ci-release.yml

name: CI and Release

on:
  push:
    branches:
      - dev
      - main
  pull_request:
    branches:
      - dev
      - main
  schedule:
    - cron: "17 3 * * 1"

permissions:
  contents: read

env:
  COVERAGE_MIN: "25.0"
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
  SYFT_VERSION: "v1.42.3"

concurrency:
  group: ci-release-${{ github.ref }}
  cancel-in-progress: true

jobs:
  metadata:
    name: Release Metadata
    runs-on: ubuntu-latest
    if: github.event_name != 'schedule'
    outputs:
      version: ${{ steps.version.outputs.value }}
      should_release: ${{ steps.version.outputs.should_release }}
    steps:
      - uses: actions/checkout@v5

      - name: Resolve app version
        id: version
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          version="$(sed -nE 's/^var version = "([^"]+)"$/\1/p' version.go)"
          if [[ -z "${version}" ]]; then
            echo "Unable to parse version.go" >&2
            exit 1
          fi

          should_release=false
          if [[ "${GITHUB_EVENT_NAME}" == "push" && "${GITHUB_REF_NAME}" == "main" ]]; then
            if [[ "${version}" == "dev" ]]; then
              echo "Skipping release on main because version.go is still set to dev." >> "${GITHUB_STEP_SUMMARY}"
            elif [[ ! "${version}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$ ]]; then
              echo "Invalid release version '${version}' in version.go" >&2
              exit 1
            elif gh release view "${version}" >/dev/null 2>&1; then
              echo "Skipping release because ${version} already exists." >> "${GITHUB_STEP_SUMMARY}"
            else
              should_release=true
              echo "Preparing release ${version} from ${GITHUB_SHA}." >> "${GITHUB_STEP_SUMMARY}"
            fi
          fi

          echo "value=${version}" >> "${GITHUB_OUTPUT}"
          echo "should_release=${should_release}" >> "${GITHUB_OUTPUT}"

  quality:
    name: Quality (Ubuntu)
    runs-on: ubuntu-latest
    needs: metadata
    if: github.event_name != 'schedule'
    steps:
      - uses: actions/checkout@v5

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Check formatting
        run: |
          gofiles="$(git ls-files '*.go')"
          if [ -z "$gofiles" ]; then
            exit 0
          fi

          unformatted="$(gofmt -l $gofiles)"
          if [ -n "$unformatted" ]; then
            echo "Unformatted Go files:"
            echo "$unformatted"
            exit 1
          fi

      - name: Install staticcheck
        run: go install honnef.co/go/tools/cmd/staticcheck@v0.7.0

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4

      - name: Run staticcheck
        run: |
          "$(go env GOPATH)/bin/staticcheck" ./...

      - name: Run govulncheck
        run: |
          "$(go env GOPATH)/bin/govulncheck" ./...

  build-test:
    name: Build and Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    needs: metadata
    if: github.event_name != 'schedule'
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
    steps:
      - uses: actions/checkout@v5

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Build
        run: go build -v ./...

      - name: Test
        run: go test -v ./...

  race:
    name: Race Detector (Ubuntu)
    runs-on: ubuntu-latest
    needs: metadata
    if: github.event_name != 'schedule'
    steps:
      - uses: actions/checkout@v5

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Test with race detector
        run: go test -race ./...

  coverage:
    name: Coverage (Ubuntu)
    runs-on: ubuntu-latest
    needs: metadata
    if: github.event_name != 'schedule'
    steps:
      - uses: actions/checkout@v5

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Run coverage
        run: go test -covermode=atomic -coverprofile=coverage.out ./...

      - name: Summarize coverage
        id: coverage
        run: |
          coverage="$(go tool cover -func=coverage.out | awk '/^total:/ {sub(/%/, "", $3); print $3}')"
          echo "coverage=$coverage" >> "$GITHUB_OUTPUT"

          {
            echo "## Coverage"
            echo ""
            echo "- Total: ${coverage}%"
            echo "- Minimum: ${COVERAGE_MIN}%"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Enforce minimum coverage
        run: |
          coverage="${{ steps.coverage.outputs.coverage }}"
          minimum="${COVERAGE_MIN}"

          if ! awk "BEGIN { exit !($coverage >= $minimum) }"; then
            echo "Coverage ${coverage}% is below minimum ${minimum}%"
            exit 1
          fi

      - name: Upload coverage artifact
        uses: actions/upload-artifact@v6
        with:
          name: coverage-ubuntu
          path: coverage.out

  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v5

      - name: Review dependency changes
        uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: moderate

  secret-scan:
    name: Secret Detection
    runs-on: ubuntu-latest
    if: github.event_name != 'schedule'
    needs: metadata
    steps:
      - uses: actions/checkout@v5

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Install gitleaks
        run: go install github.com/zricethezav/gitleaks/v8@v8.30.1

      - name: Scan working tree
        run: |
          "$(go env GOPATH)/bin/gitleaks" dir . --redact

  codeql:
    name: CodeQL
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v5

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: go
          build-mode: manual

      - name: Build
        run: go build ./...

      - name: Analyze
        uses: github/codeql-action/analyze@v4

  release:
    name: Publish Release
    runs-on: ubuntu-latest
    environment:
      name: release
    needs:
      - metadata
      - quality
      - build-test
      - race
      - coverage
      - secret-scan
      - codeql
    if: needs.metadata.outputs.should_release == 'true'
    permissions:
      contents: write
      id-token: write
      attestations: write
      artifact-metadata: write
    steps:
      - uses: actions/checkout@v5

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Build archives and checksums
        run: ./scripts/build-release-artifacts.sh "${{ needs.metadata.outputs.version }}"

      - name: Smoke test release archives
        run: ./scripts/smoke-test-release-artifacts.sh "${{ needs.metadata.outputs.version }}"

      - name: Install cosign
        uses: sigstore/cosign-installer@v4.1.1

      - name: Install syft
        run: go install github.com/anchore/syft/cmd/syft@${SYFT_VERSION}

      - name: Generate per-archive SBOMs
        run: ./scripts/generate-release-sboms.sh "${{ needs.metadata.outputs.version }}"

      - name: Sign release archives and checksum file
        run: ./scripts/sign-release-assets.sh "${{ needs.metadata.outputs.version }}"

      - name: Attest release archive provenance
        uses: actions/attest@v4
        with:
          subject-checksums: dist/teams-cli_${{ needs.metadata.outputs.version }}_checksums.txt

      - name: Upload release bundle artifact
        uses: actions/upload-artifact@v6
        with:
          name: release-${{ needs.metadata.outputs.version }}
          path: |
            dist/*.tar.gz
            dist/*_checksums.txt
            dist/*_checksums.txt.sigstore.json
            dist/*_sboms.tar.gz

      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_VERSION: ${{ needs.metadata.outputs.version }}
        run: |
          args=()
          if [[ "${RELEASE_VERSION}" == *-* ]]; then
            args+=(--prerelease)
          fi

          if gh release view "${RELEASE_VERSION}" >/dev/null 2>&1; then
            echo "Reusing existing release ${RELEASE_VERSION}."
          else
            gh release create "${RELEASE_VERSION}" \
              --generate-notes \
              --target "${GITHUB_SHA}" \
              "${args[@]}"
          fi

          ./scripts/upload-release-assets.sh "${RELEASE_VERSION}"