only on the release-please GitHub Release for the nodejs component.
+    if: "github.event_name == 'release' && startsWith(github.event.release.tag_name, 'nodejs-v')"
     defaults:
       run:
         working-directory: ${{ env.WORKING_DIRECTORY }}
     needs:
-      - test-linux-x64-gnu-binding
-      #      - test-linux-x64-centos-7
-      - test-linux-x64-musl-binding
-      #      - test-linux-aarch64-gnu-binding
-      #      - test-linux-arm-gnueabihf-binding
-      - test-macOS-windows-binding
-      - test-linux-aarch64-musl-binding
+      - test
     steps:
       - uses: actions/checkout@v3
 
@@ -543,8 +327,8 @@ jobs:
         shell: bash
 
       - name: Lerna publish
-        if: "startsWith(github.event.head_commit.message, 'chore(release): publish nodejs')"
-        run: yarn lerna publish from-package --no-verify-access --yes
+        # Prereleases (release-please beta window) go to the `next` dist-tag, not `latest`.
+        run: yarn lerna publish from-package --dist-tag ${{ github.event.release.prerelease && 'next' || 'latest' }} --no-verify-access --yes
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/python-version-bump.yaml

@@ -1,56 +0,0 @@
-name: "Release: Python"
-
-env:
-  WORKING_DIRECTORY: bindings/python
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Version'
-        required: true
-        default: 'patch'
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-
-permissions:
-  contents: write
-
-jobs:
-  publish:
-    name: Version
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: ${{ env.WORKING_DIRECTORY }}
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          persist-credentials: false
-
-      - name: Set Git author
-        run: |
-          git config user.name "Bot"
-          git config user.email "bot@gorules.io"
-
-      - uses: actions/setup-python@v4
-        with:
-          python-version: '3.10'
-
-      - name: 'Install dependencies'
-        run: pip install --upgrade bump2version
-
-      - name: Bumpversion
-        run: bumpversion ${{ github.event.inputs.version }} --allow-dirty --tag-name "python-v{new_version}"
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Push changes
-        uses: ad-m/github-push-action@v0.6.0
-        with:
-          github_token: ${{ secrets.PAT}}

.github/workflows/python.yaml

@@ -19,100 +19,71 @@ on:
       - 'core/**'
       - 'test-data/**'
       - '.github/workflows/python.yaml'
+  # Stable publish is driven by the GitHub Release that release-please creates
+  # for the `python` component (tag `python-v<version>`).
+  release:
+    types: [ published ]
 
 permissions:
   contents: read
 
 jobs:
-  linux:
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: ${{ env.WORKING_DIRECTORY }}
+  # The build jobs skip on release events for other components (release-please fires
+  # one `release` event per component; only `python-v*` should build/publish here).
+  wheels:
+    if: "github.event_name != 'release' || startsWith(github.event.release.tag_name, 'python-v')"
+    runs-on: ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
-        target: [ x86_64, aarch64 ]
+        include:
+          - os: ubuntu-latest
+            platform: linux
+            target: x86_64
+            args: --release --out dist --find-interpreter -m bindings/python/Cargo.toml --zig --compatibility manylinux_2_28
+            manylinux: auto
+          - os: ubuntu-latest
+            platform: linux
+            target: aarch64
+            args: --release --out dist --find-interpreter -m bindings/python/Cargo.toml --zig --compatibility manylinux_2_28
+            manylinux: auto
+          - os: windows-latest
+            platform: windows
+            target: x64
+            architecture: x64
+            args: --release --out dist --find-interpreter -m bindings/python/Cargo.toml
+          - os: macos-latest
+            platform: macos
+            target: x86_64
+            args: --release --out dist --find-interpreter -m bindings/python/Cargo.toml
+          - os: macos-latest
+            platform: macos
+            target: aarch64
+            args: --release --out dist --find-interpreter -m bindings/python/Cargo.toml
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-python@v4
         with:
           python-version: '3.13'
+          architecture: ${{ matrix.architecture }}
 
