release.yml

name: release

# Merges to main keep a release PR up to date (release-please). Merging that PR tags the
# commit and creates the GitHub release; the goreleaser job then builds and attaches the
# binaries, .deb packages, checksums and SBOMs and creates signed build provenance
# attestations. Finally the Homebrew formula is published to the tap, and the docs workflow
# rebuilds the APT repository from the new release.
on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      tag:
        description: Existing tag to (re)build assets for, e.g. v0.2.0
        required: true
        type: string

permissions: {}

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release-please:
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      actions: write # dispatch CI onto the release PR
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
    steps:
      # With a GitHub App configured (vars.RELEASE_APP_CLIENT_ID, secrets.RELEASE_APP_PRIVATE_KEY),
      # release-please acts as that app, so the release PR's CI runs like any other PR's. Without
      # it, GITHUB_TOKEN is used and the next step starts the checks instead.
      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        if: vars.RELEASE_APP_CLIENT_ID != ''
        with:
          client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write
      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
        id: release
        with:
          token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json
      # A release PR opened with GITHUB_TOKEN is authored by github-actions[bot], so GitHub holds
      # its pull_request runs for maintainer approval ("first-time contributor" policy).
      # workflow_dispatch isn't subject to that. So whenever a release PR is open, run CI and
      # CodeQL on it directly; they report their results to the PR as commit statuses (see
      # .github/actions/commit-status).
      - name: Run checks on the open release PR
        if: steps.app-token.outputs.token == ''
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BRANCH: release-please--branches--main--components--dotsync
        run: |
          if [ "$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$BRANCH" --state open --json number --jq length)" = "1" ]; then
            gh workflow run ci.yml --repo "$GITHUB_REPOSITORY" --ref "$BRANCH"
            gh workflow run codeql.yml --repo "$GITHUB_REPOSITORY" --ref "$BRANCH"
            echo "dispatched ci and codeql on $BRANCH"
          fi

  goreleaser:
    needs: release-please
    if: ${{ always() && (needs.release-please.outputs.release_created == 'true' || github.event_name == 'workflow_dispatch') }}
    runs-on: ubuntu-latest
    permissions:
      contents: write     # upload release assets
      id-token: write     # Sigstore signing for attestations
      attestations: write # store attestations
    env:
      TAG: ${{ needs.release-please.outputs.tag_name || inputs.tag }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ env.TAG }}
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: stable
      - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GORELEASER_CURRENT_TAG: ${{ env.TAG }}
      - name: Attest build provenance
        id: attest
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-checksums: ./dist/checksums.txt
      # Also publish the signed provenance next to the binaries, for offline verification
      # (`gh attestation verify --bundle`) and for tools that look for it there.
      - name: Attach provenance bundle to the release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BUNDLE: ${{ steps.attest.outputs.bundle-path }}
        run: |
          out="dotsync_${TAG#v}.intoto.jsonl"
          cp "$BUNDLE" "$out"
          gh release upload "$TAG" "$out" --clobber --repo "$GITHUB_REPOSITORY"

  # Publishes the formula for this release to the Homebrew tap (vars.HOMEBREW_TAP, e.g.
  # pungoyal/homebrew-tap). Pushes as the release GitHub App when it's installed on the tap,
  # otherwise with secrets.HOMEBREW_TAP_TOKEN (a fine-grained token: contents write on the tap).
  homebrew:
    needs: [release-please, goreleaser]
    if: ${{ always() && needs.goreleaser.result == 'success' && vars.HOMEBREW_TAP != '' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      TAG: ${{ needs.release-please.outputs.tag_name || inputs.tag }}
      TAP: ${{ vars.HOMEBREW_TAP }}
    steps:
      - id: tap
        run: echo "name=${TAP#*/}" >> "$GITHUB_OUTPUT"
      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        if: vars.RELEASE_APP_CLIENT_ID != ''
        with:
          client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: ${{ steps.tap.outputs.name }}
          permission-contents: write
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ env.TAG }}
          persist-credentials: false
      - name: Generate the formula
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern checksums.txt --dir "$RUNNER_TEMP"
          packaging/homebrew/formula.sh "$TAG" "$RUNNER_TEMP/checksums.txt" > "$RUNNER_TEMP/dotsync.rb"
          cat "$RUNNER_TEMP/dotsync.rb"
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ vars.HOMEBREW_TAP }}
          token: ${{ steps.app-token.outputs.token || secrets.HOMEBREW_TAP_TOKEN }}
          path: tap
      - name: Push the formula to the tap
        working-directory: tap
        run: |
          mkdir -p Formula
          cp "$RUNNER_TEMP/dotsync.rb" Formula/dotsync.rb
          git add Formula/dotsync.rb
          if git diff --cached --quiet; then
            echo "Formula/dotsync.rb is already up to date"
            exit 0
          fi
          git -c user.name="github-actions[bot]" -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
            commit -m "dotsync ${TAG#v}" -m "From $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/releases/tag/$TAG"
          git push

  # The APT repository is part of the docs site, built from the latest release's packages.
  apt:
    needs: goreleaser
    if: ${{ always() && needs.goreleaser.result == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      actions: write # dispatch the docs workflow
    steps:
      # The docs site deploys from the default branch, whichever tag this run built. A
      # workflow_dispatch made with GITHUB_TOKEN does start a run.
      - name: Rebuild the APT repository
        env:
          GH_TOKEN: ${{ github.token }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: gh workflow run docs.yml --repo "$GITHUB_REPOSITORY" --ref "$DEFAULT_BRANCH"