release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Release version (e.g. 3.2.0)"
        required: true
        type: string
      dry_run:
        description: "Dry run (skip publishing)"
        required: false
        type: boolean
        default: false
      skip_crates:
        description: "Skip crates.io publish"
        required: false
        type: boolean
        default: false
env:
  CARGO_TERM_COLOR: always
permissions:
  contents: read
jobs:
  # ---------------------------------------------------------------------------
  # 1. Validate input & run tests
  # ---------------------------------------------------------------------------
  validate:
    name: Validate & Test
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@v4

      - name: Validate branch and semver
        id: version
        run: |
          if [[ "${{ github.ref_name }}" != "main" ]]; then
            echo "::error::Releases must be triggered from the main branch, got '${{ github.ref_name }}'"
            exit 1
          fi
          VERSION="${{ inputs.version }}"
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
            echo "::error::Invalid semver: $VERSION"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - uses: actions-rust-lang/setup-rust-toolchain@v1

      - name: Run tests
        run: cargo test --verbose

      - name: Clippy
        run: cargo clippy -- -D warnings

  # ---------------------------------------------------------------------------
  # 2. Bump versions in Cargo.toml files, commit, tag, push
  # ---------------------------------------------------------------------------
  version-bump:
    name: Bump Version & Tag
    needs: validate
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    env:
      VERSION: ${{ needs.validate.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Bump versions
        run: |
          # Bump package version (only the version line directly under [package])
          for toml in guard/Cargo.toml guard-lambda/Cargo.toml guard-ffi/Cargo.toml; do
            sed -i '0,/^version = "[^"]*"/{s/^version = "[^"]*"/version = "'"$VERSION"'"/}' "$toml"
          done

          # Update cross-crate dependency references
          sed -i "s/cfn-guard = { version = \"[^\"]*\"/cfn-guard = { version = \"$VERSION\"/" guard-lambda/Cargo.toml
          sed -i "s/cfn-guard = { version = \"[^\"]*\"/cfn-guard = { version = \"$VERSION\"/" guard-ffi/Cargo.toml
          sed -i "s/cfn-guard = { version = \"[^\"]*\"/cfn-guard = { version = \"$VERSION\"/" guard-examples/library/Cargo.toml

          # Update test fixtures that embed the version
          sed -i "s/\"semanticVersion\": \"[^\"]*\"/\"semanticVersion\": \"$VERSION\"/" guard/resources/validate/output-dir/structured.sarif
          sed -i "s/\"fullName\": \"cfn-guard [^\"]*\"/\"fullName\": \"cfn-guard $VERSION\"/" guard/resources/validate/output-dir/structured.sarif

          # Update lockfile to reflect new versions
          cargo check

      - name: Commit & tag
        run: |
          BRANCH="release/$VERSION"
          git checkout -b "$BRANCH"
          git add -A
          if ! git diff --cached --quiet; then
            git commit -m "chore: bump version to $VERSION"
          fi
          if git ls-remote --tags origin "$VERSION" | grep -q "$VERSION"; then
            echo "Tag $VERSION already exists on remote, skipping"
          else
            git tag "$VERSION"
            git push origin "$VERSION"
          fi
          git fetch origin "$BRANCH" 2>/dev/null || true
          git push origin "$BRANCH" --force-with-lease

      - name: Create PR to merge version bump back to main
        if: ${{ !inputs.dry_run }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh pr create \
            --base main \
            --head "release/$VERSION" \
            --title "chore: bump version to $VERSION" \
            --body "Automated version bump from release workflow. Merge after release is complete."

  # ---------------------------------------------------------------------------
  # 3. Build cross-platform binaries
  # ---------------------------------------------------------------------------
  build:
    name: Build (${{ matrix.target }})
    needs: [validate, version-bump]
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            asset_name: cfn-guard-v3-x86_64-ubuntu-latest
            extra_asset_names: "cfn-guard-v3-ubuntu-latest cfn-guard-v3-x86_64-linux-latest cfn-guard-v3-linux-latest"
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
            asset_name: cfn-guard-v3-aarch64-ubuntu-latest
            extra_asset_names: "cfn-guard-v3-aarch64-linux-latest"
          - target: x86_64-apple-darwin
            os: macos-latest
            asset_name: cfn-guard-v3-x86_64-macos-latest
            extra_asset_names: "cfn-guard-v3-macos-latest"
          - target: aarch64-apple-darwin
            os: macos-latest
            asset_name: cfn-guard-v3-aarch64-macos-latest
            extra_asset_names: ""
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            asset_name: cfn-guard-v3-x86_64-windows-latest
            extra_asset_names: "cfn-guard-v3-windows-latest"
          - target: aarch64-pc-windows-msvc
            os: windows-latest
            asset_name: cfn-guard-v3-aarch64-windows-latest
            extra_asset_names: ""
          - target: i686-pc-windows-msvc
            os: windows-latest
            asset_name: cfn-guard-v3-i686-windows-latest
            extra_asset_names: ""
    runs-on: ${{ matrix.os }}
    env:
      VERSION: ${{ needs.validate.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.validate.outputs.version }}

