release.yml

name: Release

on:
  release:
    types: [created]

permissions:
  contents: write

jobs:
  build-linux:
    name: Build Linux binaries
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        arch: [amd64, arm64]
    steps:
    - name: Checkout code
      uses: actions/checkout@v7

    - name: Set up Go
      uses: actions/setup-go@v7
      with:
        go-version: '1.25.12'

    - name: Install cross-compilation tools
      if: matrix.arch == 'arm64'
      run: |
        sudo apt-get update
        sudo apt-get install -y gcc-aarch64-linux-gnu

    - name: Build package
      env:
        TAG: ${{ github.event.release.tag_name }}
      run: |
        if [ "${{ matrix.arch }}" = "arm64" ]; then
          export C_COMPILER=aarch64-linux-gnu-gcc
        else
          export C_COMPILER=gcc
        fi

        make build \
          VERSION="$TAG" \
          TARGET_GOOS=linux \
          TARGET_GOARCH=${{ matrix.arch }} \
          TARGET_DIR=dist/linux-${{ matrix.arch }} \
          C_COMPILER="$C_COMPILER"

    - name: Create release archive
      id: package
      run: |
        archive="wrapguard-${{ github.event.release.tag_name }}-linux-${{ matrix.arch }}.tar.gz"
        tar -C "dist/linux-${{ matrix.arch }}" -czf "$archive" \
          wrapguard libwrapguard.so \
          -C "$GITHUB_WORKSPACE" README.md example-wg0.conf
        echo "archive=$archive" >> "$GITHUB_OUTPUT"

    - name: Validate release archive
      run: |
        archive="${{ steps.package.outputs.archive }}"
        verify_dir="$(mktemp -d)"
        tar -xzf "$archive" -C "$verify_dir"
        test -x "$verify_dir/wrapguard"
        test -f "$verify_dir/libwrapguard.so"
        test -f "$verify_dir/README.md"
        test -f "$verify_dir/example-wg0.conf"
        if [ "${{ matrix.arch }}" = "amd64" ]; then
          "$verify_dir/wrapguard" --version
          "$verify_dir/wrapguard" --help
        else
          file "$verify_dir/wrapguard" | grep -qi "aarch64\\|arm64"
        fi

    - name: Generate checksum
      run: |
        archive="${{ steps.package.outputs.archive }}"
        sha256sum "$archive" > "$archive.sha256"

    - name: Upload release assets
      env:
        GH_TOKEN: ${{ github.token }}
        GH_REPO: ${{ github.repository }}
        TAG: ${{ github.event.release.tag_name }}
        ARCHIVE: ${{ steps.package.outputs.archive }}
      run: gh release upload "$TAG" "$ARCHIVE" "$ARCHIVE.sha256" --repo "$GH_REPO" --clobber

  build-macos:
    name: Build macOS binaries
    runs-on: macos-latest
    strategy:
      fail-fast: false
      matrix:
        arch: [amd64, arm64]
    steps:
    - name: Checkout code
      uses: actions/checkout@v7

    - name: Set up Go
      uses: actions/setup-go@v7
      with:
        go-version: '1.25.12'

    - name: Build package
      env:
        TAG: ${{ github.event.release.tag_name }}
      run: |
        make build \
          VERSION="$TAG" \
          TARGET_GOOS=darwin \
          TARGET_GOARCH=${{ matrix.arch }} \
          TARGET_DIR=dist/darwin-${{ matrix.arch }} \
          C_COMPILER=clang

    - name: Create release archive
      id: package
      run: |
        archive="wrapguard-${{ github.event.release.tag_name }}-darwin-${{ matrix.arch }}.tar.gz"
        tar -C "dist/darwin-${{ matrix.arch }}" -czf "$archive" \
          wrapguard libwrapguard.dylib \
          -C "$GITHUB_WORKSPACE" README.md example-wg0.conf
        echo "archive=$archive" >> "$GITHUB_OUTPUT"

