release-artifacts.yml

name: Release Binaries and Images
run-name: 'Release run by ${{ github.actor }}'

on:
  # Release unstable from HEAD on every merge
  push:
    branches:
      - main

  # Run manually to release unstable from HEAD
  workflow_dispatch:
    inputs:
      protect_ref:
        description: 'Commit/branch/tag'
        default: ''

  # Official stable versioned release
  release:
    types:
    - published

permissions:
  contents: read

jobs:
  oci:
    name: 'Build and publish ${{ matrix.component }} images'
    if: ${{ github.repository_owner == 'edera-dev' && (github.event_name == 'release' || github.event.pull_request.head.repo.full_name == github.repository) }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        component:
        - edera-check
    permissions:
      contents: read
      id-token: write
      packages: write

    steps:
    - name: 'Harden runner'
      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
      with:
        egress-policy: audit

    - name: 'Checkout repository'
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4.2.0
      with:
        submodules: recursive
        persist-credentials: false

    - name: 'Setup docker buildx'
      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      with:
        cache-binary: false

    - name: 'Login to ghcr'
      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
      with:
        registry: ghcr.io
        username: '${{ github.actor }}'
        password: '${{ github.token }}'

    - name: Docker meta
      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
      id: meta
      with:
        images: |
          ghcr.io/edera-dev/${{ matrix.component }}
        tags: |
          # Tag with branch on push
          type=ref,event=branch

          # Tag with short sha on all events
          type=sha,prefix=

          # Tag version and stable on tag push
          type=semver,pattern={{raw}}
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern=stable

          # Tag nightly on schedule event
          type=schedule,pattern=nightly

    - name: 'Docker build and push ${{ matrix.component }}'
      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
      id: push
      with:
        file: images/Containerfile.edera-check
        platforms: "linux/amd64,linux/arm64"
        tags: '${{ steps.meta.outputs.tags }}'
        cache-from: type=gha
        cache-to: type=gha,mode=max
        push: true

    - name: 'Install cosign'
      uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

    - name: 'Cosign sign all images'
      shell: bash
      run: |
        images=""
        for tag in ${TAGS}; do
          pullstring="${tag}@${DIGEST}"
          echo "Signing ${pullstring}"

          cosign sign --yes "${pullstring}"
        done
      env:
        TAGS: '${{ steps.meta.outputs.tags }}'
        DIGEST: '${{ steps.push.outputs.digest }}'

  upload-artifact:
    if: ${{ github.repository_owner == 'edera-dev' && (github.event_name == 'release' || github.event.pull_request.head.repo.full_name == github.repository) }}
    name: Publish Binaries to Release
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        platform:
          - { os: linux, arch: x86_64, libc: musl, static: true, on: ubuntu-latest }
          - { os: linux, arch: aarch64, libc: musl, static: true, on: ubuntu-24.04-arm }
        binary:
          - edera-check
    runs-on: '${{ matrix.platform.on }}'
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: 'Build and assemble ${{ matrix.binary }} ${{ matrix.platform.os }}-${{ matrix.platform.arch }}-${{ matrix.platform.libc }}'
        run: |
          set -e

          # Build configuration
          TARGET="${{ matrix.platform.arch }}-unknown-linux-${{ matrix.platform.libc }}"
          rustup target add "$TARGET"

          ${{ matrix.platform.static == true && 'export RUSTFLAGS="-Ctarget-feature=+crt-static"' || '' }}

          cargo build --release --target "$TARGET"

          # Platform name
          PLATFORM="${{ matrix.platform.os }}-${{ matrix.platform.arch }}-${{ matrix.platform.libc }}"

          # Tag name
          TAG="${{ github.event.release.tag_name }}"
          [ -z "$TAG" ] && TAG="${{ github.event.repository.default_branch }}"

          # Assemble asset
          mkdir -p target/assets
          BINARY="${{ matrix.binary }}"
          OUTPUT_NAME="${BINARY}_${TAG}_${PLATFORM}"

          cp "target/${TARGET}/release/${BINARY}" "target/assets/${OUTPUT_NAME}"

          cd target/assets
          if command -v sha256sum >/dev/null 2>&1; then
            sha256sum "${OUTPUT_NAME}" > "${OUTPUT_NAME}.sha256"
          else
            shasum -a 256 "${OUTPUT_NAME}" > "${OUTPUT_NAME}.sha256"
          fi

      - name: 'Upload ${{ matrix.binary }} to workflow run'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ matrix.binary }}-${{ matrix.platform.os }}-${{ matrix.platform.arch }}-${{ matrix.platform.libc }}
          path: target/assets/${{ matrix.binary }}_*

      - name: Generate cultivator token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: generate-token
        with:
          app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
          private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
          # Scope to what `gh release upload` needs: write release assets.
          permission-contents: write

      - name: 'Upload release artifacts with retry'
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
        with:
          timeout_minutes: 5
          max_attempts: 10
          retry_wait_seconds: 1
          command: |
            cd target/assets
            gh release upload "${{ github.event.release.tag_name }}" --clobber ./*
        env:
          GITHUB_TOKEN: "${{ steps.generate-token.outputs.token }}"