release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:

permissions:
  contents: write
  packages: write
  id-token: write

jobs:
  release:
    name: Build and Release WASM Artifacts
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown
          components: rustfmt, clippy

      - name: Install wasm_opt (Binaryen)
        run: |
          sudo apt-get update
          sudo apt-get install -y binaryen

      - name: Build contracts
        run: |
          chmod +x scripts/build.sh
          ./scripts/build.sh

      - name: Prepare artifacts
        shell: bash
        run: |
          set -euo pipefail
          TAG="${GITHUB_REF_NAME}"
          mkdir -p dist artifacts
          shopt -s nullglob
          
          # Copy WASM files
          for wasm in target/wasm32-unknown-unknown/release/*.wasm; do
            base="$(basename "$wasm")"
            name="${base%.wasm}"
            cp "$wasm" "dist/$base"
          done
          for wasm in target/wasm32-unknown-unknown/release/*.optimized.wasm; do
            base="$(basename "$wasm")"
            cp "$wasm" "dist/$base"
          done
          
          # Generate checksums
          if compgen -G "dist/*" > /dev/null; then
            if command -v sha256sum >/dev/null 2>&1; then
              (cd dist && sha256sum * > SHA256SUMS.txt)
            else
              (cd dist && shasum -a 256 * > SHA256SUMS.txt)
            fi
          fi
          
          echo "Artifacts prepared in dist/"

      - name: Generate SBOM
        run: |
          set -euo pipefail
          # Install Syft for SBOM generation
          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
          syft version
          
          # Generate SBOM for the entire repository including build artifacts
          mkdir -p dist
          syft packages . -o spdx-json --file dist/sbom.spdx.json
          
          # Also generate SBOM for just the WASM artifacts
          if compgen -G "dist/*.wasm" > /dev/null; then
            syft packages dist/*.wasm -o spdx-json --file dist/sbom-wasm.spdx.json
          fi
          
          echo "SBOM generated successfully"
          ls -la dist/*.spdx.json

      - name: Upload CI Artifacts (structured)
        uses: actions/upload-artifact@v4
        with:
          name: wasm-artifacts-${{ github.ref_name }}
          path: |
            artifacts/**
            dist/**
          if-no-files-found: error

      - name: Generate changelog
        id: changelog
        shell: bash
        run: |
          set -euo pipefail
          TAG="${GITHUB_REF_NAME}"
          BODY=""
          
          if [ -f .git-cliff.toml ]; then
            if ! command -v git-cliff >/dev/null 2>&1; then
              cargo install git-cliff --locked
            fi
            BODY=$(git-cliff --tag "$TAG" --config .git-cliff.toml 2>/dev/null || echo "")
          fi
          
          if [ -z "$BODY" ]; then
            BODY="Release $TAG\n\nSee the attached artifacts for compiled WASM files and SBOM."
          fi
          
          echo "body<<EOF" >> "$GITHUB_OUTPUT"
          echo "$BODY" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          body: ${{ steps.changelog.outputs.body }}
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}
          files: |
            dist/*
            artifacts/**
          include_assets_pattern: |
            dist/*.wasm
            dist/*.spdx.json
            dist/*.sig
            dist/SHA256SUMS.txt
            artifacts/**

      - name: Set up Cosign
        if: ${{ secrets.COSIGN_PRIVATE_KEY != '' }}
        uses: sigstore/cosign-installer@v3.7.0

      - name: Sign artifacts with Cosign
        if: ${{ secrets.COSIGN_PRIVATE_KEY != '' }}
        env:
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
        run: |
          set -euo pipefail
          echo "Signing all release artifacts including SBOM..."
          
          # Sign WASM artifacts and checksums
          for f in $(find dist artifacts -type f ! -name "*.txt" ! -name "*.sig"); do
            echo "Signing: $f"
            cosign sign-blob --key cosign.key "$f" --output-signature "$f.sig"
          done
          
          # Sign SBOM files specifically
          for sbom in dist/*.spdx.json; do
            if [ -f "$sbom" ]; then
              echo "Signing SBOM: $sbom"
              cosign sign-blob --key cosign.key "$sbom" --output-signature "$sbom.sig"
            fi
          done
          
          # List all signed files
          echo "Signed files:"
          find dist artifacts -name "*.sig" -type f
          
          rm -f cosign.key