release.yml

name: Release binaries

# A pushed version tag builds lesscode-core for every supported platform, signs
# the archives in the approval-gated `release` environment and publishes them
# with checksums and the install scripts as a GitHub release.
# A manual run builds the same archives as workflow artifacts; it signs and
# publishes nothing, so the packaging can be checked before a tag exists.
on:
  push:
    tags: ['v[0-9]+.[0-9]+.[0-9]+']
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: release-publication
  cancel-in-progress: false

env:
  RUST_VERSION: '1.98.1'
  # Pinned signing CLI; scripts/sign-release-assets.ps1 refuses any other version.
  ZIPSIGN_VERSION: '0.2.2'

jobs:
  # No secrets and no write access here.
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-24.04, target: x86_64-unknown-linux-gnu }
          - { os: ubuntu-24.04-arm, target: aarch64-unknown-linux-gnu }
          - { os: windows-2025, target: x86_64-pc-windows-msvc }
          - { os: macos-15-intel, target: x86_64-apple-darwin }
          - { os: macos-15, target: aarch64-apple-darwin }
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - name: Install pinned Rust
        run: rustup toolchain install "$RUST_VERSION" --profile minimal --target "${{ matrix.target }}"
      - name: Build the release binary with locked dependencies
        run: cargo "+$RUST_VERSION" build --release --locked --target "${{ matrix.target }}" --manifest-path native/Cargo.toml
      - name: Package the binary with its license notices
        id: package
        env:
          TARGET: ${{ matrix.target }}
        run: |
          name="lesscode-core-$TARGET"
          stage="$RUNNER_TEMP/$name"
          mkdir -p "$stage"
          exe=lesscode-core
          if [ "$RUNNER_OS" = Windows ]; then exe=lesscode-core.exe; fi
          bin="native/target/$TARGET/release/$exe"
          "$bin" --version
          cp "$bin" LICENSE native/LICENSES.md native/THIRD_PARTY_NOTICES.txt "$stage/"
          cd "$RUNNER_TEMP"
          if [ "$RUNNER_OS" = Windows ]; then
            archive="$name.zip"
            7z a -tzip "$archive" "$name" > /dev/null
          else
            archive="$name.tar.gz"
            tar -czf "$archive" "$name"
          fi
          echo "archive=$archive" >> "$GITHUB_OUTPUT"
      - name: Keep the unsigned archive as a workflow artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: lesscode-core-${{ matrix.target }}
          path: ${{ runner.temp }}/${{ steps.package.outputs.archive }}
          if-no-files-found: error
          retention-days: 14

  publish:
    name: Sign and publish release
    needs: build
    # Only for a tag, and only when every platform built.
    if: github.event_name == 'push'
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    # The signing key exists only as a secret of this environment, which must
    # have required reviewers (docs/release-signing.md).
    environment: release
    permissions:
      contents: write
      actions: read
      id-token: write       # build provenance attestation (OIDC)
      attestations: write   # build provenance attestation
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - name: Require the tag to match the crate version
        run: |
          crate_version=$(sed -n 's/^version = "\(.*\)"$/\1/p' native/Cargo.toml | head -n 1)
          if [ "v$crate_version" != "$GITHUB_REF_NAME" ]; then
            echo "Tag $GITHUB_REF_NAME does not match native/Cargo.toml version $crate_version" >&2
            exit 1
          fi
      - name: Install pinned zipsign
        run: |
          cargo install zipsign --version "=$ZIPSIGN_VERSION" --locked --root "$RUNNER_TEMP/zipsign"
          echo "$RUNNER_TEMP/zipsign/bin" >> "$GITHUB_PATH"
      - name: Collect the archives built by this run
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p "$RUNNER_TEMP/download" release-assets
          gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" --dir "$RUNNER_TEMP/download"
          find "$RUNNER_TEMP/download" -type f \( -name 'lesscode-core-*.tar.gz' -o -name 'lesscode-core-*.zip' \) -exec cp {} release-assets/ \;
          cp scripts/install.sh scripts/install.ps1 release-assets/
          ls -l release-assets
      # Only this step sees the key (secret of the `release` environment).
      - name: Sign the archives and write the checksums
        shell: pwsh
        env:
          LESSCODE_RELEASE_SIGNING_KEY: ${{ secrets.LESSCODE_RELEASE_SIGNING_KEY }}
        run: ./scripts/publish-release.ps1 -Directory release-assets
      # Provenance for the exact signed archive bytes.
      - name: Attest archives
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: |
            release-assets/lesscode-core-*.tar.gz
            release-assets/lesscode-core-*.zip
      - name: Create the draft release with every asset
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --draft --verify-tag \
            --generate-notes --title "$GITHUB_REF_NAME" release-assets/*
      # Last step: runs only when signing, attestation and upload succeeded.
      - name: Publish the draft as the latest release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release edit "$GITHUB_REF_NAME" --draft=false --latest --repo "$GITHUB_REPOSITORY"