release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to release (e.g., v0.1.0)'
        required: true
        type: string

# Ensure only one release runs at a time
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse

permissions:
  contents: write
  id-token: write      # Required for SLSA provenance
  attestations: write  # Required for artifact attestations

jobs:
  # Pre-flight checks before building release
  preflight:
    name: Pre-flight Checks
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: nightly
          components: rustfmt, clippy

      - name: Cache cargo
        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db  # v2

      - name: Verify formatting
        run: cargo fmt --all -- --check

      - name: Run clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

      - name: Run tests
        run: cargo test --all-features

      - name: Verify tag matches Cargo.toml version
        run: |
          CARGO_VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          if [ "$CARGO_VERSION" != "$TAG_VERSION" ]; then
            echo "Error: Tag version ($TAG_VERSION) does not match Cargo.toml version ($CARGO_VERSION)"
            exit 1
          fi
          echo "Version check passed: $CARGO_VERSION"

  build-release:
    name: Build (${{ matrix.name }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    needs: preflight
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux x64 (glibc)
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            archive: tar.gz
            name: linux_amd64
          # Linux x64 (musl, static)
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            archive: tar.gz
            name: linux_amd64_musl
            musl: true
          # Linux ARM64 (native runner - 10x faster than cross-compilation)
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-24.04-arm
            archive: tar.gz
            name: linux_arm64
          # macOS Intel
          - target: x86_64-apple-darwin
            os: macos-15
            archive: tar.gz
            name: darwin_amd64
          # macOS Apple Silicon (native)
          - target: aarch64-apple-darwin
            os: macos-14
            archive: tar.gz
            name: darwin_arm64
          # Windows x64
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            archive: zip
            name: windows_amd64

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
        with:
          fetch-depth: 0  # Full history for vergen

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: nightly
          targets: ${{ matrix.target }}

      - name: Install musl tools (Linux musl)
        if: matrix.musl
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools

      - name: Cache cargo
        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db  # v2
        with:
          key: release-${{ runner.os }}-${{ runner.arch }}-${{ matrix.target }}

      - name: Build release binary
        run: cargo build --release --target ${{ matrix.target }}
        env:
          VERGEN_GIT_SHA: ${{ github.sha }}
          VERGEN_GIT_BRANCH: ${{ github.ref_name }}

      - name: Verify binary runs (Unix, native)
        if: runner.os != 'Windows' && !matrix.musl
        run: ./target/${{ matrix.target }}/release/br --version

      - name: Verify binary runs (Windows)
        if: runner.os == 'Windows'
        run: ./target/${{ matrix.target }}/release/br.exe --version

      - name: Create archive (Unix)
        if: runner.os != 'Windows'
        run: |
          cd target/${{ matrix.target }}/release
          tar -czvf ../../../br-${{ github.ref_name }}-${{ matrix.name }}.tar.gz br
          cd ../../..

      - name: Create archive (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          cd target/${{ matrix.target }}/release
          Compress-Archive -Path br.exe -DestinationPath ../../../br-${{ github.ref_name }}-${{ matrix.name }}.zip
          cd ../../..

      - name: Install minisign (Linux)
        if: runner.os == 'Linux'
        run: |
          curl -sL https://github.com/jedisct1/minisign/releases/download/0.11/minisign-0.11-linux.tar.gz | tar xz
          sudo mv minisign-linux/x86_64/minisign /usr/local/bin/

      - name: Generate checksum (Linux)
        if: runner.os == 'Linux'
        run: |
          sha256sum br-${{ github.ref_name }}-${{ matrix.name }}.${{ matrix.archive }} > br-${{ github.ref_name }}-${{ matrix.name }}.${{ matrix.archive }}.sha256

      - name: Install minisign (macOS)
        if: runner.os == 'macOS'
        run: |
          brew install minisign

      - name: Generate checksum (macOS)
        if: runner.os == 'macOS'
        run: |
          shasum -a 256 br-${{ github.ref_name }}-${{ matrix.name }}.${{ matrix.archive }} > br-${{ github.ref_name }}-${{ matrix.name }}.${{ matrix.archive }}.sha256

