release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions: {}

jobs:
  security:
    name: Security scan
    uses: ./.github/workflows/security.yml
    permissions:
      contents: read
      security-events: write
      pull-requests: read

  test:
    name: Test before release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      BASECAMP_NO_KEYRING: "1"
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to the cache used by tag-push workflows
        with:
          go-version-file: 'go.mod'

      - name: Install golangci-lint
        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
        with:
          version: v2.9.0
          install-only: true

      - name: Cache BATS
        id: cache-bats
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to the cache used by tag-push workflows
        with:
          path: ~/.local
          key: bats-1.11.0-home

      - name: Install BATS
        if: steps.cache-bats.outputs.cache-hit != 'true'
        run: |
          git clone --depth 1 --branch v1.11.0 https://github.com/bats-core/bats-core.git /tmp/bats-core
          /tmp/bats-core/install.sh ~/.local

      - name: Add BATS to PATH
        run: echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Run release quality gate
        run: |
          make fmt-check vet lint test test-e2e provenance-check check-naming check-surface
          go test -tags dev -race -count=1 ./...

      - name: Run govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          GOFLAGS=-tags=dev govulncheck ./...

      - name: Check CLI surface compatibility
        run: |
          # Generate current snapshot
          make build
          scripts/check-cli-surface.sh ./bin/basecamp /tmp/current-surface.txt
          # Generate baseline from previous tag in isolated worktree
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
          if [ -n "$PREV_TAG" ]; then
            SCRIPT_DIR="$(pwd)/scripts"
            WORKTREE_DIR=/tmp/baseline-tree
            trap 'git worktree remove "$WORKTREE_DIR" --force 2>/dev/null || true' EXIT
            git worktree add "$WORKTREE_DIR" "$PREV_TAG"
            cd "$WORKTREE_DIR"
            make build
            if "$SCRIPT_DIR/check-cli-surface.sh" ./bin/basecamp /tmp/baseline-surface.txt 2>/dev/null; then
              cd -
              git worktree remove "$WORKTREE_DIR" --force
              trap - EXIT
              scripts/check-cli-surface-diff.sh /tmp/baseline-surface.txt /tmp/current-surface.txt
            else
              echo "Baseline ($PREV_TAG) does not support --help --agent — skipping surface diff"
              cd -
              git worktree remove "$WORKTREE_DIR" --force
              trap - EXIT
            fi
          else
            echo "First release — no baseline to compare against"
          fi

  release:
    name: Release
    needs: [test, security]
    runs-on: ubuntu-latest
    timeout-minutes: 45
    environment: release
    permissions:
      contents: write
      id-token: write
      models: read
      attestations: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Generate token for Homebrew tap
        id: sdk-token
        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
        with:
          app-id: ${{ vars.RELEASE_CLIENT_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          owner: basecamp
          repositories: homebrew-tap
          permission-contents: write

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to the cache used by tag-push workflows
        with:
          go-version-file: 'go.mod'

      - name: Verify tag is on main
        run: |
          git fetch origin main
          git merge-base --is-ancestor "$GITHUB_SHA" origin/main

      - name: Install Cosign
        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0

      - name: Install Syft
        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0

      - name: Build changelog context
        run: |
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
          DIFF_FILE=/tmp/diff.txt
          if [ -z "$PREV_TAG" ]; then
            COMMITS=$(git log --oneline --no-decorate)
            git diff --stat 4b825dc642cb6eb9a060e54bf899d69f82a3ef17 HEAD > "$DIFF_FILE"
          else
            COMMITS=$(git log --oneline --no-decorate "${PREV_TAG}..HEAD")
            git diff "${PREV_TAG}..HEAD" -- '*.go' 'go.mod' > "$DIFF_FILE"
          fi
          {
            echo "Commits:"
            echo "$COMMITS"
            echo ""
            echo "Diff summary:"
            head -c 80000 "$DIFF_FILE"
          } > /tmp/user-message.txt
          # Splice into prompt YAML
          python3 -c "
          with open('.github/prompts/summarize-changelog.prompt.yml') as f:
              lines = f.readlines()
          with open('/tmp/user-message.txt') as f:
              user_msg = f.read()
          insert_at = len(lines)
          for i, line in enumerate(lines):
              if i == 0: continue
              if line.strip() and not line[0].isspace():
                  insert_at = i
                  break
          entry = ['  - role: user\n', '    content: |\n']
          for ln in user_msg.splitlines():
              entry.append('      ' + ln + '\n')
          lines[insert_at:insert_at] = entry
          with open('/tmp/prompt.yml', 'w') as f:
              f.writelines(lines)
          try:
              import yaml
              doc = yaml.safe_load(open('/tmp/prompt.yml'))
              assert doc['messages'][-1]['role'] == 'user', 'prompt splice failed'
          except ImportError:
              pass
          "
        continue-on-error: true