       - name: Build wheels
         uses: PyO3/maturin-action@v1
         with:
           target: ${{ matrix.target }}
-          args: --release --out dist --find-interpreter -m bindings/python/Cargo.toml
-          manylinux: 2_28
-          before-script-linux: |
-            if command -v dnf > /dev/null; then
-              dnf install -y patch
-            elif command -v apt-get > /dev/null; then
-              apt-get update && apt-get install -y patch
-            fi
-
-      - name: Upload wheels
-        uses: actions/upload-artifact@v4
-        with:
-          name: wheels-linux-${{ matrix.target }}
-          path: dist
-
-  windows:
-    runs-on: windows-latest
-    defaults:
-      run:
-        working-directory: ${{ env.WORKING_DIRECTORY }}
-    strategy:
-      matrix:
-        target: [ x64 ]
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-python@v4
-        with:
-          python-version: '3.13'
-          architecture: ${{ matrix.target }}
-      - name: Build wheels
-        uses: PyO3/maturin-action@v1
-        with:
-          target: ${{ matrix.target }}
-          args: --release --out dist --find-interpreter -m bindings/python/Cargo.toml
+          args: ${{ matrix.args }}
+          manylinux: ${{ matrix.manylinux || 'auto' }}
           sccache: 'true'
-      - name: Upload wheels
-        uses: actions/upload-artifact@v4
-        with:
-          name: wheels-windows-${{ matrix.target }}
-          path: dist
 
-  macos:
-    runs-on: macos-latest
-    defaults:
-      run:
-        working-directory: ${{ env.WORKING_DIRECTORY }}
-    strategy:
-      matrix:
-        target: [ x86_64, aarch64 ]
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-python@v4
-        with:
-          python-version: '3.13'
-      - name: Build wheels
-        uses: PyO3/maturin-action@v1
-        with:
-          target: ${{ matrix.target }}
-          args: --release --out dist --find-interpreter -m bindings/python/Cargo.toml
-          sccache: 'true'
       - name: Upload wheels
         uses: actions/upload-artifact@v4
         with:
-          name: wheels-macos-${{ matrix.target }}
+          name: wheels-${{ matrix.platform }}-${{ matrix.target }}
           path: dist
 
   sdist:
+    if: "github.event_name != 'release' || startsWith(github.event.release.tag_name, 'python-v')"
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: ${{ env.WORKING_DIRECTORY }}
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-python@v4
@@ -133,10 +104,10 @@ jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: ${{ env.WORKING_DIRECTORY }}
-    needs: [ linux, windows, macos, sdist ]
+    environment: release
+    # Publishes only on the release-please GitHub Release for the python component.
+    if: "github.event_name == 'release' && startsWith(github.event.release.tag_name, 'python-v')"
+    needs: [ wheels, sdist ]
     steps:
       - uses: actions/download-artifact@v4
         with:
@@ -144,7 +115,6 @@ jobs:
           merge-multiple: true
 
       - name: Publish to PyPI
-        if: "startsWith(github.event.head_commit.message, 'chore(release): publish python')"
         uses: PyO3/maturin-action@v1
         env:
           MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}

.github/workflows/release-please.yaml

@@ -0,0 +1,44 @@
+name: Release Please
+
+# Single source of truth for STABLE version bumps + changelogs + tags.
+#
+# On every push to master it maintains one "Release PR" per component
+# (separate-pull-requests). Merging a Release PR:
+#   * bumps the version(s) in the relevant Cargo.toml / package.json,
+#   * updates the CHANGELOG,
+#   * creates a git tag + GitHub Release for that component.
+#
+# The GitHub Release is what triggers the matching publish workflow
+# (node.yaml / python.yaml / rust.yaml / uniffi.yaml) via its
+# `on: release` trigger. We use a PAT (not GITHUB_TOKEN) so the created
+# release is allowed to trigger those downstream workflows.
+#
+# Tags (include-component-in-tag + tag-separator "-"):
+#   core   -> zen-engine-v<ver> (+ the 5 linked core crates), python -> python-v<ver>,
+#   nodejs -> nodejs-v<ver>, uniffi -> uniffi-v<ver>
+#
+# Betas use this SAME flow: during a prerelease window set `prerelease: true`
+# + `prerelease-type: "beta"` on the components in release-please-config.json,
+# and merges cut X.Y.Z-beta.N for every component (incl. uniffi). The publish
+# workflows pick npm/dist-tag behaviour from `github.event.release.prerelease`.
+# (One-time per-component `release-as: 1.0.0-beta.0` bootstraps the v1 base.)
+
+on:
+  push:
+    branches:
+      - master
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    name: Release Please
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@v4
+        with:
+          token: ${{ secrets.PAT }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