      - name: Generate checksum (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $hash = (Get-FileHash -Path "br-${{ github.ref_name }}-${{ matrix.name }}.${{ matrix.archive }}" -Algorithm SHA256).Hash.ToLower()
          "$hash  br-${{ github.ref_name }}-${{ matrix.name }}.${{ matrix.archive }}" | Out-File -FilePath "br-${{ github.ref_name }}-${{ matrix.name }}.${{ matrix.archive }}.sha256" -Encoding utf8 -NoNewline

      - name: Verify checksum (Linux)
        if: runner.os == 'Linux'
        run: sha256sum -c br-${{ github.ref_name }}-${{ matrix.name }}.${{ matrix.archive }}.sha256

      - name: Verify checksum (macOS)
        if: runner.os == 'macOS'
        run: shasum -a 256 -c br-${{ github.ref_name }}-${{ matrix.name }}.${{ matrix.archive }}.sha256

      - name: Sign archive with Ed25519 (Linux/macOS)
        if: runner.os != 'Windows' && env.MINISIGN_SECRET_KEY != ''
        env:
          MINISIGN_SECRET_KEY: ${{ secrets.MINISIGN_SECRET_KEY }}
        run: |
          echo "$MINISIGN_SECRET_KEY" > /tmp/minisign.key
          minisign -Sm br-${{ github.ref_name }}-${{ matrix.name }}.${{ matrix.archive }} -s /tmp/minisign.key -t "br ${{ github.ref_name }} ${{ matrix.name }}"
          rm -f /tmp/minisign.key

      - name: Upload artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
        with:
          name: br-${{ matrix.name }}
          path: |
            br-${{ github.ref_name }}-${{ matrix.name }}.${{ matrix.archive }}
            br-${{ github.ref_name }}-${{ matrix.name }}.${{ matrix.archive }}.sha256
            br-${{ github.ref_name }}-${{ matrix.name }}.${{ matrix.archive }}.minisig
          retention-days: 7

  create-release:
    name: Create Release
    needs: build-release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
        with:
          fetch-depth: 0

      - name: Download all artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
        with:
          path: artifacts
          merge-multiple: true

      - name: List artifacts
        run: ls -la artifacts/

      - name: Generate combined checksums
        run: |
          cd artifacts
          cat *.sha256 | sort > checksums.sha256
          echo "=== Combined checksums ==="
          cat checksums.sha256

      - name: Verify all checksums
        run: |
          cd artifacts
          echo "=== Verifying all checksums ==="
          for checksum_file in *.sha256; do
            if [ "$checksum_file" != "checksums.sha256" ]; then
              echo "Verifying $checksum_file..."
              sha256sum -c "$checksum_file" || echo "Skipping non-Unix checksum"
            fi
          done

      - name: Generate changelog
        id: changelog
        run: |
          # Get the previous tag
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")

          if [ -n "$PREV_TAG" ]; then
            echo "Generating changelog from $PREV_TAG to ${{ github.ref_name }}"
            COMMITS=$(git log --pretty=format:"- %s (%h)" $PREV_TAG..HEAD)
            PREV_TAG_DATE=$(git log -1 --format=%ci "$PREV_TAG" 2>/dev/null | cut -d' ' -f1 || echo "")
          else
            echo "No previous tag found, generating changelog from start"
            COMMITS=$(git log --pretty=format:"- %s (%h)" HEAD~20..HEAD 2>/dev/null || git log --pretty=format:"- %s (%h)")
            PREV_TAG_DATE=""
          fi

          # Extract closed beads from JSONL since last release
          BEADS_SECTION=""
          if [ -f ".beads/issues.jsonl" ]; then
            echo "Extracting closed beads from issues.jsonl..."
            # Filter beads closed after the previous tag date
            if [ -n "$PREV_TAG_DATE" ]; then
              CLOSED_BEADS=$(cat .beads/issues.jsonl | jq -r --arg date "$PREV_TAG_DATE" \
                'select(.status == "closed" and (.closed_at // .updated_at) > $date) | "- \(.id): \(.title)"' 2>/dev/null | head -50 || echo "")
            else
              CLOSED_BEADS=$(cat .beads/issues.jsonl | jq -r \
                'select(.status == "closed") | "- \(.id): \(.title)"' 2>/dev/null | tail -20 || echo "")
            fi
            if [ -n "$CLOSED_BEADS" ]; then
              BEADS_SECTION="### Closed Beads

