release.yml

# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json

name: Release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      version:
        description: "Release version (e.g., v1.0.0)"
        required: true

# Permissions for SLSA provenance and releases
permissions:
  contents: write
  packages: write
  id-token: write

env:
  CARGO_TERM_COLOR: always

jobs:
  # Create GitHub release
  create-release:
    name: Create Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      upload_url: ${{ steps.create_release.outputs.upload_url }}
      version: ${{ steps.get_version.outputs.version }}
    steps:
      - name: Get version from tag
        id: get_version
        env:
          INPUT_VERSION: ${{ github.event.inputs.version }}
          REF_NAME: ${{ github.ref }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            echo "version=${INPUT_VERSION}" >> $GITHUB_OUTPUT
          else
            echo "version=${REF_NAME#refs/tags/}" >> $GITHUB_OUTPUT
          fi

      - name: Create Release
        id: create_release
        uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ steps.get_version.outputs.version }}
          name: Release ${{ steps.get_version.outputs.version }}
          draft: false
          prerelease: false

  # Build release binaries for multiple platforms
  build-release:
    name: Build Release (${{ matrix.target }})
    needs: create-release
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
      id-token: write
    strategy:
      matrix:
        include:
          # Linux x86_64
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            artifact_name: inferadb
            asset_name: inferadb-linux-x86_64

          # Linux ARM64
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            artifact_name: inferadb
            asset_name: inferadb-linux-aarch64

          # macOS x86_64
          - os: macos-latest
            target: x86_64-apple-darwin
            artifact_name: inferadb
            asset_name: inferadb-macos-x86_64

          # macOS ARM64 (Apple Silicon)
          - os: macos-latest
            target: aarch64-apple-darwin
            artifact_name: inferadb
            asset_name: inferadb-macos-aarch64

    steps:
      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable
          targets: ${{ matrix.target }}

      - name: Install cross-compilation tools
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu

      - name: Setup sccache
        uses: mozilla-actions/sccache-action

      - name: Configure sccache
        run: |
          echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
        with:
          shared-key: release-${{ matrix.target }}

      - name: Build release binary
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
        run: cargo build --release --target ${{ matrix.target }}

      - name: Strip binary
        if: matrix.os != 'windows-latest'
        run: strip target/${{ matrix.target }}/release/${{ matrix.artifact_name }}

      - name: Generate SBOM
        run: |
          cargo install cargo-sbom
          cargo sbom --output-format spdx_json_2_3 > sbom-${{ matrix.target }}.spdx.json

      - name: Compress binary
        run: |
          cd target/${{ matrix.target }}/release
          tar czf ${{ matrix.asset_name }}.tar.gz ${{ matrix.artifact_name }}

      - name: Upload binary
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload ${{ needs.create-release.outputs.version }} \
            target/${{ matrix.target }}/release/${{ matrix.asset_name }}.tar.gz

      - name: Upload SBOM
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload ${{ needs.create-release.outputs.version }} \
            sbom-${{ matrix.target }}.spdx.json

      - name: Generate hash for provenance
        id: hash
        run: |
          cd target/${{ matrix.target }}/release
          echo "hash=$(sha256sum ${{ matrix.asset_name }}.tar.gz | awk '{print $1}')" >> $GITHUB_OUTPUT

  # Generate SLSA provenance
  provenance:
    name: Generate SLSA Provenance
    needs: [create-release, build-release]
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f701310a334f5d712a8869541c8e19ecb4eefc24 # v2.0.0
    with:
      base64-subjects: "${{ needs.build-release.outputs.hashes }}"
      upload-assets: true
      upload-tag-name: ${{ needs.create-release.outputs.version }}

  # Build and push Docker images to both Docker Hub and GitHub Container Registry
  build-docker:
    name: Build Docker Images
    needs: create-release
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1

      # Login to Docker Hub
      - name: Login to Docker Hub
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
        with:
          images: |
            inferadb/inferadb
            ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest

      - name: Build and push
        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          sbom: true # Generate SBOM
          provenance: mode=max # Generate SLSA provenance
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # Publish to crates.io (if desired)
  publish-crates:
    name: Publish to crates.io
    needs: [create-release, build-release]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    steps:
      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable

      - name: Publish to crates.io
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: cargo publish --token ${CARGO_REGISTRY_TOKEN}
        continue-on-error: true # Don't fail if already published