release.yaml

name: release
permissions:
  contents: read

on:
  push:
    tags:
      - "v*.*.*"

jobs:
  build:
    name: Build
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        arch: [amd64, arm64]
        os: [linux, darwin, windows]
    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: GitHub vars
        uses: rlespinasse/github-slug-action@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "${{env.GO_VERSION}}"
        id: go

      - name: Build
        env:
          GOARCH: ${{matrix.arch}}
          GOOS: ${{matrix.os}}
        run: make build-cli

      - name: Tarball
        if: ${{ matrix.os != 'windows' }}
        run: |
          cd bin
          tar -czvf cordium-${{matrix.os}}-${{matrix.arch}}.tar.gz cordium

      - name: Generate checksums (Unix)
        if: ${{ matrix.os != 'windows' }}
        run: |
          cd bin
          sha256sum *.tar.gz > checksums-${{matrix.os}}-${{matrix.arch}}.txt

      - name: Save artifacts
        if: ${{ matrix.os != 'windows' }}
        uses: actions/upload-artifact@v4
        with:
          name: release-artifact-${{matrix.os}}-${{matrix.arch}}-${{ env.GITHUB_REF_SLUG }}
          path: |
            bin/*.tar.gz
            bin/checksums-${{matrix.os}}-${{matrix.arch}}.txt
          retention-days: 1

      - name: Zip for Windows
        if: ${{ matrix.os == 'windows' }}
        run: |
          cd bin
          zip cordium-${{matrix.os}}-${{matrix.arch}}.zip cordium.exe

      - name: Generate checksums (Windows)
        if: ${{ matrix.os == 'windows' }}
        run: |
          cd bin
          sha256sum *.zip > checksums-${{matrix.os}}-${{matrix.arch}}.txt

      - name: Save Windows artifacts
        if: ${{ matrix.os == 'windows' }}
        uses: actions/upload-artifact@v4
        with:
          name: release-artifact-${{matrix.os}}-${{matrix.arch}}-${{ env.GITHUB_REF_SLUG }}
          path: |
            bin/*.zip
            bin/checksums-${{matrix.os}}-${{matrix.arch}}.txt
          retention-days: 1

      - name: Save Windows binaries for MSI
        if: ${{ matrix.os == 'windows' }}
        uses: actions/upload-artifact@v4
        with:
          name: windows-binaries-${{matrix.arch}}-${{ env.GITHUB_REF_SLUG }}
          path: bin/*.exe
          retention-days: 1

  package-linux:
    name: Package Linux
    runs-on: ubuntu-24.04
    needs: build
    strategy:
      matrix:
        arch: [amd64, arm64]
    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: GitHub vars
        uses: rlespinasse/github-slug-action@v4

      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: release-artifact-linux-${{matrix.arch}}-${{ env.GITHUB_REF_SLUG }}
          path: artifacts

      - name: Extract binaries
        run: |
          mkdir -p bin
          cd artifacts
          tar -xzf cordium-linux-${{matrix.arch}}.tar.gz -C ../bin
          cd ..
          chmod +x bin/*

      - name: Install packaging tools
        run: |
          sudo apt-get update
          sudo apt-get install -y rpm

      - name: Get version
        id: version
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "release=1" >> $GITHUB_OUTPUT

      - name: Create DEB packages
        env:
          VERSION: ${{ steps.version.outputs.version }}
          RELEASE: ${{ steps.version.outputs.release }}
          ARCH: ${{ matrix.arch }}
        run: |
          DEB_ARCH=$ARCH
          if [ "$ARCH" = "amd64" ]; then
            DEB_ARCH="amd64"
          elif [ "$ARCH" = "arm64" ]; then
            DEB_ARCH="arm64"
          fi

          create_deb() {
            local PKG_NAME=$1
            local PKG_DIR="packaging/deb/${PKG_NAME}_${VERSION}-${RELEASE}_${DEB_ARCH}"
            
            mkdir -p ${PKG_DIR}/usr/bin
            mkdir -p ${PKG_DIR}/usr/share/doc/${PKG_NAME}
            mkdir -p ${PKG_DIR}/DEBIAN
            
            cp bin/${PKG_NAME} ${PKG_DIR}/usr/bin/
            cp LICENSE ${PKG_DIR}/usr/share/doc/${PKG_NAME}/copyright
            
            cat > ${PKG_DIR}/DEBIAN/control <<EOF
          Package: ${PKG_NAME}
          Version: ${VERSION}-${RELEASE}
          Section: net
          Priority: optional
          Architecture: ${DEB_ARCH}
          Maintainer: George Badawi <contact@octelium.com>
          Description: ${PKG_NAME} - A modern, free and open source, identity-based sandbox platform for humans and AI agents.
          Homepage: https://octelium.com
          License: Apache-2.0
          EOF
            
            dpkg-deb --build ${PKG_DIR}
            mv ${PKG_DIR}.deb packaging/
          }

          mkdir -p packaging/deb
          create_deb "cordium"