          $CLOSED_BEADS

          "
            fi
          fi

          # Create changelog file
          cat << EOF > CHANGELOG.md
          ## What's Changed

          ${BEADS_SECTION}### Commits

          EOF
          echo "$COMMITS" >> CHANGELOG.md
          cat << 'EOF' >> CHANGELOG.md

          ## Platforms

          | Platform | Architecture | File |
          |----------|--------------|------|
          | Linux | x86_64 (glibc) | `br-${{ github.ref_name }}-linux_amd64.tar.gz` |
          | Linux | x86_64 (musl, static) | `br-${{ github.ref_name }}-linux_amd64_musl.tar.gz` |
          | Linux | ARM64 | `br-${{ github.ref_name }}-linux_arm64.tar.gz` |
          | macOS | x86_64 (Intel) | `br-${{ github.ref_name }}-darwin_amd64.tar.gz` |
          | macOS | ARM64 (Apple Silicon) | `br-${{ github.ref_name }}-darwin_arm64.tar.gz` |
          | Windows | x86_64 | `br-${{ github.ref_name }}-windows_amd64.zip` |

          ## Installation

          ### Quick Install (Recommended)

          ```bash
          curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/beads_rust/main/install.sh | bash
          ```

          ### Cargo Install

          ```bash
          cargo install --git https://github.com/Dicklesworthstone/beads_rust.git --tag ${{ github.ref_name }}
          ```

          ### Manual Download

          Download the appropriate binary for your platform from the assets below.

          **Verify checksum:**

          ```bash
          # Download checksums.sha256 and your binary
          sha256sum -c checksums.sha256 --ignore-missing
          ```

          **Verify signature (optional):**

          Binaries are signed with Ed25519 using minisign. Install minisign and verify:

          ```bash
          # Download the .minisig file for your binary
          # Public key: RWSp4vEOdKsY8e95W9/4eLrSJ2B2GHv4U+CKMBXqRX3JhPrPn8J0DWBG
          minisign -Vm br-${{ github.ref_name }}-*.tar.gz -P RWSp4vEOdKsY8e95W9/4eLrSJ2B2GHv4U+CKMBXqRX3JhPrPn8J0DWBG
          ```

          ## Full Changelog

          See [CHANGELOG.md](https://github.com/Dicklesworthstone/beads_rust/blob/main/CHANGELOG.md) for the complete history.
          EOF

          echo "=== Generated changelog ==="
          cat CHANGELOG.md

      - name: Generate SBOM (CycloneDX)
        run: |
          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
          syft dir:. -o cyclonedx-json > artifacts/sbom.cdx.json
          syft dir:. -o spdx-json > artifacts/sbom.spdx.json

      - name: Create GitHub Release
        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b  # v2
        with:
          name: br ${{ github.ref_name }}
          body_path: CHANGELOG.md
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}
          files: |
            artifacts/br-${{ github.ref_name }}-*.tar.gz
            artifacts/br-${{ github.ref_name }}-*.zip
            artifacts/br-${{ github.ref_name }}-*.sha256
            artifacts/br-${{ github.ref_name }}-*.minisig
            artifacts/checksums.sha256
            artifacts/sbom.cdx.json
            artifacts/sbom.spdx.json
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate SLSA provenance attestations
        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018  # v2
        with:
          subject-path: |
            artifacts/br-${{ github.ref_name }}-*.tar.gz
            artifacts/br-${{ github.ref_name }}-*.zip

  update-crates-io:
    name: Publish to crates.io
    needs: create-release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: "!contains(github.ref_name, '-')"  # Skip pre-releases
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: nightly

      - name: Publish to crates.io
        run: cargo publish --token ${{ secrets.CRATES_IO_TOKEN }}
        continue-on-error: true  # Don't fail release if crates.io publish fails