release.yml

name: release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  GO_VERSION: "1.26.5"
  GORELEASER_VERSION: "v2.17.0"
  SYFT_VERSION: "v1.49.0"
  COSIGN_VERSION: "v3.1.2"
  HUB_IMAGE: ghcr.io/ardurai/sith-hub

jobs:
  release:
    name: build · sign · attest · publish
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      id-token: write
      attestations: write
      packages: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Validate signed release tag and ancestry
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          release_kind="$(hack/release-tag-classify.sh "$GITHUB_REF_NAME")"
          git fetch --no-tags origin main
          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
            echo "::error::release tag must point to a commit reachable from main"
            exit 1
          fi
          if [ "$(git cat-file -t "$GITHUB_REF_NAME")" != "tag" ]; then
            echo "::error::release tag must be annotated"
            exit 1
          fi
          tag_object=$(git rev-parse "$GITHUB_REF_NAME^{tag}")
          if [ "$(gh api "repos/${GITHUB_REPOSITORY}/git/tags/${tag_object}" --jq '.verification.verified')" != "true" ]; then
            echo "::error::release tag must carry a signature verified by GitHub"
            exit 1
          fi
          echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
          echo "RELEASE_KIND=${release_kind}" >> "$GITHUB_ENV"

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
          check-latest: false
          cache: true
          cache-dependency-path: go.sum

      - name: Install pinned Syft
        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
        with:
          syft-version: ${{ env.SYFT_VERSION }}

      - name: Install pinned Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: ${{ env.COSIGN_VERSION }}

      - name: Download and verify modules
        run: |
          go mod download
          go mod verify

      - name: Build signed draft release
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          version: ${{ env.GORELEASER_VERSION }}
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Verify release assets and render Homebrew formula
        run: |
          go run ./tools/releasecheck verify --dist dist
          go run ./tools/releasecheck formula \
            --dist dist \
            --tag "$GITHUB_REF_NAME" \
            --output dist/sith.rb

      - name: Sign Homebrew formula
        run: cosign sign-blob --yes --bundle=dist/sith.rb.sigstore.json dist/sith.rb

      - name: Stage immutable hub image context
        env:
          IMAGE_CONTEXT: ${{ runner.temp }}/sith-hub-image
        run: |
          set -euo pipefail
          install -d "$IMAGE_CONTEXT/bin/linux/amd64" "$IMAGE_CONTEXT/bin/linux/arm64"
          tar -xzf "dist/sith_${VERSION}_linux_amd64.tar.gz" -C "$IMAGE_CONTEXT/bin/linux/amd64" sith
          tar -xzf "dist/sith_${VERSION}_linux_arm64.tar.gz" -C "$IMAGE_CONTEXT/bin/linux/arm64" sith
          install -m 0644 Containerfile "$IMAGE_CONTEXT/Containerfile"
          test -x "$IMAGE_CONTEXT/bin/linux/amd64/sith"
          test -x "$IMAGE_CONTEXT/bin/linux/arm64/sith"

      - name: Set up QEMU for hub image platforms
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - name: Set up Buildx for hub image platforms
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Authenticate to the GitHub Container Registry
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Guard hub image tag against overwrite
        env:
          HUB_TAG: ${{ env.HUB_IMAGE }}:${{ github.ref_name }}
        run: |
          set -euo pipefail
          if inspection="$(docker manifest inspect "$HUB_TAG" 2>&1)"; then
            echo "::error::hub image tag already exists; immutable release tags cannot be overwritten"
            exit 1
          fi
          case "$inspection" in
            *"manifest unknown"*|*"no such manifest"*) ;;
            *)
              echo "::error::could not establish whether the hub image tag exists"
              exit 1
              ;;
          esac

      - name: Publish immutable multi-platform hub image
        id: hub_image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: ${{ runner.temp }}/sith-hub-image
          file: ${{ runner.temp }}/sith-hub-image/Containerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ env.HUB_IMAGE }}:${{ github.ref_name }}
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
          provenance: false
          sbom: false

      - name: Sign and verify published hub image
        env:
          HUB_DIGEST: ${{ steps.hub_image.outputs.digest }}
        run: |
          set -euo pipefail
          test -n "$HUB_DIGEST"
          image="${HUB_IMAGE}@${HUB_DIGEST}"
          identity="https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release.yml@refs/tags/${GITHUB_REF_NAME}"
          cosign sign --yes "$image"
          cosign verify \
            --certificate-identity "$identity" \
            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
            "$image" >/dev/null
          printf '%s\n' "$image" > "dist/sith_${VERSION}_hub.image"
          cosign sign-blob --yes \
            --bundle="dist/sith_${VERSION}_hub.image.sigstore.json" \
            "dist/sith_${VERSION}_hub.image"

      - name: Generate hub image SPDX SBOM
        env:
          HUB_DIGEST: ${{ steps.hub_image.outputs.digest }}
        run: |
          set -euo pipefail
          test -n "$HUB_DIGEST"
          syft "${HUB_IMAGE}@${HUB_DIGEST}" \
            --output "spdx-json=dist/sith_${VERSION}_hub.spdx.json"

      - name: Attest hub image build provenance
        id: hub_provenance
        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
        with:
          subject-name: ${{ env.HUB_IMAGE }}
          subject-digest: ${{ steps.hub_image.outputs.digest }}
          push-to-registry: true