.github/workflows/rust.yaml

@@ -9,9 +9,7 @@ on:
       - 'bindings/**'
       - 'examples/**'
       - '.github/workflows/python.yaml'
-      - '.github/workflows/python-version-bump.yaml'
       - '.github/workflows/node.yaml'
-      - '.github/workflows/node-version-bump.yaml'
   push:
     branches:
       - master
@@ -21,9 +19,11 @@ on:
       - 'bindings/**'
       - 'examples/**'
       - '.github/workflows/python.yaml'
-      - '.github/workflows/python-version-bump.yaml'
       - '.github/workflows/node.yaml'
-      - '.github/workflows/node-version-bump.yaml'
+  # Crates.io publish is driven by the GitHub Release that release-please
+  # creates for the linked `core` group (anchored on tag `zen-engine-v<version>`).
+  release:
+    types: [published]
 
 env:
   RUST_BACKTRACE: 1
@@ -34,7 +34,7 @@ defaults:
     shell: bash
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -51,50 +51,13 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Install Rust
-        run: rustup install 1.80
+        run: rustup update stable
+      - uses: ./.github/actions/setup-rust
+        with:
+          shared-key: rust-test-${{ matrix.os }}
       - run: cargo test --workspace --all-features --exclude zen-ffi --exclude zen-nodejs --exclude zen-python
-      - run: cargo test --workspace --all-features --exclude zen-ffi --exclude zen-nodejs --exclude zen-python --release
       - name: Test without arbitrary_precision
         run: cargo test --workspace --exclude zen-ffi --exclude zen-nodejs --exclude zen-python
-      - name: Test without arbitrary_precision (release)
-        run: cargo test --workspace --exclude zen-ffi --exclude zen-nodejs --exclude zen-python --release
-
-  build:
-    name: cargo +${{ matrix.rust }} build
-    strategy:
-      fail-fast: false
-      matrix:
-        rust:
-          - stable
-          - beta
-          - nightly
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Install Rust
-        run: rustup update ${{ matrix.rust }} && rustup default ${{ matrix.rust }}
-      - run: cargo build --tests
-
-  bench:
-    name: cargo bench
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Install Rust
-        run: rustup update stable
-      - run: cargo bench --workspace
-
-  miri:
-    name: cargo miri test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Install Rust
-        run: rustup toolchain install nightly-2025-05-08 --component miri && rustup default nightly-2025-05-08
-      - run: cargo miri test --workspace --all-features
-        env:
-          MIRIFLAGS: -Zmiri-strict-provenance -Zmiri-symbolic-alignment-check -Zmiri-disable-isolation
-          RUSTFLAGS: ${{ env.RUSTFLAGS }} -Z randomize-layout
 
   fmt:
     name: Cargo FMT
@@ -108,12 +71,11 @@ jobs:
   release:
     name: Cargo Release
     runs-on: ubuntu-latest
-    if: "startsWith(github.event.head_commit.message, 'chore(release): publish core')"
+    environment: release
+    # Publishes only on the release-please GitHub Release for the core group.
+    if: "github.event_name == 'release' && startsWith(github.event.release.tag_name, 'zen-engine-v')"
     needs:
       - test
-      - build
-      - bench
-      - miri
       - fmt
     steps:
       - uses: actions/checkout@v3