      - name: Generate AI changelog
        id: ai-changelog
        uses: actions/ai-inference@e09e65981758de8b2fdab13c2bfb7c7d5493b0b6 # v2.0.7
        continue-on-error: true
        with:
          prompt-file: /tmp/prompt.yml

      - name: Set changelog path
        id: changelog
        env:
          RESPONSE_FILE: ${{ steps.ai-changelog.outputs.response-file }}
        run: |
          if [ -n "$RESPONSE_FILE" ] && [ -f "$RESPONSE_FILE" ]; then
            sed -i '/^```\(markdown\)\?$/d' "$RESPONSE_FILE"
            echo "file=$RESPONSE_FILE" >> "$GITHUB_OUTPUT"
          fi

      - name: Verify macOS signing secrets
        if: github.repository == 'basecamp/basecamp-cli'
        run: |
          missing=()
          for var in MACOS_SIGN_P12 MACOS_SIGN_PASSWORD MACOS_NOTARY_KEY MACOS_NOTARY_KEY_ID MACOS_NOTARY_ISSUER_ID; do
            if [ -z "${!var}" ]; then
              missing+=("$var")
            fi
          done
          if [ ${#missing[@]} -gt 0 ]; then
            echo "::error::Missing macOS signing secrets: ${missing[*]}"
            exit 1
          fi
          echo "All macOS signing secrets present"
        env:
          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}

      - name: Install quill for macOS signing
        run: |
          go install github.com/anchore/quill/cmd/quill@v0.7.1
          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"

      - name: Prepare signing credentials
        env:
          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
        run: |
          umask 077
          echo "$MACOS_SIGN_P12" | base64 -d > "$RUNNER_TEMP/codesign.p12"
          echo "$MACOS_NOTARY_KEY" | base64 -d > "$RUNNER_TEMP/notary.p8"

      - name: Install GoReleaser
        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
        with:
          distribution: goreleaser
          version: 'v2.14.1'
          install-only: true

      - name: Run GoReleaser
        env:
          CHANGELOG_FILE: ${{ steps.changelog.outputs.file }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP_TOKEN: ${{ steps.sdk-token.outputs.token }}
          QUILL_SIGN_P12: ${{ runner.temp }}/codesign.p12
          QUILL_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
        run: |
          RELEASE_CHANGELOG=""
          if [ -n "$CHANGELOG_FILE" ] && [ -f "$CHANGELOG_FILE" ]; then
            RELEASE_CHANGELOG=$(cat "$CHANGELOG_FILE")
          fi
          export RELEASE_CHANGELOG
          goreleaser release --clean --skip=notarize

      - name: Notarize macOS binaries
        env:
          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
        run: |
          for bin in dist/basecamp_darwin_*/basecamp; do
            echo "Notarizing $bin..."
            quill notarize "$bin" \
              --notary-issuer "$MACOS_NOTARY_ISSUER_ID" \
              --notary-key-id "$MACOS_NOTARY_KEY_ID" \
              --notary-key "$RUNNER_TEMP/notary.p8" \
              --wait
          done

      - name: Clean up signing credentials
        if: always()
        run: rm -f "$RUNNER_TEMP/codesign.p12" "$RUNNER_TEMP/notary.p8"

      - name: Attest build provenance
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-checksums: ./dist/checksums.txt

      - name: Publish to AUR
        env:
          AUR_KEY: ${{ secrets.AUR_KEY }}
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          mkdir -p ~/.ssh
          echo "$AUR_KEY" > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          echo -e "Host aur.archlinux.org\n  IdentityFile ~/.ssh/aur\n  User aur\n  StrictHostKeyChecking accept-new" >> ~/.ssh/config
          git config --global user.name "37signals"
          git config --global user.email "dev@37signals.com"
          scripts/publish-aur.sh "$VERSION"

  macos-verify:
    name: Verify macOS signing
    needs: [release]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: macos-latest
    timeout-minutes: 10
    permissions:
      contents: read
    strategy:
      matrix:
        arch: [amd64, arm64]
    steps:
      - name: Download release binary
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p /tmp/verify
          gh release download "$GITHUB_REF_NAME" \
            --repo "$GITHUB_REPOSITORY" \
            --pattern "basecamp_*_darwin_${{ matrix.arch }}.tar.gz" \
            --dir /tmp/verify
          tar -xzf /tmp/verify/basecamp_*_darwin_${{ matrix.arch }}.tar.gz -C /tmp/verify