      - name: Create RPM packages
        env:
          VERSION: ${{ steps.version.outputs.version }}
          RELEASE: ${{ steps.version.outputs.release }}
          ARCH: ${{ matrix.arch }}
        run: |
          RPM_ARCH=$ARCH
          if [ "$ARCH" = "amd64" ]; then
            RPM_ARCH="x86_64"
          elif [ "$ARCH" = "arm64" ]; then
            RPM_ARCH="aarch64"
          fi

          create_rpm() {
            local PKG_NAME=$1
            local BASE_DIR="packaging/rpm/build/${PKG_NAME}"
            
            mkdir -p ${BASE_DIR}/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
            
            cp bin/${PKG_NAME} ${BASE_DIR}/SOURCES/
            cp LICENSE ${BASE_DIR}/SOURCES/LICENSE
            
            cat > ${BASE_DIR}/SPECS/${PKG_NAME}.spec <<EOF
          Name:           ${PKG_NAME}
          Version:        ${VERSION}
          Release:        ${RELEASE}%{?dist}
          Summary:        ${PKG_NAME} - A modern, open source, identity-based sandbox platform for humans and AI agents
          License:        Apache-2.0
          URL:            https://octelium.com
          Source0:        ${PKG_NAME}
          Source1:        LICENSE

          %define debug_package %{nil}
          %define __strip /bin/true

          %description
          A modern, free and open source, identity-based sandbox platform for humans and AI agents.

          %install
          mkdir -p %{buildroot}/usr/bin
          mkdir -p %{buildroot}/usr/share/licenses/${PKG_NAME}

          install -m 755 %{_sourcedir}/${PKG_NAME} %{buildroot}/usr/bin/${PKG_NAME}
          install -m 644 %{_sourcedir}/LICENSE %{buildroot}/usr/share/licenses/${PKG_NAME}/LICENSE

          %files
          %license /usr/share/licenses/${PKG_NAME}/LICENSE
          %dir /usr/share/licenses/${PKG_NAME}
          /usr/bin/${PKG_NAME}

          %changelog
          * $(date '+%a %b %d %Y') George Badawi <contact@octelium.com> - ${VERSION}-${RELEASE}
          - Release ${VERSION}-${RELEASE}
          EOF
            
            rpmbuild --target ${RPM_ARCH} \
              --define "_topdir $(pwd)/${BASE_DIR}" \
              --define "_rpmdir $(pwd)/packaging/rpm" \
              -bb ${BASE_DIR}/SPECS/${PKG_NAME}.spec
          }

          mkdir -p packaging/rpm
          create_rpm "cordium"

          # Move RPMs to flat structure
          find packaging/rpm -type f -name "*.rpm" -exec mv {} packaging/ \;

      - name: List created packages
        run: |
          echo "Contents of packaging directory:"
          ls -la packaging/

      - name: Upload DEB/RPM artifacts
        uses: actions/upload-artifact@v4
        with:
          name: packages-linux-${{matrix.arch}}-${{ env.GITHUB_REF_SLUG }}
          path: |
            packaging/*.deb
            packaging/*.rpm
          retention-days: 1

  package-windows:
    name: Package Windows
    runs-on: windows-2022
    needs: build
    strategy:
      matrix:
        arch: [amd64, arm64]
    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: GitHub vars
        uses: rlespinasse/github-slug-action@v4

      - name: Download binaries
        uses: actions/download-artifact@v4
        with:
          name: windows-binaries-${{matrix.arch}}-${{ env.GITHUB_REF_SLUG }}
          path: bin

      - name: Get version
        id: version
        shell: bash
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Install WiX Toolset
        run: |
          dotnet tool install --global wix --version 5.0.2
          wix --version

