publish.yml

name: Publish

on:
  workflow_run:
    workflows: ["CI"]
    types: [completed]
    branches: [main]
  workflow_dispatch:
    inputs:
      version:
        description: "Version to build binaries for (e.g., 0.3.0). Must match Cargo.toml."
        required: false
        type: string
      skip_crates:
        description: "Skip publishing to crates.io"
        required: false
        default: true
        type: boolean

permissions:
  contents: write
  id-token: write # Required for SLSA provenance
  attestations: write # Required for SLSA provenance

jobs:
  publish:
    name: Prepare release and crates publish
    runs-on: ubuntu-latest
    environment: default
    if: >
      (github.event_name == 'workflow_run' &&
       github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.event == 'push' &&
       github.event.workflow_run.head_branch == 'main') ||
      (github.event_name == 'workflow_dispatch')
    outputs:
      build_binaries: ${{ steps.compute_outputs.outputs.build_binaries }}
      version: ${{ steps.determine_version.outputs.version }}
      publish_crate: ${{ steps.check_crate.outputs.publish_crate }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Setup Git
        run: |
          git config --local user.email "github-actions[bot]@users.noreply.github.com"
          git config --local user.name "github-actions[bot]"

      - name: Detect release tag on triggering commit
        id: detect_tag
        run: |
          if [ "${{ github.event_name }}" = "workflow_run" ]; then
            COMMIT_SHA="${{ github.event.workflow_run.head_sha }}"
          else
            COMMIT_SHA=$(git rev-parse HEAD)
          fi
          # Look for a semver tag pointing at the triggering commit
          TAG=$(git tag --points-at "$COMMIT_SHA" | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n1 || true)
          if [ -n "$TAG" ]; then
            echo "Found release tag: $TAG"
            echo "tag=$TAG" >> $GITHUB_OUTPUT
            echo "use_tag=true" >> $GITHUB_OUTPUT
          else
            echo "No release tag found on commit $COMMIT_SHA"
            echo "use_tag=false" >> $GITHUB_OUTPUT
          fi

      - name: Check if publish is needed (code changes)
        id: check_needed
        run: |
          # Get the commit SHA depending on event
          if [ "${{ github.event_name }}" = "workflow_run" ]; then
            COMMIT_SHA="${{ github.event.workflow_run.head_sha }}"
          else
            COMMIT_SHA=$(git rev-parse HEAD)
          fi
          
          # Check if any relevant files changed in the triggering commit
          CHANGED_FILES=$(git diff --name-only $COMMIT_SHA~1 $COMMIT_SHA)
          
          # Files that should trigger a publish
          RELEVANT_PATTERNS="^(src/|Cargo\.toml|Cargo\.lock|tests/|\.cargo/)"
          
          # Files/patterns that should NOT trigger a publish
          IGNORE_PATTERNS="^(.*\.md$|samples/|\.github/workflows/ci\.yml$|doap\.ttl$|LICENSE$)"
          
          echo "Changed files in commit $COMMIT_SHA:"
          echo "$CHANGED_FILES"
          
          # Check if any relevant files changed and no ignore patterns match
          SHOULD_PUBLISH=false
          for file in $CHANGED_FILES; do
            if echo "$file" | grep -qE "$RELEVANT_PATTERNS"; then
              if ! echo "$file" | grep -qE "$IGNORE_PATTERNS"; then
                SHOULD_PUBLISH=true
                echo "Relevant file changed: $file"
                break
              fi
            fi
          done
          
          echo "should_publish=$SHOULD_PUBLISH" >> $GITHUB_OUTPUT
          echo "Should publish: $SHOULD_PUBLISH"

      - name: Compute outputs (build_binaries)
        id: compute_outputs
        run: |
          EVENT_NAME='${{ github.event_name }}'
          SHOULD_PUBLISH='${{ steps.check_needed.outputs.should_publish }}'
          USE_TAG='${{ steps.detect_tag.outputs.use_tag }}'
          INPUT_VERSION='${{ inputs.version }}'

          # If this workflow was triggered manually, always build binaries.
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            echo "Manual dispatch detected; forcing build_binaries=true"
            echo "build_binaries=true" >> $GITHUB_OUTPUT
            exit 0
          fi

          # Otherwise, build binaries when relevant changes, a tag is present, or a version was provided.
          if [ "$SHOULD_PUBLISH" = "true" ] || [ "$USE_TAG" = "true" ] || [ -n "$INPUT_VERSION" ]; then
            echo "build_binaries=true" >> $GITHUB_OUTPUT
          else
            echo "build_binaries=false" >> $GITHUB_OUTPUT
          fi

      - name: Determine version
        id: determine_version
        run: |
          CURRENT=$(grep -m 1 '^version = ' Cargo.toml | cut -d '"' -f 2)
          if [ -n "${{ inputs.version }}" ]; then
            V="${{ inputs.version }}"
            if [ "$CURRENT" != "$V" ]; then
              echo "Input version ($V) does not match Cargo.toml version ($CURRENT)."; exit 1
            fi
            echo "version=$V" >> $GITHUB_OUTPUT
          elif [ "${{ steps.detect_tag.outputs.use_tag }}" = "true" ]; then
            TAG="${{ steps.detect_tag.outputs.tag }}"
            V="${TAG#v}"
            if [ "$CURRENT" != "$V" ]; then
              echo "Tag version ($V) does not match Cargo.toml version ($CURRENT)."; exit 1
            fi
            echo "version=$V" >> $GITHUB_OUTPUT
          elif [ "${{ steps.check_needed.outputs.should_publish }}" = "true" ]; then
            IFS='.' read -r MA MI PA <<< "$CURRENT"
            PA=$((PA+1))
            NEW="$MA.$MI.$PA"
            sed -i "s/^version = \"$CURRENT\"/version = \"$NEW\"/" Cargo.toml
            cargo update -p rdfless
            echo "version=$NEW" >> $GITHUB_OUTPUT
          else
            echo "version=$CURRENT" >> $GITHUB_OUTPUT
          fi

      - name: Sync DOAP revision with version
        id: sync_doap
        if: steps.compute_outputs.outputs.build_binaries == 'true'
        run: |
          set -euo pipefail
          V="${{ steps.determine_version.outputs.version }}"
          if [ -z "$V" ]; then
            echo "No version determined" >&2
            exit 1
          fi
          if [ ! -f doap.ttl ]; then
            echo "doap.ttl not found; skipping"
            echo "changed=false" >> $GITHUB_OUTPUT
            exit 0
          fi
          CURRENT=$(grep -E 'doap:revision\s+"' doap.ttl | sed -E 's/.*doap:revision\s+"([^"]+)".*/\1/' || true)
          if [ "$CURRENT" = "$V" ]; then
            echo "DOAP revision already $V; no change"
            echo "changed=false" >> $GITHUB_OUTPUT
            exit 0
          fi
          # Update the doap:revision value to match the determined version
          sed -i -E 's/(doap:revision\s+\")([^\"]+)(\"\s*;)/\1'"$V"'\3/' doap.ttl
          echo "Updated doap:revision: $CURRENT -> $V"
          echo "changed=true" >> $GITHUB_OUTPUT

      - name: Update Dockerfile version label
        id: update_dockerfile
        if: steps.compute_outputs.outputs.build_binaries == 'true'
        run: |
          set -euo pipefail
          V="${{ steps.determine_version.outputs.version }}"
          if [ -z "$V" ]; then
            echo "No version determined" >&2
            exit 1
          fi
          if [ ! -f Dockerfile ]; then
            echo "Dockerfile not found; skipping"
            echo "changed=false" >> $GITHUB_OUTPUT
            exit 0
          fi
          CURRENT=$(grep -E 'org\.opencontainers\.image\.version=' Dockerfile | sed -E 's/.*org\.opencontainers\.image\.version="([^"]+)".*/\1/' || true)
          if [ "$CURRENT" = "$V" ]; then
            echo "Dockerfile version already $V; no change"
            echo "changed=false" >> $GITHUB_OUTPUT
            exit 0
          fi
          # Update the org.opencontainers.image.version label to match the determined version
          sed -i -E 's/(org\.opencontainers\.image\.version=")([^"]+)(")/\1'"$V"'\3/' Dockerfile
          echo "Updated Dockerfile version: $CURRENT -> $V"
          echo "changed=true" >> $GITHUB_OUTPUT

      - name: Check if version exists on crates.io
        id: check_crate
        if: steps.compute_outputs.outputs.build_binaries == 'true'
        run: |
          NEW_VERSION=${{ steps.determine_version.outputs.version }}
          if [ "${{ inputs.skip_crates }}" = "true" ]; then
            echo "skip_crates input is true; will not publish crate"
            echo "publish_crate=false" >> $GITHUB_OUTPUT
            exit 0
          fi

          # Check if this version already exists on crates.io
          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://crates.io/api/v1/crates/rdfless/$NEW_VERSION)

          if [ "$HTTP_STATUS" = "200" ]; then
            echo "Version $NEW_VERSION already exists on crates.io. Will skip crates publish but continue building binaries."
            echo "publish_crate=false" >> $GITHUB_OUTPUT
          else
            echo "Version $NEW_VERSION is new and can be published to crates.io."
            echo "publish_crate=true" >> $GITHUB_OUTPUT
          fi

      - name: Commit and tag new version
        if: steps.check_crate.outputs.publish_crate == 'true' && steps.detect_tag.outputs.use_tag != 'true'
        run: |
          NEW_VERSION=${{ steps.determine_version.outputs.version }}

          git add Cargo.toml Cargo.lock doap.ttl Dockerfile || true
          git commit -m "Bump version to $NEW_VERSION [skip ci]"
          git tag -a "v$NEW_VERSION" -m "Release v$NEW_VERSION"
          git push origin main
          git push origin "v$NEW_VERSION"

      - name: Commit DOAP revision update (no crates publish)
        if: steps.compute_outputs.outputs.build_binaries == 'true' && steps.check_crate.outputs.publish_crate != 'true' && (steps.sync_doap.outputs.changed == 'true' || steps.update_dockerfile.outputs.changed == 'true')
        run: |
          NEW_VERSION=${{ steps.determine_version.outputs.version }}
          git add doap.ttl Dockerfile || true
          git commit -m "chore: update doap:revision and Dockerfile version to $NEW_VERSION [skip ci]"
          git push origin main

      - name: Publish to crates.io
        if: steps.check_crate.outputs.publish_crate == 'true'
        run: |
          cargo login ${{ secrets.CRATES_IO_TOKEN }}
          cargo publish --no-verify

#      - name: Install Debian packaging tools
#        if: steps.check_version.outputs.should_publish == 'true'
#        run: |
#          sudo apt-get update
#          sudo apt-get install -y devscripts debhelper build-essential lintian dput gnupg

#      - name: Build Debian source package
#        if: steps.check_version.outputs.should_publish == 'true'
#        run: |
#          debclean || true
#          debuild -S -sa -us -uc

#      - name: Import Launchpad GPG key
#        if: steps.check_version.outputs.should_publish == 'true'
#        env:
#          LAUNCHPAD_GPG_KEY: ${{ secrets.LAUNCHPAD_GPG_KEY }}
#        run: |
#          echo "$LAUNCHPAD_GPG_KEY" | gpg --batch --import

#      - name: Sign .changes and .dsc files
#        if: steps.check_version.outputs.should_publish == 'true'
#        env:
#          LAUNCHPAD_GPG_PASSPHRASE: ${{ secrets.LAUNCHPAD_GPG_PASSPHRASE }}
#          LAUNCHPAD_USERNAME: ${{ secrets.LAUNCHPAD_USERNAME }}
#        run: |
#          CHANGES_FILE=$(ls ../*.changes | head -n1)
#          debsign -k$LAUNCHPAD_USERNAME -p"gpg --batch --yes --passphrase $LAUNCHPAD_GPG_PASSPHRASE --pinentry-mode loopback --detach-sign" $CHANGES_FILE

#      - name: Upload to Launchpad PPA
#        if: steps.check_version.outputs.should_publish == 'true'
#        env:
#          LAUNCHPAD_USERNAME: ${{ secrets.LAUNCHPAD_USERNAME }}
#        run: |
#          echo "[larsw42-ppa]" > ~/.dput.cf
#          echo "fqdn = ppa.launchpad.net" >> ~/.dput.cf
#          echo "incoming = ~larsw42/ubuntu/rdfless/" >> ~/.dput.cf
#          echo "login = $LAUNCHPAD_USERNAME" >> ~/.dput.cf
#          echo "method = ftp" >> ~/.dput.cf
#          echo "allow_unsigned_uploads = 0" >> ~/.dput.cf
#          CHANGES_FILE=$(ls ../*.changes | head -n1)
#          dput larsw42-ppa $CHANGES_FILE

  build-debian:
    name: Build Debian Packages (Docker)
    runs-on: ubuntu-latest
    needs: publish
    if: needs.publish.outputs.build_binaries == 'true'
    strategy:
      matrix:
        ubuntu: ['24.04', '22.04', '20.04']
    steps:
      - uses: actions/checkout@v4
      - name: Build .deb in Ubuntu ${{ matrix.ubuntu }}
        run: |
          set -eux
          VERSION="${{ needs.publish.outputs.version }}"
          UBUNTU="${{ matrix.ubuntu }}"
          docker run --rm -v "$PWD":/work -w /work ubuntu:${UBUNTU} bash -lc '
            set -eux
            apt-get update
            DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
              curl ca-certificates build-essential pkg-config libssl-dev git perl make gcc g++ cmake
            curl -fsSL https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
            . "$HOME/.cargo/env"
            cargo install cargo-deb
            cargo deb
          '
          # The deb file is created inside the container and may be owned by root.
          # Copying avoids permission errors from moving a file out of a root-owned directory.
          cp target/debian/*.deb "rdfless_${VERSION}_amd64-ubuntu-${UBUNTU}.deb"
      - uses: actions/upload-artifact@v4
        with:
          name: rdfless_${{ needs.publish.outputs.version }}_amd64-ubuntu-${{ matrix.ubuntu }}.deb
          path: rdfless_${{ needs.publish.outputs.version }}_amd64-ubuntu-${{ matrix.ubuntu }}.deb

  build-cross-platform:
    name: Build cross-platform binaries
    runs-on: ${{ matrix.os }}
    needs: publish
    if: needs.publish.outputs.build_binaries == 'true'
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-pc-windows-gnu
            binary-name: rdfless.exe
            dist-name: rdfless-windows-x86_64.exe
            platform: windows
          - os: macos-latest
            target: x86_64-apple-darwin
            binary-name: rdfless
            dist-name: rdfless-macos-x86_64
            platform: macos
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install Just
        uses: taiki-e/install-action@v2
        with:
          tool: just

      - name: Install Windows cross-compilation toolchain (Ubuntu only)
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-mingw-w64-x86-64

      - name: Install target
        run: rustup target add ${{ matrix.target }}

      - name: Install UPX
        run: |
          if [[ "${{ matrix.os }}" == "ubuntu-latest" ]]; then
            sudo apt-get install -y upx-ucl
          elif [[ "${{ matrix.os }}" == "macos-latest" ]]; then
            brew install upx
          fi

      - name: Build binary
        run: |
          if [[ "${{ matrix.target }}" == "x86_64-pc-windows-gnu" ]]; then
            just dist-windows
          elif [[ "${{ matrix.target }}" == "x86_64-apple-darwin" ]]; then
            just build
            cp target/release/rdfless target/release/rdfless-macos-x86_64
          fi

      - name: Set artifact name
        id: set_artifact_name
        run: |
          VERSION=${{ needs.publish.outputs.version }}
          PLATFORM=${{ matrix.platform }}
          if [ "$PLATFORM" = "windows" ]; then
            echo "artifact_name=rdfless-${VERSION}-windows-x86_64.exe" >> $GITHUB_OUTPUT
          else
            echo "artifact_name=rdfless-${VERSION}-${PLATFORM}-x86_64" >> $GITHUB_OUTPUT
          fi

      - name: Upload binary artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.set_artifact_name.outputs.artifact_name }}
          path: target/release/${{ matrix.dist-name }}

 #     - name: Find .deb package
 #       id: find_deb
 #       if: steps.check_version.outputs.should_publish == 'true'
 #       run: |
 #         echo "deb_path=$(ls target/debian/*.deb | head -n1)" >> $GITHUB_OUTPUT

  create-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs: [publish, build-cross-platform, build-debian]
    if: needs.publish.outputs.build_binaries == 'true'
    permissions:
      contents: write
      id-token: write # Required for SLSA provenance
      attestations: write # Required for SLSA provenance
    outputs:
      slsa-subjects: ${{ steps.hash.outputs.slsa-subjects }}
      version: ${{ needs.publish.outputs.version }}
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install Just
        uses: taiki-e/install-action@v2
        with:
          tool: just
      
      - name: Install UPX and musl tools
        run: |
          sudo apt-get update
          sudo apt-get install -y upx-ucl musl-tools

      - name: Install musl target
        run: rustup target add x86_64-unknown-linux-musl

      - name: Build Linux binary (static musl)
        run: just dist-linux-static
      
      - name: Download cross-platform artifacts
        uses: actions/download-artifact@v4
        with:
          path: ./artifacts

      - name: Prepare release artifacts with version
        run: |
          VERSION=${{ needs.publish.outputs.version }}
          mkdir -p ./release-artifacts
          
          # Copy and rename Linux binary
          cp target/release/rdfless-linux-x86_64 ./release-artifacts/rdfless-${VERSION}-linux-x86_64
          
          # Copy and rename Windows binary
          cp "./artifacts/rdfless-${VERSION}-windows-x86_64.exe/rdfless-windows-x86_64.exe" "./release-artifacts/rdfless-${VERSION}-windows-x86_64.exe"
          
          # Copy and rename macOS binary
          cp "./artifacts/rdfless-${VERSION}-macos-x86_64/rdfless-macos-x86_64" "./release-artifacts/rdfless-${VERSION}-macos-x86_64"
          
          # Copy Debian packages for Ubuntu 24.04, 22.04 and 20.04
          cp "./artifacts/rdfless_${VERSION}_amd64-ubuntu-24.04.deb/rdfless_${VERSION}_amd64-ubuntu-24.04.deb" "./release-artifacts/rdfless_${VERSION}_amd64-ubuntu-24.04.deb"
          cp "./artifacts/rdfless_${VERSION}_amd64-ubuntu-22.04.deb/rdfless_${VERSION}_amd64-ubuntu-22.04.deb" "./release-artifacts/rdfless_${VERSION}_amd64-ubuntu-22.04.deb"
          cp "./artifacts/rdfless_${VERSION}_amd64-ubuntu-20.04.deb/rdfless_${VERSION}_amd64-ubuntu-20.04.deb" "./release-artifacts/rdfless_${VERSION}_amd64-ubuntu-20.04.deb"

      - name: Generate SHA256 hashes for SLSA provenance
        id: hash
        run: |
          cd ./release-artifacts
          # Generate the subjects in the format expected by SLSA generator
          echo "Creating SLSA subjects..."
          # The SLSA generator expects the base64-encoded output of sha256sum directly
          HASHES=$(sha256sum * | base64 -w0)
          echo "slsa-subjects=$HASHES" >> $GITHUB_OUTPUT
          
          # Also create checksums file for the release
          sha256sum * > ../checksums.txt
          cat ../checksums.txt

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.publish.outputs.version }}
          name: Release v${{ needs.publish.outputs.version }}
          body: |
            Automated release of rdfless v${{ needs.publish.outputs.version }}
            
            ## SHA256 Checksums
            ```
            $(cat checksums.txt)
            ```
            
            ## SLSA Provenance
            This release includes SLSA Build Level 3 provenance. You can verify the provenance of these artifacts using the [slsa-verifier](https://github.com/slsa-framework/slsa-verifier) tool.
          files: |
            ./release-artifacts/rdfless-${{ needs.publish.outputs.version }}-linux-x86_64
            ./release-artifacts/rdfless-${{ needs.publish.outputs.version }}-windows-x86_64.exe
            ./release-artifacts/rdfless-${{ needs.publish.outputs.version }}-macos-x86_64
            ./release-artifacts/rdfless_${{ needs.publish.outputs.version }}_amd64-ubuntu-24.04.deb
            ./release-artifacts/rdfless_${{ needs.publish.outputs.version }}_amd64-ubuntu-22.04.deb
            ./release-artifacts/rdfless_${{ needs.publish.outputs.version }}_amd64-ubuntu-20.04.deb
            checksums.txt

  # SLSA provenance generation
  provenance:
    name: Generate SLSA Provenance
    needs: [create-release]
    if: needs.create-release.result == 'success'
    permissions:
      actions: read
      id-token: write
      contents: write
      attestations: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: "${{ needs.create-release.outputs.slsa-subjects }}"
      upload-assets: true # Upload provenance to release
      upload-tag-name: "v${{ needs.create-release.outputs.version }}"