release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to release (e.g., v0.1.7)'
        required: true

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

permissions:
  contents: write
  id-token: write
  packages: write
  attestations: write

env:
  CARGO_TERM_COLOR: always

jobs:
  validate:
    name: Pre-Release Validation
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.get_tag.outputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libtss2-dev libsqlite3-dev libxcb1-dev

      - name: Get and validate tag
        id: get_tag
        run: |
          if [ -n "${{ github.event.inputs.tag }}" ]; then
            TAG="${{ github.event.inputs.tag }}"
          else
            TAG="${{ github.ref_name }}"
          fi
          echo "tag=$TAG" >> $GITHUB_OUTPUT
          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
            echo "Invalid tag format: $TAG"
            echo "Expected format: vX.Y.Z or vX.Y.Z-suffix"
            exit 1
          fi
          echo "Tag format valid: $TAG"

      - name: Run tests
        run: cargo test --all-features

      - name: Run clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

  build:
    name: Build (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    needs: validate
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            ext: ''
          - target: x86_64-apple-darwin
            os: macos-latest
            ext: ''
          - target: aarch64-apple-darwin
            os: macos-14
            ext: ''
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            ext: '.exe'
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install system dependencies (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libsqlite3-dev libtss2-dev

      - name: Build CLI
        run: cargo build --release --target ${{ matrix.target }}

      - name: Create archive (Unix)
        if: runner.os != 'Windows'
        run: |
          VERSION="${{ needs.validate.outputs.tag }}"
          ARCHIVE="witnessd_${VERSION}_${{ matrix.target }}.tar.gz"
          tar -czvf "$ARCHIVE" \
            -C target/${{ matrix.target }}/release \
            witnessd-cli${{ matrix.ext }}
          echo "ARCHIVE=$ARCHIVE" >> $GITHUB_ENV

      - name: Create archive (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $VERSION = "${{ needs.validate.outputs.tag }}"
          $ARCHIVE = "witnessd_${VERSION}_${{ matrix.target }}.zip"
          Compress-Archive -Path "target/${{ matrix.target }}/release/witnessd-cli${{ matrix.ext }}" -DestinationPath $ARCHIVE
          echo "ARCHIVE=$ARCHIVE" >> $env:GITHUB_ENV

      - name: Generate hash
        id: hash
        shell: bash
        run: |
          if [[ "$RUNNER_OS" == "macOS" ]]; then
            shasum -a 256 "${{ env.ARCHIVE }}" | base64 > hash.txt
          else
            sha256sum "${{ env.ARCHIVE }}" | base64 -w0 > hash.txt
          fi
          echo "hashes=$(cat hash.txt)" >> "$GITHUB_OUTPUT"

      - name: Upload artifact
        uses: actions/upload-artifact@v6
        with:
          name: binary-${{ matrix.target }}
          path: ${{ env.ARCHIVE }}
          retention-days: 7

      - name: Attest Build Provenance
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: ${{ env.ARCHIVE }}

  aggregate-hashes:
    name: Aggregate Artifact Hashes
    runs-on: ubuntu-latest
    needs: build
    outputs:
      hashes: ${{ steps.aggregate.outputs.hashes }}
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          pattern: binary-*
          merge-multiple: true

      - name: Generate combined hashes
        id: aggregate
        run: |
          cd artifacts
          sha256sum * | base64 -w0 > ../hashes.txt
          echo "hashes=$(cat ../hashes.txt)" >> "$GITHUB_OUTPUT"

  slsa-provenance:
    name: SLSA Provenance
    needs: aggregate-hashes
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: "${{ needs.aggregate-hashes.outputs.hashes }}"
      upload-assets: false

  sbom:
    name: Generate SBOM
    runs-on: ubuntu-latest
    needs: validate
    steps:
      - uses: actions/checkout@v4

      - name: Install Syft
        run: |
          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

      - name: Generate SPDX SBOM
        run: syft dir:. -o spdx-json=witnessd-cli-sbom.spdx.json

