release.yml

name: Release

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+*"

permissions:
  contents: write

env:
  # Pinned schemaforge-console release whose signed `dist` bundle is embedded
  # into the binary. Bump in lockstep with console changes; the build verifies
  # this release's keyless signature (identity-pinned) before embedding it.
  CONSOLE_VERSION: v0.1.0

jobs:
  build:
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
      id-token: write

    strategy:
      matrix:
        include:
          - backend: surrealdb
            suffix: surrealdb
            runner: ubuntu-24.04
            target: x86_64-unknown-linux-gnu
            archive: tar.gz
          - backend: postgres
            suffix: postgres
            runner: ubuntu-24.04
            target: x86_64-unknown-linux-gnu
            archive: tar.gz
          - backend: mssql
            suffix: mssql
            runner: ubuntu-24.04
            target: x86_64-unknown-linux-gnu
            archive: tar.gz
          - backend: mssql
            suffix: mssql
            runner: windows-2025
            target: x86_64-pc-windows-msvc
            archive: zip
          - backend: surrealdb
            suffix: surrealdb
            runner: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            archive: tar.gz
          - backend: postgres
            suffix: postgres
            runner: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            archive: tar.gz

    env:
      TAG_NAME: ${{ github.ref_name }}

    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@1.97.1

      - name: Install Linux system build dependencies
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libkrb5-dev

      - name: Install Windows system build dependencies
        if: runner.os == 'Windows'
        shell: pwsh
        run: choco install protoc --no-progress --yes

      - name: Verify Rust toolchain
        run: rustc --version && cargo --version

      - name: Verify release tag matches CLI version
        shell: bash
        run: |
          PACKAGE_ID="$(cargo pkgid --locked -p schema-forge-cli)"
          PACKAGE_VERSION="${PACKAGE_ID##*#}"
          test "$TAG_NAME" = "v${PACKAGE_VERSION##*@}"

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Download + verify the signed console bundle
        shell: bash
        env:
          # GITHUB_TOKEN can read another OSS repo's releases in the same org.
          # If schemaforge-console is private, swap for a scoped PAT/app token.
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Prevent Git Bash/MSYS from rewriting URL-shaped cosign regex args
          # into Windows paths before they reach the native executable.
          MSYS_NO_PATHCONV: "1"
        run: |
          set -euo pipefail
          gh release download "$CONSOLE_VERSION" \
            --repo Govcraft/schemaforge-console \
            --pattern 'console-dist-*.tar.gz' \
            --pattern 'SHA256SUMS' \
            --pattern 'SHA256SUMS.sig' \
            --pattern 'SHA256SUMS.pem'
          # Identity-pinned keyless verification (FAIL-CLOSED): a SHA256SUMS
          # signed by any other repo/workflow — or a tampered manifest — aborts
          # the build here. A bare verify-blob (no identity/issuer) is not enough.
          cosign verify-blob \
            --certificate SHA256SUMS.pem \
            --signature SHA256SUMS.sig \
            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
            --certificate-identity-regexp '^https://github\.com/Govcraft/schemaforge-console/\.github/workflows/release\.yml@' \
            SHA256SUMS
          # Tie the verified manifest to the actual tarball bytes, then extract.
          sha256sum -c SHA256SUMS
          mkdir -p console-dist
          tar -xzf console-dist-*.tar.gz -C console-dist

      - name: Stamp checked-out source revision
        shell: bash
        run: echo "SCHEMAFORGE_SOURCE_REVISION=$(git rev-parse HEAD)" >> "$GITHUB_ENV"

      - name: Build release binary (${{ matrix.backend }} / ${{ matrix.target }})
        env:
          # Points rust-embed at the verified console bundle (build.rs re-exports
          # it for the `#[folder = "$SCHEMAFORGE_CONSOLE_DIST"]` interpolation).
          SCHEMAFORGE_CONSOLE_DIST: ${{ github.workspace }}/console-dist
        run: cargo build --locked --release --package schema-forge-cli --no-default-features --features ${{ matrix.backend }},embedded-console

      - name: Sign and verify Windows binary (Sigstore keyless)
        if: runner.os == 'Windows'
        shell: pwsh
        env:
          COSIGN_YES: "true"
        run: |
          cosign sign-blob `
            --bundle target/release/schemaforge.exe.sigstore.json `
            target/release/schemaforge.exe
          cosign verify-blob `
            --bundle target/release/schemaforge.exe.sigstore.json `
            --certificate-oidc-issuer https://token.actions.githubusercontent.com `
            --certificate-identity-regexp '^https://github\.com/Govcraft/schemaforge/\.github/workflows/release\.yml@refs/tags/' `
            target/release/schemaforge.exe

      - name: Package Unix binary
        if: runner.os != 'Windows'
        env:
          TARGET: ${{ matrix.target }}
          SUFFIX: ${{ matrix.suffix }}
        run: |
          cd target/release
          tar czf "../../schemaforge-${TAG_NAME}-${TARGET}-${SUFFIX}.tar.gz" schemaforge
          cd ../..

      - name: Package Windows binary
        if: runner.os == 'Windows'
        shell: pwsh
        env:
          TARGET: ${{ matrix.target }}
          SUFFIX: ${{ matrix.suffix }}
        run: |
          Compress-Archive `
            -Path target/release/schemaforge.exe,target/release/schemaforge.exe.sigstore.json `
            -DestinationPath "schemaforge-$env:TAG_NAME-$env:TARGET-$env:SUFFIX.zip"

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: schemaforge-${{ matrix.target }}-${{ matrix.suffix }}
          path: schemaforge-${{ github.ref_name }}-${{ matrix.target }}-${{ matrix.suffix }}.${{ matrix.archive }}

  release:
    needs: build
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v6

      - name: Prepare release notes from changelog
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: |
          awk -v version="${TAG_NAME#v}" '
            index($0, "## [" version "]") == 1 { found = 1; next }
            found && /^## \[/ { exit }
            found { print }
          ' CHANGELOG.md > RELEASE_NOTES.md
          test -s RELEASE_NOTES.md

      - uses: actions/download-artifact@v8
        with:
          merge-multiple: true

      - name: Generate SHA256SUMS
        run: sha256sum schemaforge-*.tar.gz schemaforge-*.zip > SHA256SUMS

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Sign SHA256SUMS (keyless)
        env:
          COSIGN_YES: "true"
        run: |
          cosign sign-blob \
            --output-signature SHA256SUMS.sig \
            --output-certificate SHA256SUMS.pem \
            SHA256SUMS

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          body_path: RELEASE_NOTES.md
          generate_release_notes: true
          files: |
            schemaforge-*.tar.gz
            schemaforge-*.zip
            SHA256SUMS
            SHA256SUMS.sig
            SHA256SUMS.pem