      - name: Create MSI for cordium
        shell: pwsh
        env:
          VERSION: ${{ steps.version.outputs.version }}
          ARCH: ${{ matrix.arch }}
        run: |
          .github/scripts/windows/build-msi.ps1 `
            -Version $env:VERSION `
            -Arch $env:ARCH

      - name: List created packages
        run: |
          Write-Host "Contents of packaging directory:"
          Get-ChildItem -Path packaging -Recurse

      - name: Upload MSI artifacts
        uses: actions/upload-artifact@v4
        with:
          name: packages-windows-${{matrix.arch}}-${{ env.GITHUB_REF_SLUG }}
          path: packaging/*.msi
          retention-days: 1

  package-macos:
    name: Package macOS
    runs-on: macos-14
    needs: build
    strategy:
      matrix:
        arch: [amd64, arm64]
    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: GitHub vars
        uses: rlespinasse/github-slug-action@v4

      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: release-artifact-darwin-${{matrix.arch}}-${{ env.GITHUB_REF_SLUG }}
          path: artifacts

      - name: Extract binaries
        run: |
          mkdir -p bin
          cd artifacts
          tar -xzf cordium-darwin-${{matrix.arch}}.tar.gz -C ../bin
          cd ..
          chmod +x bin/*

      - name: Make build script executable
        run: chmod +x .github/scripts/macos/build-pkg.sh

      - name: Get version
        id: version
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Create PKG for cordium
        env:
          VERSION: ${{ steps.version.outputs.version }}
          ARCH: ${{ matrix.arch }}
        run: |
          .github/scripts/macos/build-pkg.sh \
            --package-name cordium \
            --version $VERSION \
            --arch $ARCH

      - name: List created packages
        run: |
          echo "Contents of packaging directory:"
          ls -la packaging/

      - name: Upload PKG artifacts
        uses: actions/upload-artifact@v4
        with:
          name: packages-macos-${{matrix.arch}}-${{ env.GITHUB_REF_SLUG }}
          path: packaging/*.pkg
          retention-days: 1

  release:
    name: Release
    runs-on: ubuntu-24.04
    needs: [build, package-linux, package-macos, package-windows]
    permissions:
      contents: write
    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: GitHub vars
        uses: rlespinasse/github-slug-action@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: release-artifact-*
          path: artifacts

      - name: Download Linux packages
        uses: actions/download-artifact@v4
        with:
          pattern: packages-linux-*
          path: artifacts

      - name: Download macOS packages
        uses: actions/download-artifact@v4
        with:
          pattern: packages-macos-*
          path: artifacts

      - name: Download Windows packages
        uses: actions/download-artifact@v4
        with:
          pattern: packages-windows-*
          path: artifacts

      - name: Organize files for release
        run: |
          mkdir -p release-files

          # Copy all release artifacts (tarballs and zips)
          find artifacts -type f \( -name "*.tar.gz" -o -name "*.zip" \) -exec cp {} release-files/ \;

          # Copy all package files (avoiding duplicates by using -n flag)
          find artifacts -type f -name "*.deb" -exec cp -n {} release-files/ \;
          find artifacts -type f -name "*.rpm" -exec cp -n {} release-files/ \;
          find artifacts -type f -name "*.pkg" -exec cp -n {} release-files/ \;
          find artifacts -type f -name "*.msi" -exec cp -n {} release-files/ \;

          echo "=== Files prepared for release ==="
          ls -lh release-files/ | wc -l
          echo "files ready"

      - name: Generate checksums
        run: |
          cd release-files
          sha256sum * > ../SHA256SUMS
          cd ..

          echo "=== SHA256SUMS content ==="
          cat SHA256SUMS

          # Move SHA256SUMS to release-files
          mv SHA256SUMS release-files/

      - name: Generate and Download SBOM from GitHub
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "Fetching SBOM from GitHub Dependency Graph API..."
          gh api \
            -H "Accept: application/vnd.github+json" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            /repos/${{ github.repository }}/dependency-graph/sbom | jq -r '.sbom' > sbom.json
          mv sbom.json release-files/

      - name: Verify release files
        run: |
          echo "=== Final release file count ==="
          ls -1 release-files/ | wc -l
          echo ""
          echo "=== Release files ==="
          ls -lh release-files/

      - name: Release
        uses: softprops/action-gh-release@v2
        with:
          files: release-files/*
          fail_on_unmatched_files: true