      - name: Attest hub image SBOM
        id: hub_sbom
        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
        with:
          subject-name: ${{ env.HUB_IMAGE }}
          subject-digest: ${{ steps.hub_image.outputs.digest }}
          sbom-path: dist/sith_${{ env.VERSION }}_hub.spdx.json
          push-to-registry: true

      - name: Verify public hub image distribution
        env:
          HUB_DIGEST: ${{ steps.hub_image.outputs.digest }}
        run: |
          set -euo pipefail
          test -n "$HUB_DIGEST"
          docker logout ghcr.io >/dev/null 2>&1 || true
          docker manifest inspect "${HUB_IMAGE}@${HUB_DIGEST}" >/dev/null

      - name: Generate SLSA build provenance
        id: provenance
        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
        with:
          subject-checksums: dist/checksums.txt

      - name: Attest darwin amd64 SBOM
        id: sbom_darwin_amd64
        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
        with:
          subject-path: dist/sith_${{ env.VERSION }}_darwin_amd64.tar.gz
          sbom-path: dist/sith_${{ env.VERSION }}_darwin_amd64.tar.gz.spdx.json

      - name: Attest darwin arm64 SBOM
        id: sbom_darwin_arm64
        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
        with:
          subject-path: dist/sith_${{ env.VERSION }}_darwin_arm64.tar.gz
          sbom-path: dist/sith_${{ env.VERSION }}_darwin_arm64.tar.gz.spdx.json

      - name: Attest linux amd64 SBOM
        id: sbom_linux_amd64
        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
        with:
          subject-path: dist/sith_${{ env.VERSION }}_linux_amd64.tar.gz
          sbom-path: dist/sith_${{ env.VERSION }}_linux_amd64.tar.gz.spdx.json

      - name: Attest linux arm64 SBOM
        id: sbom_linux_arm64
        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
        with:
          subject-path: dist/sith_${{ env.VERSION }}_linux_arm64.tar.gz
          sbom-path: dist/sith_${{ env.VERSION }}_linux_arm64.tar.gz.spdx.json

      - name: Attach attestations and Homebrew formula
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PROVENANCE_BUNDLE: ${{ steps.provenance.outputs.bundle-path }}
          SBOM_DARWIN_AMD64_BUNDLE: ${{ steps.sbom_darwin_amd64.outputs.bundle-path }}
          SBOM_DARWIN_ARM64_BUNDLE: ${{ steps.sbom_darwin_arm64.outputs.bundle-path }}
          SBOM_LINUX_AMD64_BUNDLE: ${{ steps.sbom_linux_amd64.outputs.bundle-path }}
          SBOM_LINUX_ARM64_BUNDLE: ${{ steps.sbom_linux_arm64.outputs.bundle-path }}
          HUB_PROVENANCE_BUNDLE: ${{ steps.hub_provenance.outputs.bundle-path }}
          HUB_SBOM_BUNDLE: ${{ steps.hub_sbom.outputs.bundle-path }}
        run: |
          set -euo pipefail
          install -m 0644 "$PROVENANCE_BUNDLE" "dist/sith_${VERSION}_provenance.sigstore.json"
          install -m 0644 "$SBOM_DARWIN_AMD64_BUNDLE" "dist/sith_${VERSION}_darwin_amd64.sbom.sigstore.json"
          install -m 0644 "$SBOM_DARWIN_ARM64_BUNDLE" "dist/sith_${VERSION}_darwin_arm64.sbom.sigstore.json"
          install -m 0644 "$SBOM_LINUX_AMD64_BUNDLE" "dist/sith_${VERSION}_linux_amd64.sbom.sigstore.json"
          install -m 0644 "$SBOM_LINUX_ARM64_BUNDLE" "dist/sith_${VERSION}_linux_arm64.sbom.sigstore.json"
          install -m 0644 "$HUB_PROVENANCE_BUNDLE" "dist/sith_${VERSION}_hub.provenance.sigstore.json"
          install -m 0644 "$HUB_SBOM_BUNDLE" "dist/sith_${VERSION}_hub.sbom.sigstore.json"
          gh release upload "$GITHUB_REF_NAME" \
            dist/sith.rb \
            dist/sith.rb.sigstore.json \
            "dist/sith_${VERSION}_hub.image" \
            "dist/sith_${VERSION}_hub.image.sigstore.json" \
            "dist/sith_${VERSION}_hub.spdx.json" \
            "dist/sith_${VERSION}_hub.provenance.sigstore.json" \
            "dist/sith_${VERSION}_hub.sbom.sigstore.json" \
            "dist/sith_${VERSION}_provenance.sigstore.json" \
            "dist/sith_${VERSION}_darwin_amd64.sbom.sigstore.json" \
            "dist/sith_${VERSION}_darwin_arm64.sbom.sigstore.json" \
            "dist/sith_${VERSION}_linux_amd64.sbom.sigstore.json" \
            "dist/sith_${VERSION}_linux_arm64.sbom.sigstore.json" \
            --clobber

      - name: Publish completed release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          if [[ "$RELEASE_KIND" == "beta" ]]; then
            release_id="$(gh release view "$GITHUB_REF_NAME" --json databaseId --jq '.databaseId')"
            gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${release_id}" \
              -F draft=false \
              -F prerelease=true \
              -f make_latest=false >/dev/null
          else
            gh release edit "$GITHUB_REF_NAME" --draft=false --latest
          fi