    - name: Validate release archive
      run: |
        archive="${{ steps.package.outputs.archive }}"
        verify_dir="$(mktemp -d)"
        tar -xzf "$archive" -C "$verify_dir"
        test -x "$verify_dir/wrapguard"
        test -f "$verify_dir/libwrapguard.dylib"
        test -f "$verify_dir/README.md"
        test -f "$verify_dir/example-wg0.conf"
        if [ "${{ matrix.arch }}" = "arm64" ]; then
          file "$verify_dir/wrapguard" | grep -Eqi "aarch64|arm64"
        else
          file "$verify_dir/wrapguard" | grep -Eqi "x86[_-]64|x86-64"
        fi
        host_arch="$(uname -m)"
        if { [ "${{ matrix.arch }}" = "amd64" ] && [ "$host_arch" = "x86_64" ]; } ||
           { [ "${{ matrix.arch }}" = "arm64" ] && [ "$host_arch" = "arm64" ]; }; then
          "$verify_dir/wrapguard" --version
          "$verify_dir/wrapguard" --help
        fi

    - name: Generate checksum
      run: |
        archive="${{ steps.package.outputs.archive }}"
        shasum -a 256 "$archive" > "$archive.sha256"

    - name: Upload workflow artifact
      uses: actions/upload-artifact@v7
      with:
        name: wrapguard-macos-${{ matrix.arch }}
        path: |
          ${{ steps.package.outputs.archive }}
          ${{ steps.package.outputs.archive }}.sha256
        if-no-files-found: error

  verify-macos-release-archives:
    name: Verify macOS release archives
    needs: build-macos
    runs-on: macos-latest
    strategy:
      fail-fast: false
      matrix:
        arch: [amd64, arm64]
    steps:
    - name: Download packaged archive
      uses: actions/download-artifact@v8
      with:
        name: wrapguard-macos-${{ matrix.arch }}
        path: ${{ runner.temp }}/wrapguard-macos-${{ matrix.arch }}

    - name: Validate archive contents
      run: |
        artifact_dir="${{ runner.temp }}/wrapguard-macos-${{ matrix.arch }}"
        archive="wrapguard-${{ github.event.release.tag_name }}-darwin-${{ matrix.arch }}.tar.gz"
        archive_path="$artifact_dir/$archive"
        checksum_path="$archive_path.sha256"
        verify_dir="$(mktemp -d)"

        test -f "$archive_path"
        test -f "$checksum_path"

        expected_sum="$(awk '{print $1}' "$checksum_path")"
        actual_sum="$(shasum -a 256 "$archive_path" | awk '{print $1}')"
        test "$actual_sum" = "$expected_sum"

        tar -xzf "$archive_path" -C "$verify_dir"
        test -x "$verify_dir/wrapguard"
        test -f "$verify_dir/libwrapguard.dylib"
        test -f "$verify_dir/README.md"
        test -f "$verify_dir/example-wg0.conf"
        if [ "${{ matrix.arch }}" = "arm64" ]; then
          file "$verify_dir/wrapguard" | grep -Eqi "aarch64|arm64"
        else
          file "$verify_dir/wrapguard" | grep -Eqi "x86[_-]64|x86-64"
        fi
        host_arch="$(uname -m)"
        if { [ "${{ matrix.arch }}" = "amd64" ] && [ "$host_arch" = "x86_64" ]; } ||
           { [ "${{ matrix.arch }}" = "arm64" ] && [ "$host_arch" = "arm64" ]; }; then
          chmod +x "$verify_dir/wrapguard"
          "$verify_dir/wrapguard" --version
          "$verify_dir/wrapguard" --help
        fi

  publish-macos-release-assets:
    name: Publish macOS release assets
    needs: verify-macos-release-archives
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        arch: [amd64, arm64]
    steps:
    - name: Download packaged archive
      uses: actions/download-artifact@v8
      with:
        name: wrapguard-macos-${{ matrix.arch }}
        path: ${{ runner.temp }}/wrapguard-macos-${{ matrix.arch }}

    - name: Upload release assets
      env:
        GH_TOKEN: ${{ github.token }}
        GH_REPO: ${{ github.repository }}
        TAG: ${{ github.event.release.tag_name }}
        ARCHIVE: ${{ runner.temp }}/wrapguard-macos-${{ matrix.arch }}/wrapguard-${{ github.event.release.tag_name }}-darwin-${{ matrix.arch }}.tar.gz
      run: gh release upload "$TAG" "$ARCHIVE" "$ARCHIVE.sha256" --repo "$GH_REPO" --clobber