.github/workflows/uniffi-version-bump.yaml

@@ -1,56 +0,0 @@
-name: "Release: Uniffi"
-
-env:
-  WORKING_DIRECTORY: bindings/uniffi
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Version'
-        required: true
-        default: 'patch'
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-
-permissions:
-  contents: write
-
-jobs:
-  publish:
-    name: Version
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: ${{ env.WORKING_DIRECTORY }}
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          persist-credentials: false
-
-      - name: Set Git author
-        run: |
-          git config user.name "Bot"
-          git config user.email "bot@gorules.io"
-
-      - uses: actions/setup-python@v4
-        with:
-          python-version: '3.10'
-
-      - name: 'Install dependencies'
-        run: pip install --upgrade bump2version
-
-      - name: Bumpversion
-        run: bumpversion ${{ github.event.inputs.version }} --allow-dirty --tag-name "uniffi-v{new_version}"
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Push changes
-        uses: ad-m/github-push-action@v0.6.0
-        with:
-          github_token: ${{ secrets.PAT}}

.github/workflows/uniffi.yaml

@@ -19,6 +19,10 @@ on:
       - 'core/**'
       - 'test-data/**'
       - '.github/workflows/uniffi.yaml'
+  # Stable publish is driven by the GitHub Release that release-please creates
+  # for the `uniffi` component (tag `uniffi-v<version>`).
+  release:
+    types: [published]
 
 jobs:
   build:
@@ -67,7 +71,18 @@ jobs:
         with:
           target: ${{ matrix.settings.target }}
 
-      - name: Build
+      - uses: ./.github/actions/setup-rust
+        with:
+          shared-key: uniffi-${{ matrix.settings.target }}
+          zig: ${{ matrix.settings.host == 'ubuntu-latest' }}
+
+      # Linux targets (incl. s390x) build on the host via zig; mac/windows build natively.
+      - name: Build (zig, linux)
+        if: ${{ matrix.settings.host == 'ubuntu-latest' }}
+        working-directory: ${{ env.UNIFFI_DIRECTORY }}
+        run: cargo zigbuild --lib --release --target ${{ matrix.settings.target }}.${{ env.GLIBC_VERSION }} ${{ matrix.settings.extra_args }}
+      - name: Build (native)
+        if: ${{ matrix.settings.host != 'ubuntu-latest' }}
         uses: houseabsolute/actions-rust-cross@v1
         with:
           working-directory: ${{ env.UNIFFI_DIRECTORY }}
@@ -83,8 +98,9 @@ jobs:
 
   release-java-kotlin:
     runs-on: ubuntu-latest
+    environment: release
     needs: [ build ]
-    if: "startsWith(github.event.head_commit.message, 'chore(release): publish uniffi')"
+    if: "github.event_name == 'release' && startsWith(github.event.release.tag_name, 'uniffi-v')"
     defaults:
       run:
         working-directory: ${{ env.UNIFFI_DIRECTORY }}
@@ -100,6 +116,10 @@ jobs:
       - name: Setup Rust Toolchain
         uses: dtolnay/rust-toolchain@stable
 
+      - uses: ./.github/actions/setup-rust
+        with:
+          shared-key: uniffi-java-kotlin
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4
 
@@ -152,10 +172,11 @@ jobs:
 
   release-csharp:
     runs-on: ubuntu-latest
+    environment: release
     needs: [ build ]
     permissions:
       id-token: write  # Required for OIDC
-    if: "startsWith(github.event.head_commit.message, 'chore(release): publish uniffi')"
+    if: "github.event_name == 'release' && startsWith(github.event.release.tag_name, 'uniffi-v')"
     defaults:
       run:
         working-directory: ${{ env.UNIFFI_DIRECTORY }}
@@ -171,6 +192,10 @@ jobs:
       - name: Setup Rust Toolchain
         uses: dtolnay/rust-toolchain@stable
 
+      - uses: ./.github/actions/setup-rust
+        with:
+          shared-key: uniffi-csharp
+
       - name: Download all artifacts
         uses: actions/download-artifact@v4
         with:
@@ -260,6 +285,10 @@ jobs:
         with:
           target: ${{ matrix.settings.target }}
 
