release-binaries.yml

name: Release Binaries

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag to build (e.g. v0.1.0)"
        required: true

permissions: {}

env:
  ARCHGATE_TELEMETRY: "0"

jobs:
  build:
    name: Build ${{ matrix.artifact }}
    timeout-minutes: 15
    permissions:
      contents: write
      id-token: write
      attestations: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: bun-darwin-arm64
            artifact: archgate-darwin-arm64
            os: macos-latest
            binary_name: archgate
          - target: bun-linux-x64
            artifact: archgate-linux-x64
            os: ubuntu-latest
            binary_name: archgate
          - target: bun-windows-x64
            artifact: archgate-win32-x64
            os: windows-latest
            binary_name: archgate.exe
    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ github.event.release.tag_name || inputs.tag }}

      - uses: moonrepo/setup-toolchain@261c62cb5b0f580c7be7c8cd0f023a2e96756095 # v0
        with:
          auto-install: true

      - run: bun install --frozen-lockfile

      - name: Validate (Unix)
        if: runner.os != 'Windows'
        run: bun run validate

      - name: Validate (Windows)
        if: runner.os == 'Windows'
        run: bun run lint && bun run typecheck && bun run format:check && bun run test

      - name: Build binary
        run: |
          bun build src/cli.ts --compile --bytecode --minify --target ${{ matrix.target }} --outfile dist/${{ matrix.artifact }}

      - name: Prepare release asset (Unix)
        if: runner.os != 'Windows'
        run: |
          cp dist/${{ matrix.artifact }} archgate
          tar -czf ${{ matrix.artifact }}.tar.gz archgate
          rm archgate
          shasum -a 256 ${{ matrix.artifact }}.tar.gz > ${{ matrix.artifact }}.tar.gz.sha256

      - name: Prepare release asset (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          Copy-Item "dist/${{ matrix.artifact }}.exe" "archgate.exe"
          Compress-Archive -Path "archgate.exe" -DestinationPath "${{ matrix.artifact }}.zip"
          Remove-Item "archgate.exe"
          (Get-FileHash "${{ matrix.artifact }}.zip" -Algorithm SHA256).Hash.ToLower() + "  ${{ matrix.artifact }}.zip" | Out-File -Encoding ascii "${{ matrix.artifact }}.zip.sha256"

      - name: Attest build provenance (Unix)
        if: runner.os != 'Windows'
        id: attest-unix
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4
        with:
          subject-path: ${{ matrix.artifact }}.tar.gz

      - name: Attest build provenance (Windows)
        if: runner.os == 'Windows'
        id: attest-win
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4
        with:
          subject-path: ${{ matrix.artifact }}.zip

      - name: Upload release asset (Unix)
        if: runner.os != 'Windows'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          TAG="${{ github.event.release.tag_name || inputs.tag }}"
          cp "${{ steps.attest-unix.outputs.bundle-path }}" "${{ matrix.artifact }}.tar.gz.sigstore.json"
          gh release upload "$TAG" \
            "${{ matrix.artifact }}.tar.gz" \
            "${{ matrix.artifact }}.tar.gz.sha256" \
            "${{ matrix.artifact }}.tar.gz.sigstore.json" \
            --clobber

      - name: Upload release asset (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          $tag = "${{ github.event.release.tag_name || inputs.tag }}"
          Copy-Item "${{ steps.attest-win.outputs.bundle-path }}" "${{ matrix.artifact }}.zip.sigstore.json"
          gh release upload $tag "${{ matrix.artifact }}.zip" "${{ matrix.artifact }}.zip.sha256" "${{ matrix.artifact }}.zip.sigstore.json" --clobber

      - name: Upload digest for SLSA provenance (Unix)
        if: runner.os != 'Windows'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: digest-${{ matrix.artifact }}
          path: ${{ matrix.artifact }}.tar.gz.sha256

      - name: Upload digest for SLSA provenance (Windows)
        if: runner.os == 'Windows'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: digest-${{ matrix.artifact }}
          path: ${{ matrix.artifact }}.zip.sha256

  combine-hashes:
    name: Combine hashes for provenance
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      digests: ${{ steps.combine.outputs.digests }}
    steps:
      - name: Download all digest artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: digest-*
          merge-multiple: true

      - name: Combine digests
        id: combine
        run: |
          echo "=== Individual digests ==="
          cat *.sha256
          echo ""
          DIGESTS=$(cat *.sha256 | tr -d '\r' | base64 -w0)
          echo "digests=$DIGESTS" >> "$GITHUB_OUTPUT"

  # SLSA provenance — generates .intoto.jsonl and uploads it to the release.
  provenance:
    name: SLSA provenance
    needs: combine-hashes
    permissions:
      actions: read
      id-token: write
      contents: write
    # SLSA reusable workflow MUST be referenced by tag, not SHA — the generator's
    # generate-builder.sh extracts the version from the ref to download the builder
    # binary from a GitHub release and rejects non-tag refs. See CI-001 exception
    # and slsa-framework/slsa-github-generator#150.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: "${{ needs.combine-hashes.outputs.digests }}"
      upload-assets: true
      upload-tag-name: ${{ github.event.release.tag_name || inputs.tag }}