cli-release.yml

# Cut a bootintel-cli release across 5 platforms.
#
# workflow_dispatch only — never triggered by push, so a stray tag
# or commit can't accidentally publish. Matches the Launch Guard

#
# What it does:
#   1. Matrix-builds the CLI on Linux (x86_64 + aarch64), macOS
#      (x86_64 + aarch64), and Windows (x86_64).
#   2. Bundles each binary with LICENSE + README into a tarball
#      (or zip on Windows).
#   3. Uploads all artifacts to a GH Release DRAFT — you review +
#      publish the draft manually. Nothing is public until you hit
#      the "Publish release" button.
#   4. Computes a combined SHA256SUMS file across all binaries so
#      install.sh can verify.
#   5. Generates a signed build-provenance attestation for every
#      released artifact (see "Provenance" below).
#
# What it does NOT do:
#   - No auto-publish to Homebrew tap / winget / apt / Nix registry.
#   - No auto-bump of version numbers. You bump Cargo.toml
#     yourself before running this, then paste the version below.
#   - No auto-tag. You tag from the released commit manually after
#     the draft is published.
#
# Cost note: uses github-hosted runners (2000 min/mo free for
# public repos). Full matrix is ~15-20 minutes per invocation.

name: cli-release

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to build (e.g. 0.1.0 — no leading v)'
        required: true
        type: string
      dry_run:
        description: 'Build binaries but do NOT create a release draft'
        required: false
        type: boolean
        default: false
      publish_docker:
        description: 'Also build + push the Docker image to ghcr.io/bootintel/cli'
        required: false
        type: boolean
        default: false

# Provenance
# ----------
# Every released artifact gets a signed build-provenance attestation
# via actions/attest-build-provenance. That is a Sigstore signature
# over the artifact digest plus a SLSA statement recording which
# workflow, at which commit, on which runner produced it — so a user
# can verify an artifact really came from this repository's release
# workflow and not from someone's laptop:
#
#   gh attestation verify bootintel-v0.3.2-x86_64-linux.tar.gz \
#     --repo BootIntel/cli
#
# It is free for public repositories, needs no key material of our own
# (keyless: the runner's OIDC identity is what gets signed, and the
# certificate lives in the public Rekor transparency log), and gives a
# stronger guarantee than a paid code-signing certificate would for
# this audience — it binds the artifact to a *build*, not merely to an
# organisation that paid a CA.
#
# SHA256SUMS stays exactly as it was: it answers "did this download
# arrive intact", which is a different question and still the one
# install.sh asks.
permissions:
  contents: write   # needed to create the release draft
  id-token: write   # OIDC identity for keyless attestation signing
  attestations: write  # write the attestation to the repo's store

jobs:
  build:
    name: build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            asset_name: bootintel-v${{ inputs.version }}-x86_64-linux.tar.gz
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            asset_name: bootintel-v${{ inputs.version }}-aarch64-linux.tar.gz
            cross: true
          # x86_64-apple-darwin cross-compiles from an Apple Silicon
          # runner (macos-latest = macos-15 as of 2026). The macos-13
          # (Intel) runner pool is effectively unavailable on public
          # repos — a v0.2.0 dispatch on 2026-08-26 sat queued for 1h47m
          # before we gave up. Rust cross-compiles Intel-macos from
          # arm64-macos cleanly (single-arch dylib, same Xcode SDK).
          - target: x86_64-apple-darwin
            os: macos-latest
            asset_name: bootintel-v${{ inputs.version }}-x86_64-macos.tar.gz
          - target: aarch64-apple-darwin
            os: macos-14
            asset_name: bootintel-v${{ inputs.version }}-aarch64-macos.tar.gz
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            asset_name: bootintel-v${{ inputs.version }}-x86_64-windows.zip
            windows: true

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      # Linux serialport backend needs libudev headers.
      - name: Install libudev (Linux)
        if: startsWith(matrix.os, 'ubuntu')
        run: |
          sudo apt-get update
          sudo apt-get install -y libudev-dev

      # For cross-compiling to aarch64-linux on an x86_64 GH runner.
      - name: Install cross-linker (Linux aarch64)
        if: matrix.cross
        run: |
          sudo apt-get install -y gcc-aarch64-linux-gnu
          mkdir -p .cargo
          cat >> .cargo/config.toml <<'EOF'
          [target.aarch64-unknown-linux-gnu]
          linker = "aarch64-linux-gnu-gcc"
          EOF

      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: cli-release-${{ matrix.target }}-${{ hashFiles('Cargo.lock') }}

      - name: Build release
        
        run: |
          cargo build --release --target ${{ matrix.target }} --features tui

      - name: Package (Unix)
        if: '!matrix.windows'
        
        run: |
          mkdir -p dist
          cp target/${{ matrix.target }}/release/bootintel dist/
          cp README.md dist/
          cp ../LICENSE dist/ 2>/dev/null || echo "LICENSE not found at repo root; skipping"
          tar -czf ${{ matrix.asset_name }} -C dist .