      - name: Verify TeamIdentifier
        run: |
          TEAM_ID=$(codesign -dv --verbose=4 /tmp/verify/basecamp 2>&1 | grep TeamIdentifier= | cut -d= -f2)
          echo "TeamIdentifier (${{ matrix.arch }}): $TEAM_ID"
          if [ "$TEAM_ID" != "2WNYUYRS7G" ]; then
            echo "::error::TeamIdentifier mismatch (${{ matrix.arch }}): expected 2WNYUYRS7G, got $TEAM_ID"
            exit 1
          fi

      - name: Verify hardened runtime
        run: |
          FLAGS=$(codesign -dv --verbose=4 /tmp/verify/basecamp 2>&1 | grep 'flags=' | head -1)
          echo "Flags (${{ matrix.arch }}): $FLAGS"
          if ! echo "$FLAGS" | grep -q 'runtime'; then
            echo "::error::Hardened runtime flag not set (${{ matrix.arch }}): $FLAGS"
            exit 1
          fi

      - name: Check notarization status
        run: |
          # Best-effort: notarization ticket propagation can lag, so this is
          # telemetry, not a gate. TeamIdentifier and hardened runtime above
          # are the hard assertions.
          spctl -a -vvv -t install /tmp/verify/basecamp 2>&1 | tee /tmp/verify/spctl.out
          if grep -q 'accepted\|Notarized Developer ID' /tmp/verify/spctl.out; then
            echo "Notarization accepted for ${{ matrix.arch }}"
          else
            echo "::warning::Notarization not yet accepted for ${{ matrix.arch }} (ticket propagation may lag)"
          fi

  nix-verify:
    name: Verify Nix flake
    needs: [release]
    if: startsWith(github.ref, 'refs/tags/v')
    continue-on-error: true
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install Nix
        uses: cachix/install-nix-action@1ca7d21a94afc7c957383a2d217460d980de4934 # v31.10.1

      - name: Build and verify
        run: |
          STORE_PATH=$(nix build --no-link --print-out-paths)
          "$STORE_PATH/bin/basecamp" --version

  sync-skills:
    name: Sync skills
    needs: [release]
    if: startsWith(github.ref, 'refs/tags/v')
    continue-on-error: true
    concurrency:
      group: sync-skills
      cancel-in-progress: false
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment: release
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Generate token for skills repo
        id: skills-token
        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
        with:
          app-id: ${{ vars.RELEASE_CLIENT_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          owner: basecamp
          repositories: skills
          permission-contents: write

      - name: Sync skills to distribution repo
        id: sync
        env:
          SKILLS_TOKEN: ${{ steps.skills-token.outputs.token }}
          RELEASE_TAG: ${{ github.ref_name }}
          SOURCE_SHA: ${{ github.sha }}
        run: scripts/sync-skills.sh

      - name: Notify on sync failure
        if: failure()
        env:
          GH_TOKEN: ${{ github.token }}
          REF_NAME: ${{ github.ref_name }}
          RUN_ID: ${{ github.run_id }}
        run: |
          TITLE="Skills sync failure"
          BODY="The automatic skills sync for [${REF_NAME}](https://github.com/${{ github.repository }}/actions/runs/${RUN_ID}) failed. Check the workflow run for details."

          # Check for existing open issue before creating a new one
          existing=$(gh issue list --repo ${{ github.repository }} --state open --search "in:title $TITLE" --json number,title --jq '[.[] | select(.title == "'"$TITLE"'")][0].number // empty' 2>/dev/null || true)
          if [ -n "$existing" ]; then
            gh issue comment --repo ${{ github.repository }} "$existing" --body "$BODY" || true
          else
            gh issue create --repo ${{ github.repository }} --title "$TITLE" --body "$BODY" || true
          fi

          # Always emit annotation so the failure is visible in the workflow summary
          echo "::error::Skills sync to basecamp/skills failed for ${REF_NAME}. See https://github.com/${{ github.repository }}/actions/runs/${RUN_ID}"