+      - uses: ./.github/actions/setup-rust
+        with:
+          shared-key: uniffi-ios-${{ matrix.settings.target }}
+
       - name: Build iOS
         run: |
           if [ "${{ matrix.settings.target }}" = "aarch64-apple-ios-sim" ]; then
@@ -282,6 +311,13 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
+      - name: Setup Rust Toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - uses: ./.github/actions/setup-rust
+        with:
+          shared-key: uniffi-swift
+
       - name: Download iOS artifacts
         uses: actions/download-artifact@v4
         with:
@@ -297,9 +333,6 @@ jobs:
           cp target-ios/ios-x86-64/libzen_uniffi.a target/x86_64-apple-ios/release/
           cp target-ios/ios-aarch64-sim/libzen_uniffi.a target/aarch64-apple-ios-sim/release/
 
-      - name: Setup Rust Toolchain
-        uses: dtolnay/rust-toolchain@stable
-
       - name: Generate Swift bindings
         run: |
           cargo run --bin uniffi-bindgen -- generate \
@@ -366,8 +399,9 @@ jobs:
   release-ios:
     name: Release iOS
     runs-on: macos-latest
+    environment: release
     needs: [ create-xcframework ]
-    if: "startsWith(github.event.head_commit.message, 'chore(release): publish uniffi')"
+    if: "github.event_name == 'release' && startsWith(github.event.release.tag_name, 'uniffi-v')"
 
     steps:
       - name: Checkout zen-ios
@@ -455,6 +489,10 @@ jobs:
       - name: Setup Rust Toolchain
         uses: dtolnay/rust-toolchain@stable
 
+      - uses: ./.github/actions/setup-rust
+        with:
+          shared-key: uniffi-android
+
       - name: Install cargo-ndk
         run: cargo install cargo-ndk
 
@@ -466,7 +504,7 @@ jobs:
           add-to-path: true
 
       - name: Add Rust Android targets (all)
-        if: "startsWith(github.event.head_commit.message, 'chore(release): publish uniffi')"
+        if: "github.event_name == 'release' && startsWith(github.event.release.tag_name, 'uniffi-v')"
         run: |
           rustup target add aarch64-linux-android
           rustup target add armv7-linux-androideabi
@@ -474,12 +512,12 @@ jobs:
           rustup target add x86_64-linux-android
 
       - name: Add Rust Android targets (arm64 only)
-        if: "!startsWith(github.event.head_commit.message, 'chore(release): publish uniffi')"
+        if: "github.event_name != 'release' || !startsWith(github.event.release.tag_name, 'uniffi-v')"
         run: |
           rustup target add aarch64-linux-android
 
       - name: Build for Android (all targets)
-        if: "startsWith(github.event.head_commit.message, 'chore(release): publish uniffi')"
+        if: "github.event_name == 'release' && startsWith(github.event.release.tag_name, 'uniffi-v')"
         env:
           ANDROID_NDK_ROOT: ${{ steps.setup-ndk.outputs.ndk-path }}
         run: |
@@ -489,7 +527,7 @@ jobs:
            build -p zen-uniffi --release --features bindgen
 
       - name: Build for Android (arm64 only)
-        if: "!startsWith(github.event.head_commit.message, 'chore(release): publish uniffi')"
+        if: "github.event_name != 'release' || !startsWith(github.event.release.tag_name, 'uniffi-v')"
         env:
           ANDROID_NDK_ROOT: ${{ steps.setup-ndk.outputs.ndk-path }}
         run: |
@@ -643,8 +681,9 @@ jobs:
 
   release-android:
     runs-on: ubuntu-latest
+    environment: release
     needs: [ package-android-aar ]
-    if: "startsWith(github.event.head_commit.message, 'chore(release): publish uniffi')"
+    if: "github.event_name == 'release' && startsWith(github.event.release.tag_name, 'uniffi-v')"
     defaults:
       run:
         working-directory: ${{ env.UNIFFI_DIRECTORY }}