      - name: Generate CycloneDX SBOM
        run: syft dir:. -o cyclonedx-json=witnessd-cli-sbom.cdx.json

      - name: Upload SBOMs
        uses: actions/upload-artifact@v6
        with:
          name: sbom
          path: |
            witnessd-cli-sbom.spdx.json
            witnessd-cli-sbom.cdx.json

  release:
    name: Create Release
    runs-on: ubuntu-latest
    needs: [validate, build, slsa-provenance, sbom]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Download SLSA provenance
        uses: actions/download-artifact@v4
        with:
          name: ${{ needs.slsa-provenance.outputs.provenance-name }}
          path: artifacts

      - name: Generate checksums
        run: |
          cd artifacts
          sha256sum *.tar.gz *.zip 2>/dev/null > checksums.txt || true
          cat checksums.txt

      - name: Get previous tag
        id: prev_tag
        run: |
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
          echo "prev_tag=$PREV_TAG" >> $GITHUB_OUTPUT

      - name: Generate changelog
        id: changelog
        run: |
          if [ -n "${{ steps.prev_tag.outputs.prev_tag }}" ]; then
            CHANGELOG=$(git log --pretty=format:"- %s" ${{ steps.prev_tag.outputs.prev_tag }}..HEAD)
          else
            CHANGELOG="Initial release"
          fi
          echo "changelog<<EOF" >> $GITHUB_OUTPUT
          echo "$CHANGELOG" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          name: witnessd ${{ needs.validate.outputs.tag }}
          draft: false
          prerelease: ${{ contains(needs.validate.outputs.tag, '-') }}
          files: |
            artifacts/*.tar.gz
            artifacts/*.zip
            artifacts/checksums.txt
            artifacts/witnessd-cli-sbom.spdx.json
            artifacts/witnessd-cli-sbom.cdx.json
            artifacts/*.intoto.jsonl
          body: |
            ## witnessd ${{ needs.validate.outputs.tag }}

            Cryptographic Authorship Witnessing - CLI

            ### Downloads

            | Platform | Architecture | Download |
            |----------|--------------|----------|
            | Linux | x86_64 | [tar.gz](https://github.com/writerslogic/witnessd-cli/releases/download/${{ needs.validate.outputs.tag }}/witnessd_${{ needs.validate.outputs.tag }}_x86_64-unknown-linux-gnu.tar.gz) |
            | macOS | x86_64 | [tar.gz](https://github.com/writerslogic/witnessd-cli/releases/download/${{ needs.validate.outputs.tag }}/witnessd_${{ needs.validate.outputs.tag }}_x86_64-apple-darwin.tar.gz) |
            | macOS | aarch64 (Apple Silicon) | [tar.gz](https://github.com/writerslogic/witnessd-cli/releases/download/${{ needs.validate.outputs.tag }}/witnessd_${{ needs.validate.outputs.tag }}_aarch64-apple-darwin.tar.gz) |
            | Windows | x86_64 | [zip](https://github.com/writerslogic/witnessd-cli/releases/download/${{ needs.validate.outputs.tag }}/witnessd_${{ needs.validate.outputs.tag }}_x86_64-pc-windows-msvc.zip) |

            ### Verification

            All release artifacts include:
            - SHA256 checksums (`checksums.txt`)
            - SLSA Level 3 provenance attestations
            - SBOM (SPDX and CycloneDX formats)

            ```bash
            # Verify checksum
            sha256sum -c checksums.txt

            # Verify SLSA provenance
            slsa-verifier verify-artifact witnessd_${{ needs.validate.outputs.tag }}_x86_64-unknown-linux-gnu.tar.gz \
              --provenance-path multiple.intoto.jsonl \
              --source-uri github.com/writerslogic/witnessd-cli
            ```

            ### Changelog
            ${{ steps.changelog.outputs.changelog }}

            ---
            **Full Changelog**: https://github.com/writerslogic/witnessd-cli/compare/${{ steps.prev_tag.outputs.prev_tag }}...${{ needs.validate.outputs.tag }}