slsa-go-releaser.yml

# =============================================================================
# NFTBan v1.0.0 - SLSA Level 3 Go Builder
# =============================================================================
# SPDX-License-Identifier: MPL-2.0
# Purpose: Build Go binaries with SLSA Level 3 compliance and provenance
# Triggers: After Release Packages workflow completes OR manual dispatch
#
# This workflow uses OpenSSF's SLSA Go builder instead of manual go build.
# Benefits:
#   - Isolated, hermetic build environment
#   - Signed provenance (.intoto.jsonl files)
#   - Cryptographically verifiable artifacts
#   - SLSA Level 3 compliance (high security standard)
#
# Builds:
#   - nftban-core (main CLI for firewall operations)
#
# COORDINATION: This workflow runs AFTER Release Packages completes to avoid
# race conditions when uploading assets to the same GitHub release.
# =============================================================================

name: SLSA Go Releaser

on:
  # Run after Release Packages workflow completes (avoids race condition)
  workflow_run:
    workflows: ["Release Packages"]
    types: [completed]
  workflow_dispatch:
    inputs:
      version:
        description: 'Version tag (e.g., v1.0.0)'
        required: true
        default: 'v1.0.0'

concurrency:
  group: slsa-${{ github.ref }}
  cancel-in-progress: false

# Minimal top-level permissions (OpenSSF Scorecard compliance)
# Job-level permissions are set for each job that needs write access
permissions:
  contents: read
  actions: read

jobs:
  # ============================================================================
  # Job 0: Get release tag from triggering workflow
  # ============================================================================
  get-tag:
    name: Get Release Tag
    runs-on: ubuntu-latest
    # Only run if Release Packages succeeded (for workflow_run trigger)
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    outputs:
      tag: ${{ steps.get-tag.outputs.tag }}
    steps:
      - name: Get tag from event
        id: get-tag
        run: |
          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
            echo "tag=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
          else
            # workflow_run: get tag from the triggering workflow's head branch
            echo "tag=${{ github.event.workflow_run.head_branch }}" >> $GITHUB_OUTPUT
          fi
          echo "Resolved tag: $(cat $GITHUB_OUTPUT)"

  # ============================================================================
  # Job 1: Build nftban-core with SLSA provenance
  # ============================================================================
  build-nftban-core:
    name: Build nftban-core (SLSA3)
    needs: get-tag
    permissions:
      id-token: write
      contents: write
      actions: read
    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v2.1.0
    with:
      go-version: "1.25"
      # Config file specifies build parameters
      config-file: .github/slsa/nftban-core.yml
      evaluated-envs: "VERSION:${{ needs.get-tag.outputs.tag }}"
      # Upload provenance directly to release (fixes workflow_run trigger skip)
      upload-tag-name: ${{ needs.get-tag.outputs.tag }}

  # ============================================================================
  # Job 2: Assemble all artifacts and upload to release
  # ============================================================================
  assemble-release:
    name: Assemble Release Artifacts
    needs: [get-tag, build-nftban-core]
    runs-on: ubuntu-latest
    # Run for workflow_run (after Release Packages) but not for manual dispatch
    if: ${{ github.event_name == 'workflow_run' }}
    permissions:
      contents: write  # To upload release assets

    steps:
      - name: Download nftban-core artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ${{ needs.build-nftban-core.outputs.go-binary-name }}
          path: dist/

      - name: Download nftban-core provenance
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: ${{ needs.build-nftban-core.outputs.go-provenance-name }}
          path: dist/

      - name: List artifacts
        run: ls -la dist/

      # NOTE: SHA256SUMS not generated here - Release Packages workflow provides
      # complete checksums for all packages. SLSA provenance (.intoto.jsonl)
      # provides cryptographic verification for these binaries.

      - name: Upload to GitHub Release
        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
        with:
          tag_name: ${{ needs.get-tag.outputs.tag }}
          # Use single pattern to avoid duplicates (nftban-* matches .intoto.jsonl too)
          files: dist/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # v1.19.0: Verify SLSA provenance after build (R26)
      - name: Install SLSA Verifier
        run: |
          curl -sSfL https://github.com/slsa-framework/slsa-verifier/releases/download/v2.7.0/slsa-verifier-linux-amd64 \
            -o /usr/local/bin/slsa-verifier
          chmod +x /usr/local/bin/slsa-verifier

      - name: Verify SLSA Provenance
        run: |
          echo "Verifying SLSA provenance..."
          VERIFY_FAILED=0
          for binary in dist/nftban-*; do
            if [[ ! "$binary" =~ \.intoto\.jsonl$ ]] && [[ ! "$binary" =~ SHA256SUMS$ ]]; then
              provenance="${binary}.intoto.jsonl"
              if [ -f "$provenance" ]; then
                echo "Verifying $(basename "$binary")..."
                slsa-verifier verify-artifact "$binary" \
                  --provenance-path "$provenance" \
                  --source-uri github.com/itcmsgr/nftban || {
                    echo "::error::Provenance verification failed for $(basename "$binary")"
                    VERIFY_FAILED=1
                  }
              fi
            fi
          done
          if [[ "$VERIFY_FAILED" -ne 0 ]]; then
            echo "::error::One or more SLSA provenance verifications failed"
            exit 1
          fi

      - name: Generate SLSA Summary
        run: |
          echo "## SLSA Level 3 Build Complete" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Artifacts Built" >> $GITHUB_STEP_SUMMARY
          echo "| Binary | Architecture | Provenance |" >> $GITHUB_STEP_SUMMARY
          echo "|--------|--------------|------------|" >> $GITHUB_STEP_SUMMARY
          for f in dist/nftban-*; do
            if [[ ! "$f" =~ \.intoto\.jsonl$ ]] && [[ ! "$f" =~ SHA256SUMS$ ]]; then
              basename=$(basename "$f")
              provenance="${basename}.intoto.jsonl"
              if [ -f "dist/$provenance" ]; then
                echo "| $basename | linux | ✅ Signed |" >> $GITHUB_STEP_SUMMARY
              else
                echo "| $basename | linux | ❌ Missing |" >> $GITHUB_STEP_SUMMARY
              fi
            fi
          done
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Verification" >> $GITHUB_STEP_SUMMARY
          echo "Users can verify provenance using:" >> $GITHUB_STEP_SUMMARY
          echo '```bash' >> $GITHUB_STEP_SUMMARY
          echo 'slsa-verifier verify-artifact nftban-core-linux-amd64 \' >> $GITHUB_STEP_SUMMARY
          echo '  --provenance-path nftban-core-linux-amd64.intoto.jsonl \' >> $GITHUB_STEP_SUMMARY
          echo '  --source-uri github.com/itcmsgr/nftban' >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY