release.yml

name: "🚀 Release"

on:
  push:
    tags:
      - "v*"

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  release:
    name: "🚀 GoReleaser + Cosign"
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: write
      packages: write
      id-token: write
      attestations: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
        with:
          egress-policy: block
          allowed-endpoints: >
            9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com:443
            api.github.com:443
            auth.docker.io:443
            cgr.dev:443
            dl-cdn.alpinelinux.org:443
            fulcio.sigstore.dev:443
            get.anchore.io:443
            ghcr.io:443
            github.com:443
            goreleaser.com:443
            packages.wolfi.dev:443
            pkg-containers.githubusercontent.com:443
            production.cloudflare.docker.com:443
            production.cloudfront.docker.com:443
            proxy.golang.org:443
            raw.githubusercontent.com:443
            registry-1.docker.io:443
            rekor.sigstore.dev:443
            release-assets.githubusercontent.com:443
            timestamp.sigstore.dev:443
            toolbox-data.anchore.io:443
            tuf-repo-cdn.sigstore.dev:443
            uploads.github.com:443

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
        with:
          go-version-file: go.mod
          # Release builds are hermetic: no restored module/build cache can
          # influence published artifacts (zizmor cache-poisoning). Modules
          # are fetched fresh from the proxy on every release.
          cache: false

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2

      - name: Install syft
        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0

      - name: Login to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94  # v7.2.3
        with:
          version: "v2.16.0"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}

      - name: Resolve container manifest digest
        id: manifest-digest
        shell: bash
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          DIGEST=$(docker buildx imagetools inspect "ghcr.io/codeswhat/portwing:${VERSION}" \
            --format '{{json .Manifest.Digest}}' | tr -d '"' || true)
          if [ -z "$DIGEST" ]; then
            echo "No manifest digest resolved, skipping image attestation."
          fi
          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"

      # Attests every artifact listed in checksums.txt: archives, packages, and
      # per-archive SBOMs. Verify any one with:
      # gh attestation verify <asset> --repo CodesWhat/portwing
      # Gated on public visibility: GitHub artifact attestation is not available
      # for private repos on this org's plan (cosign blob signatures in
      # checksums.txt.bundle still authenticates those assets either way).
      - name: Attest checksummed release assets
        if: github.event.repository.visibility == 'public'
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
        with:
          subject-checksums: dist/checksums.txt
          # We don't consume GitHub's artifact-metadata catalog; the Sigstore
          # attestation (Rekor + gh attestation verify) is the source of truth.
          create-storage-record: false

      # Container images (per-arch AND manifest lists) are cosign keyless-signed
      # by GoReleaser docker_signs; the version-tag manifest additionally gets
      # GitHub build provenance here when the repo is public.
      - name: Attest container manifest
        if: github.event.repository.visibility == 'public' && steps.manifest-digest.outputs.digest != ''
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
        with:
          subject-name: ghcr.io/codeswhat/portwing
          subject-digest: ${{ steps.manifest-digest.outputs.digest }}
          push-to-registry: true
          # OCI digest subjects have no file artifacts to catalog, so the
          # artifact-metadata storage record always errors "no artifacts found".
          # The attestation is pushed to the registry and gh-verifiable regardless.
          create-storage-record: false

  verify-published:
    name: "✅ Verify Published"
    needs: release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      packages: read
    # Gate: Sigstore public-ledger attestation verification requires the repo to
    # be public (so the OIDC token was issued against a public-visible identity).
    # On private repos this step is skipped to avoid spurious failures.
    if: github.event.repository.visibility == 'public'

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            ghcr.io:443
            github.com:443
            pkg-containers.githubusercontent.com:443
            release-assets.githubusercontent.com:443
            tmaproduction.blob.core.windows.net:443
            tuf-repo-cdn.sigstore.dev:443
            tuf-repo.github.com:443

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2

      - name: Pull released image
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          docker pull "ghcr.io/codeswhat/portwing:${VERSION}"

      - name: Verify cosign signature
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          cosign verify \
            --certificate-identity="https://github.com/CodesWhat/portwing/.github/workflows/release.yml@refs/tags/${GITHUB_REF_NAME}" \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            "ghcr.io/codeswhat/portwing:${VERSION}"

      - name: Verify gh attestation
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          gh attestation verify "oci://ghcr.io/codeswhat/portwing:${VERSION}" \
            --repo CodesWhat/portwing
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  verify-native-packages:
    name: "✅ Verify Native Packages"
    needs: release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            auth.docker.io:443
            github.com:443
            production.cloudflare.docker.com:443
            production.cloudfront.docker.com:443
            registry-1.docker.io:443
            release-assets.githubusercontent.com:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2

      - name: Download native packages and signatures
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mkdir -p packages
          gh release download "${GITHUB_REF_NAME}" \
            --repo "${GITHUB_REPOSITORY}" \
            --pattern "*.deb" \
            --pattern "*.deb.bundle" \
            --pattern "*.rpm" \
            --pattern "*.rpm.bundle" \
            --dir packages

      - name: Verify native package signatures
        run: |
          set -euo pipefail
          for package in packages/*.deb packages/*.rpm; do
            cosign verify-blob \
              --certificate-identity="https://github.com/CodesWhat/portwing/.github/workflows/release.yml@refs/tags/${GITHUB_REF_NAME}" \
              --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
              --bundle="${package}.bundle" \
              "${package}"
          done

      - name: Verify deb package install
        run: |
          docker run --rm \
            --volume "${PWD}/packages:/packages:ro" \
            ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90 \
            bash -euxo pipefail -c '
              dpkg --install /packages/portwing_*_linux_amd64.deb
              /usr/bin/portwing version
              test -f /usr/lib/systemd/system/portwing.service
              grep -Fq "ExecStart=/usr/bin/portwing" /usr/lib/systemd/system/portwing.service
            '

      - name: Verify rpm package install
        run: |
          docker run --rm \
            --volume "${PWD}/packages:/packages:ro" \
            fedora:42@sha256:99e203b80b1c3d8f7e161ec10a68fd02b081ef83a3963553e513c82846b97814 \
            bash -euxo pipefail -c '
              rpm --install /packages/portwing_*_linux_amd64.rpm
              /usr/bin/portwing version
              test -f /usr/lib/systemd/system/portwing.service
              grep -Fq "ExecStart=/usr/bin/portwing" /usr/lib/systemd/system/portwing.service
            '

  verify-homebrew:
    name: "✅ Verify Homebrew"
    needs: release
    if: ${{ !contains(github.ref_name, '-') }}
    runs-on: macos-26
    timeout-minutes: 15
    permissions:
      contents: read
    env:
      HOMEBREW_NO_ANALYTICS: "1"
      HOMEBREW_NO_AUTO_UPDATE: "1"

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            formulae.brew.sh:443
            github.com:443
            raw.githubusercontent.com:443
            release-assets.githubusercontent.com:443

      - name: Verify Homebrew cask install
        run: |
          brew tap CodesWhat/tap https://github.com/CodesWhat/homebrew-tap.git
          brew install --cask codeswhat/tap/portwing
          portwing version
          brew uninstall --cask portwing