      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          target: ${{ matrix.target }}

      - name: Install cross-compilation deps (aarch64 linux)
        if: matrix.target == 'aarch64-unknown-linux-musl'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu
          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"

      - name: Build
        run: cargo build --release --target ${{ matrix.target }}

      - name: Package (unix)
        if: runner.os != 'Windows'
        run: |
          BIN="target/${{ matrix.target }}/release/cfn-guard"
          for NAME in ${{ matrix.asset_name }} ${{ matrix.extra_asset_names }}; do
            mkdir "$NAME"
            cp "$BIN" README.md "$NAME/"
            tar czvf "${NAME}.tar.gz" "$NAME"
          done

      - name: Package (windows)
        if: runner.os == 'Windows'
        shell: bash
        run: |
          BIN="target/${{ matrix.target }}/release/cfn-guard.exe"
          for NAME in ${{ matrix.asset_name }} ${{ matrix.extra_asset_names }}; do
            mkdir "$NAME"
            cp "$BIN" README.md "$NAME/"
            tar czvf "${NAME}.tar.gz" "$NAME"
          done

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.asset_name }}
          path: "*.tar.gz"
          retention-days: 1

  # ---------------------------------------------------------------------------
  # 4. Create GitHub Release & upload all assets
  # ---------------------------------------------------------------------------
  github-release:
    name: GitHub Release
    needs: [validate, build]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      VERSION: ${{ needs.validate.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.validate.outputs.version }}

      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: List assets
        run: ls -lhR artifacts/

      - name: Check if release exists
        id: check
        run: |
          if gh release view "$VERSION" --repo "${{ github.repository }}" >/dev/null 2>&1; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create release
        if: ${{ !inputs.dry_run }}
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ env.VERSION }}
          name: v${{ env.VERSION }}
          generate_release_notes: ${{ steps.check.outputs.exists == 'false' }}
          files: artifacts/*.tar.gz

  # ---------------------------------------------------------------------------
  # 5. Publish to crates.io
  # ---------------------------------------------------------------------------
  publish-crates:
    name: Publish to crates.io
    needs: [validate, version-bump, github-release]
    if: ${{ !inputs.dry_run && !inputs.skip_crates }}
    runs-on: ubuntu-latest
    env:
      VERSION: ${{ needs.validate.outputs.version }}
      CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.validate.outputs.version }}

      - uses: actions-rust-lang/setup-rust-toolchain@v1

      - name: Publish cfn-guard
        run: |
          cd guard
          cargo publish --no-verify 2>&1 | tee /tmp/publish.log || {
            if grep -q "already uploaded" /tmp/publish.log; then
              echo "::warning::cfn-guard already published, skipping"
            else
              exit 1
            fi
          }

      - name: Wait for crates.io index
        run: sleep 30

      - name: Publish cfn-guard-lambda
        run: |
          cd guard-lambda
          cargo publish --no-verify 2>&1 | tee /tmp/publish.log || {
            if grep -q "already uploaded" /tmp/publish.log; then
              echo "::warning::cfn-guard-lambda already published, skipping"
            else
              exit 1
            fi
          }

      - name: Publish cfn-guard-ffi
        run: |
          cd guard-ffi
          cargo publish --no-verify 2>&1 | tee /tmp/publish.log || {
            if grep -q "already uploaded" /tmp/publish.log; then
              echo "::warning::cfn-guard-ffi already published, skipping"
            else
              exit 1
            fi
          }

  # ---------------------------------------------------------------------------
  # 6. Publish Docker to ECR Public
  # ---------------------------------------------------------------------------
  publish-docker:
    name: Publish Docker to ECR
    needs: [validate, version-bump]
    if: ${{ !inputs.dry_run }}
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    env:
      VERSION: ${{ needs.validate.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.validate.outputs.version }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          role-to-assume: ${{ secrets.PUBLISHER_ROLE_NAME }}
          role-session-name: PublishToECR

      - name: Login to ECR Public
        id: ecr
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public

      - name: Build & push
        env:
          REGISTRY: ${{ steps.ecr.outputs.registry }}
          REGISTRY_ALIAS: ${{ secrets.REGISTRY_ALIAS }}
          REPOSITORY: cloudformation-guard
        run: |
          PREFIX="$REGISTRY/$REGISTRY_ALIAS/$REPOSITORY"
          docker build \
            -t "$PREFIX:$VERSION" \
            -t "$PREFIX:latest" \
            .
          docker push "$PREFIX:$VERSION"
          docker push "$PREFIX:latest"