release.yml

# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json

name: Release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      version:
        description: "Release version (e.g., v1.0.0)"
        required: true

# Permissions for SLSA provenance and releases
permissions:
  contents: write
  packages: write
  id-token: write

env:
  CARGO_TERM_COLOR: always

jobs:
  # Create GitHub release
  create-release:
    name: Create Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      upload_url: ${{ steps.create_release.outputs.upload_url }}
      version: ${{ steps.get_version.outputs.version }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Get version from tag
        id: get_version
        env:
          INPUT_VERSION: ${{ github.event.inputs.version }}
          REF_NAME: ${{ github.ref }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            echo "version=${INPUT_VERSION}" >> $GITHUB_OUTPUT
          else
            echo "version=${REF_NAME#refs/tags/}" >> $GITHUB_OUTPUT
          fi

      - name: Create Release
        id: create_release
        uses: step-security/action-gh-release@5f6a6ab53a5a2c000ff3a16fad038291e5b97ce7 # v2.4.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ steps.get_version.outputs.version }}
          name: Release ${{ steps.get_version.outputs.version }}
          draft: false
          prerelease: false

  # Build and publish documentation
  docs:
    name: Build Documentation
    needs: create-release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      CARGO_INCREMENTAL: 0
      RUSTFLAGS: "-C codegen-units=16 -C link-arg=-fuse-ld=mold"
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable

      - name: Install system dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq protobuf-compiler mold
          protoc --version
          mold --version

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
        with:
          shared-key: docs-4-core

      - name: Build documentation
        run: cargo doc --workspace --no-deps --all-features
        env:
          RUSTDOCFLAGS: -D warnings

      - name: Add index redirect
        run: |
          echo '<meta http-equiv="refresh" content="0; url=inferadb">' > target/doc/index.html

      - name: Upload documentation artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: documentation
          path: target/doc
          retention-days: 30

      - name: Compress documentation
        run: |
          cd target
          tar czf docs-${{ needs.create-release.outputs.version }}.tar.gz doc/

      - name: Upload docs to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload ${{ needs.create-release.outputs.version }} \
            target/docs-${{ needs.create-release.outputs.version }}.tar.gz

  # Build release binaries for multiple platforms
  build-release:
    name: Build Release (${{ matrix.target }})
    needs: create-release
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
      id-token: write
    strategy:
      matrix:
        include:
          # Linux x86_64
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            artifact_name: inferadb
            asset_name: inferadb-linux-x86_64

          # Linux ARM64
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            artifact_name: inferadb
            asset_name: inferadb-linux-aarch64

          # macOS x86_64
          - os: macos-latest
            target: x86_64-apple-darwin
            artifact_name: inferadb
            asset_name: inferadb-macos-x86_64

          # macOS ARM64 (Apple Silicon)
          - os: macos-latest
            target: aarch64-apple-darwin
            artifact_name: inferadb
            asset_name: inferadb-macos-aarch64

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable
          targets: ${{ matrix.target }}

      - name: Install system dependencies (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq protobuf-compiler mold
          protoc --version
          mold --version

      - name: Install protobuf compiler (macOS)
        if: runner.os == 'macOS'
        run: |
          brew install protobuf
          protoc --version

      - name: Install cross-compilation tools
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt-get install -y -qq gcc-aarch64-linux-gnu

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Configure build environment
        run: |
          echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
          echo "CARGO_INCREMENTAL=0" >> $GITHUB_ENV
          if [[ "${{ runner.os }}" == "Linux" ]]; then
            echo "RUSTFLAGS=-C codegen-units=16 -C link-arg=-fuse-ld=mold" >> $GITHUB_ENV
          elif [[ "${{ runner.os }}" == "macOS" ]]; then
            echo "RUSTFLAGS=-C codegen-units=16" >> $GITHUB_ENV
            echo "MACOSX_DEPLOYMENT_TARGET=11.0" >> $GITHUB_ENV
          fi

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
        with:
          shared-key: release-${{ matrix.os }}-${{ matrix.target }}

      - name: Build release binary
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
        run: cargo build --release --target ${{ matrix.target }}

      - name: Strip binary
        if: matrix.os != 'windows-latest'
        run: strip target/${{ matrix.target }}/release/${{ matrix.artifact_name }}

      - name: Generate SBOM
        run: |
          cargo install cargo-sbom
          cargo sbom --output-format spdx_json_2_3 > sbom-${{ matrix.target }}.spdx.json

      - name: Compress binary
        run: |
          cd target/${{ matrix.target }}/release
          tar czf ${{ matrix.asset_name }}.tar.gz ${{ matrix.artifact_name }}

      - name: Upload binary
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload ${{ needs.create-release.outputs.version }} \
            target/${{ matrix.target }}/release/${{ matrix.asset_name }}.tar.gz

      - name: Upload SBOM
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload ${{ needs.create-release.outputs.version }} \
            sbom-${{ matrix.target }}.spdx.json

      - name: Generate hash for provenance
        id: hash
        run: |
          cd target/${{ matrix.target }}/release
          echo "hash=$(sha256sum ${{ matrix.asset_name }}.tar.gz | awk '{print $1}')" >> $GITHUB_OUTPUT

  # Generate SLSA provenance
  provenance:
    name: Generate SLSA Provenance
    needs: [create-release, build-release]
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@a09dd8c05eda63cace134cb7dccd7e019f25e6f3 # v2.0.0
    with:
      base64-subjects: "${{ needs.build-release.outputs.hashes }}"
      upload-assets: true
      upload-tag-name: ${{ needs.create-release.outputs.version }}

  # Build and push Docker images to both Docker Hub and GitHub Container Registry
  build-docker:
    name: Build Docker Images
    needs: create-release
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      # Login to Docker Hub
      - name: Login to Docker Hub
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: |
            inferadb/inferadb
            ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest

      - name: Build and push
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          sbom: true # Generate SBOM
          provenance: mode=max # Generate SLSA provenance
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # Publish to crates.io (if desired)
  publish-crates:
    name: Publish to crates.io
    needs: [create-release, build-release]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    env:
      CARGO_INCREMENTAL: 0
      RUSTFLAGS: "-C codegen-units=16 -C link-arg=-fuse-ld=mold"
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable

      - name: Install system dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq protobuf-compiler mold
          protoc --version
          mold --version

      - name: Publish to crates.io
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: cargo publish --token ${CARGO_REGISTRY_TOKEN}
        continue-on-error: true # Don't fail if already published