      - name: Package (Windows)
        if: matrix.windows
        
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path dist | Out-Null
          Copy-Item "target\${{ matrix.target }}\release\bootintel.exe" -Destination "dist\"
          Copy-Item README.md -Destination "dist\"
          if (Test-Path "..\LICENSE") { Copy-Item "..\LICENSE" -Destination "dist\" }
          Compress-Archive -Path "dist\*" -DestinationPath ${{ matrix.asset_name }}

      - name: Compute SHA256
        
        shell: bash
        run: |
          if command -v sha256sum >/dev/null; then
            sha256sum ${{ matrix.asset_name }} > ${{ matrix.asset_name }}.sha256
          else
            shasum -a 256 ${{ matrix.asset_name }} > ${{ matrix.asset_name }}.sha256
          fi
          cat ${{ matrix.asset_name }}.sha256

      # Attest the archive we are about to ship. Runs per-matrix-leg so
      # each platform's artifact is attested on the runner that built
      # it, which is what makes the provenance meaningful.
      #
      # Skipped on dry runs: a dry run produces nothing anyone will
      # download, and attesting it would put a misleading entry in the
      # public transparency log.
      - name: Attest build provenance
        if: '!inputs.dry_run'
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: ${{ matrix.asset_name }}

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.asset_name }}
          path: |
            ${{ matrix.asset_name }}
            ${{ matrix.asset_name }}.sha256
          retention-days: 7

  release:
    name: create release draft
    needs: build
    if: '!inputs.dry_run'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Assemble SHA256SUMS
        run: |
          mkdir release-assets
          # NB: parenthesize the -o expression so -type f binds to
          # BOTH branches. Without parens, -type f only applies to
          # the tar.gz branch, and the zip branch matches the parent
          # directory that actions/download-artifact@v4 creates
          # (named after the artifact — see
          # https://github.com/actions/download-artifact#outputs).
          # cp then fails on the directory and the whole job exits 1.
          # v0.2.0 dispatch (run 32958967197) hit this. Keep the parens.
          find artifacts -type f \( -name 'bootintel-*.tar.gz' -o -name 'bootintel-*.zip' \) | while read f; do
            cp "$f" release-assets/
          done
          find artifacts -type f -name '*.sha256' -exec cat {} \; | sort > release-assets/SHA256SUMS
          echo "─────────────────────────────────────"
          ls -la release-assets/
          echo "─────────────────────────────────────"
          cat release-assets/SHA256SUMS

      - name: Write release notes
        run: |
          cat > RELEASE_NOTES.md <<'NOTES'
          Release notes: see CHANGELOG.md.

          This is a DRAFT — publish manually after verifying artifacts.

          ## Verify what you downloaded

          Checksums are in `SHA256SUMS`:

              sha256sum -c SHA256SUMS --ignore-missing

          Every archive also carries a signed build-provenance attestation,
          so you can confirm it was produced by this repository's release
          workflow rather than by someone's laptop:

              gh attestation verify <archive> --repo BootIntel/cli
          NOTES
          # Strip the leading indentation the YAML block required.
          sed -i 's/^          //' RELEASE_NOTES.md
          cat RELEASE_NOTES.md

      - name: Create GH Release DRAFT
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "cli-v${{ inputs.version }}" \
            --draft \
            --title "bootintel-cli v${{ inputs.version }}" \
            --notes-file RELEASE_NOTES.md \
            release-assets/*

  docker:
    name: build + push docker image
    needs: build
    if: inputs.publish_docker && !inputs.dry_run
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v4

      - name: Log in to ghcr.io
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build + push (linux/amd64, linux/arm64)
        id: docker_build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ghcr.io/bootintel/cli:v${{ inputs.version }}
            ghcr.io/bootintel/cli:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Attest image provenance
        uses: actions/attest-build-provenance@v2
        with:
          subject-name: ghcr.io/bootintel/cli
          subject-digest: ${{ steps.docker_build.outputs.digest }}
          push-to-registry: true