release-suite.yml

name: Release Suite

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:

permissions:
  contents: write
  id-token: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build-release:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            name: linux-x64
            artifact: eapps-linux-x64
          - os: windows-latest
            name: windows-x64
            artifact: eapps-windows-x64
          - os: macos-latest
            name: macos-arm64
            artifact: eapps-macos-arm64

    name: Build (${{ matrix.name }})
    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install dependencies (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libsdl2-dev

      - name: Install dependencies (macOS)
        if: runner.os == 'macOS'
        run: brew install sdl2

      - name: Configure (Unix)
        if: runner.os != 'Windows'
        run: cmake -B build -DCMAKE_BUILD_TYPE=Release

      - name: Configure (Windows)
        if: runner.os == 'Windows'
        run: cmake -B build

      - name: Build
        run: cmake --build build --config Release --parallel

      - name: Test
        run: |
          cmake -B build-test -DBUILD_TESTING=ON
          cmake --build build-test --config Release --parallel
          ctest --test-dir build-test --output-on-failure -C Release

      - name: Package (Linux)
        if: runner.os == 'Linux'
        run: |
          mkdir -p dist
          cp build/apps/suite/eapps_suite dist/ 2>/dev/null || true
          find build/apps -type f -executable -exec cp {} dist/ \; 2>/dev/null || true
          tar czf ${{ matrix.artifact }}.tar.gz -C dist .

      - name: Package (macOS)
        if: runner.os == 'macOS'
        run: |
          mkdir -p dist
          cp build/apps/suite/eapps_suite dist/ 2>/dev/null || true
          find build/apps -type f -perm +111 -exec cp {} dist/ \; 2>/dev/null || true
          tar czf ${{ matrix.artifact }}.tar.gz -C dist .

      - name: Package (Windows)
        if: runner.os == 'Windows'
        run: |
          New-Item -ItemType Directory -Force -Path dist
          Copy-Item build\Release\*.exe dist\ -ErrorAction SilentlyContinue
          Copy-Item build\apps\suite\Release\*.exe dist\ -ErrorAction SilentlyContinue
          Compress-Archive -Path dist\* -DestinationPath ${{ matrix.artifact }}.zip

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: |
            *.tar.gz
            *.zip

  create-release:
    name: Create GitHub Release
    needs: build-release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Extract version
        id: version
        run: |
          TAG=${GITHUB_REF#refs/tags/}
          echo "tag=$TAG" >> $GITHUB_OUTPUT
          echo "version=${TAG#v}" >> $GITHUB_OUTPUT

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: release-artifacts
          merge-multiple: true

      - name: Collect release files
        run: |
          mkdir -p release
          find release-artifacts -type f \( -name "*.tar.gz" -o -name "*.zip" \) -exec cp {} release/ \; 2>/dev/null || true

      - name: Generate SHA-256 checksums
        working-directory: release
        run: sha256sum * > SHA256SUMS.txt 2>/dev/null || true

      - name: Generate SBOM (CycloneDX v1.5)
        run: |
          TIMESTAMP=$(date -u +%Y-%m-%dT%H:%M:%SZ)
          UUID=$(cat /proc/sys/kernel/random/uuid 2>/dev/null || echo "00000000-0000-0000-0000-$(date +%s)")
          cat > release/sbom.cdx.json << EOF
          {
            "bomFormat": "CycloneDX",
            "specVersion": "1.5",
            "serialNumber": "urn:uuid:${UUID}",
            "version": 1,
            "metadata": {
              "timestamp": "${TIMESTAMP}",
              "component": {
                "type": "application",
                "name": "eApps",
                "version": "${{ steps.version.outputs.version }}",
                "supplier": { "name": "embeddedos-org" },
                "licenses": [{ "license": { "id": "MIT" } }]
              }
            },
            "components": [
              { "type": "framework", "name": "LVGL", "version": "9.1.0", "purl": "pkg:github/lvgl/lvgl@v9.1.0" },
              { "type": "library", "name": "SDL2", "version": "2.x", "purl": "pkg:generic/sdl2" }
            ]
          }
          EOF

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Sign release artifacts
        run: |
          cd release
          for f in *.tar.gz *.zip; do
            [ -f "$f" ] && cosign sign-blob --yes --bundle "${f}.sig.bundle" "$f" 2>/dev/null || true
          done

      - name: Check release does not already exist
        run: |
          if gh release view "${{ steps.version.outputs.tag }}" &>/dev/null; then
            echo "::error::Release ${{ steps.version.outputs.tag }} already exists."
            exit 1
          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.version.outputs.tag }}
          name: "eApps Suite ${{ steps.version.outputs.tag }}"
          generate_release_notes: true
          body: |
            ## eApps Suite ${{ steps.version.outputs.tag }}

            ### Release Integrity
            - `SHA256SUMS.txt` — file checksums
            - `sbom.cdx.json` — CycloneDX SBOM (v1.5)
            - `*.sig.bundle` — Sigstore cosign signatures
          files: release/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}