release.yml

name: Release SemanticQt

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: write

jobs:
  package:
    name: Package tracked SemanticQt sources
    runs-on: ubuntu-latest
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
      asset_name: ${{ steps.package.outputs.asset_name }}
    steps:
      - name: Check out the tagged source
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Create reproducible ZIP
        id: package
        shell: bash
        run: |
          set -euo pipefail
          tag="${GITHUB_REF_NAME}"
          asset="SemanticQt-${tag}.zip"
          mkdir -p dist
          git archive --format=zip --prefix="SemanticQt-${tag}/" HEAD -o "dist/${asset}"
          sha256sum "dist/${asset}" > "dist/${asset}.sha256"
          echo "asset_name=${asset}" >> "$GITHUB_OUTPUT"

      - name: Compute SLSA subject hash
        id: hash
        shell: bash
        run: |
          set -euo pipefail
          base64 -w0 "dist/${{ steps.package.outputs.asset_name }}.sha256" > subjects.b64
          echo "hashes=$(cat subjects.b64)" >> "$GITHUB_OUTPUT"

      - name: Upload release payload
        uses: actions/upload-artifact@v4
        with:
          name: semanticqt-release-payload
          path: dist/
          if-no-files-found: error

  release:
    name: Publish GitHub release
    needs: package
    runs-on: ubuntu-latest
    steps:
      - name: Download release payload
        uses: actions/download-artifact@v4
        with:
          name: semanticqt-release-payload
          path: dist

      - name: Create release and upload ZIP
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          generate_release_notes: true
          files: |
            dist/${{ needs.package.outputs.asset_name }}
            dist/${{ needs.package.outputs.asset_name }}.sha256

  provenance:
    name: Generate SLSA provenance and attach it to the release
    needs: [package, release]
    permissions:
      actions: read
      contents: write
      id-token: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: ${{ needs.package.outputs.hashes }}
      upload-assets: true