release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  attestations: write
  contents: write
  id-token: write

env:
  BINARY_NAME: cyphergoat

jobs:
  test:
    name: Run tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.25'
          cache: true

      - name: Run tests
        run: go test ./... -v -race

  build:
    name: Build binaries
    needs: test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64
          - goos: darwin
            goarch: amd64
          - goos: darwin
            goarch: arm64
          - goos: windows
            goarch: amd64
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.25'
          cache: true

      - name: Get version info
        id: version
        run: |
          TAG=${GITHUB_REF#refs/tags/}
          echo "version=$TAG" >> $GITHUB_OUTPUT
          echo "commit=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
          echo "date=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_OUTPUT

      - name: Build binary
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: 0
        run: |
          EXTENSION=""
          if [ "${{ matrix.goos }}" = "windows" ]; then
            EXTENSION=".exe"
          fi

          OUTPUT_NAME="${{ env.BINARY_NAME }}-${{ matrix.goos }}-${{ matrix.goarch }}${EXTENSION}"
          MODULE="github.com/moralpriest/cyphergoat-cli/cmd"

          go build -ldflags="-s -w \
            -X ${MODULE}.version=${{ steps.version.outputs.version }} \
            -X ${MODULE}.commit=${{ steps.version.outputs.commit }} \
            -X ${MODULE}.date=${{ steps.version.outputs.date }}" \
            -o "${OUTPUT_NAME}" .

          echo "Built: ${OUTPUT_NAME}"

      - name: Upload binary artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-${{ matrix.goos }}-${{ matrix.goarch }}
          path: ${{ env.BINARY_NAME }}-*

  source:
    name: Create source tarball
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get version info
        id: version
        run: |
          TAG=${GITHUB_REF#refs/tags/}
          echo "version=$TAG" >> $GITHUB_OUTPUT

      - name: Create source tarball
        run: |
          git archive -o ${{ env.BINARY_NAME }}-${{ steps.version.outputs.version }}.tar.gz \
            --prefix=${{ env.BINARY_NAME }}-${{ steps.version.outputs.version }}/ HEAD

      - name: Upload source tarball
        uses: actions/upload-artifact@v4
        with:
          name: source-tarball
          path: ${{ env.BINARY_NAME }}-*.tar.gz

  release:
    name: Create GitHub release
    needs: [build, source]
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Prepare release assets
        run: |
          mkdir -p release

          # Move all binaries to release folder
          find artifacts -type f -name "${{ env.BINARY_NAME }}-*" -exec mv {} release/ \;

          echo "Release assets:"
          ls -la release/

      - name: Create checksums
        working-directory: release
        run: |
          sha256sum * > checksums.txt
          echo "Checksums:"
          cat checksums.txt

      - name: Generate GitHub artifact attestation
        uses: actions/attest-build-provenance@v3
        with:
          subject-path: 'release/cyphergoat-linux-amd64'

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          files: release/*
          generate_release_notes: true
          draft: false
          prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'alpha') || contains(github.ref, 'rc') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Sign checksums with self-signed key
        env:
          COSIGN_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
        working-directory: release
        run: |
          echo "$COSIGN_KEY" > cosign.key
          cosign sign-blob -y --key cosign.key checksums.txt \
            --output-signature checksums.txt.sig \
            --output-certificate checksums.txt.crt
          rm cosign.key

      - name: Upload signature to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload ${{ github.ref_name }} release/checksums.txt.sig --repo ${{ github.repository }}

  verify:
    name: Verify release
    needs: release
    runs-on: ubuntu-latest
    steps:
      - name: Get release tag
        id: tag
        run: echo "tag=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT

      - name: Download release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release download ${{ steps.tag.outputs.tag }} \
            --repo ${{ github.repository }} \
            --dir downloaded

      - name: Verify checksums
        working-directory: downloaded
        run: |
          echo "Downloaded files:"
          ls -la
          echo ""
          echo "Verifying checksums..."
          sha256sum -c checksums.txt

      - name: Show release info
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "Release created successfully!"
          echo "Tag: ${{ steps.tag.outputs.tag }}"
          echo ""
          echo "Assets:"
          gh release view ${{ steps.tag.outputs.tag }} \
            --repo ${{ github.repository }} \
            --json assets -q '.assets[].name'