release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: write

env:
  APP_NAME: SolidityGuard
  APP_VERSION: ${{ github.ref_name }}

jobs:
  # ── CLI Package ───────────────────────────────────────────────────────
  build-cli:
    name: CLI (pip package)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install build tools
        run: pip install build

      - name: Build CLI package
        run: |
          cd apps/cli
          python -m build

      - name: Upload CLI dist
        uses: actions/upload-artifact@v4
        with:
          name: solidityguard-cli
          path: apps/cli/dist/*

  # ── OpenClaw Skill ──────────────────────────────────────────────────
  build-skill:
    name: OpenClaw Skill
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Package OpenClaw skill
        run: |
          cd apps/openclaw-skill
          # Ensure scripts are bundled
          cp ../../.claude/skills/solidity-guard/scripts/solidity_guard.py scripts/
          cp ../../.claude/skills/solidity-guard/scripts/report_generator.py scripts/
          chmod +x scripts/*.sh
          cd ..
          tar czf solidityguard-openclaw-skill.tar.gz openclaw-skill/
          zip -r solidityguard-openclaw-skill.zip openclaw-skill/

      - name: Upload skill tarball
        uses: actions/upload-artifact@v4
        with:
          name: solidityguard-openclaw-skill
          path: |
            apps/solidityguard-openclaw-skill.tar.gz
            apps/solidityguard-openclaw-skill.zip

  # ── Desktop: Linux ─────────────────────────────────────────────────
  build-linux:
    name: Linux (deb + AppImage)
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: apps/desktop/src-tauri

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            libfuse2

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Build scanner binaries (Linux)
        run: |
          cd apps/desktop/pyinstaller
          pip install -r requirements-build.txt
          pyinstaller solidityguard-scanner.spec --clean
          pyinstaller solidityguard-report-gen.spec --clean
          ./dist/solidityguard-scanner --help
          mkdir -p ../src-tauri/binaries
          cp dist/solidityguard-scanner ../src-tauri/binaries/
          cp dist/solidityguard-report-gen ../src-tauri/binaries/

      - name: Build web frontend
        run: |
          cd apps/web/frontend
          npm ci
          npm run build

      - name: Build desktop app
        run: |
          cd apps/desktop
          npm ci
          npm run tauri:build

      - name: Upload deb
        uses: actions/upload-artifact@v4
        with:
          name: solidityguard-linux-deb
          path: apps/desktop/src-tauri/target/release/bundle/deb/*.deb

      - name: Upload AppImage
        uses: actions/upload-artifact@v4
        with:
          name: solidityguard-linux-appimage
          path: apps/desktop/src-tauri/target/release/bundle/appimage/*.AppImage

  # ── Desktop: macOS (signed + notarized) ────────────────────────────
  build-macos:
    name: macOS (dmg, signed)
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: apps/desktop/src-tauri

      - name: Import Apple certificate
        if: env.APPLE_CERTIFICATE != ''
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          # Create temporary keychain
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -hex 32)

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          # Import certificate
          CERT_PATH=$RUNNER_TEMP/certificate.p12
          echo "$APPLE_CERTIFICATE" | base64 --decode > "$CERT_PATH"
          security import "$CERT_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" \
            -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: \
            -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"

          # Clean up certificate file
          rm -f "$CERT_PATH"

      - name: Install DMG tools
        run: brew install create-dmg

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Build scanner binaries (macOS)
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          cd apps/desktop/pyinstaller
          pip install -r requirements-build.txt
          pyinstaller solidityguard-scanner.spec --clean
          pyinstaller solidityguard-report-gen.spec --clean
          ./dist/solidityguard-scanner --help
          # Sign binaries so Apple notarization accepts them inside the .app
          if [ -n "$APPLE_SIGNING_IDENTITY" ]; then
            echo "Signing PyInstaller binaries with Developer ID..."
            codesign --force --options runtime --timestamp \
              --sign "$APPLE_SIGNING_IDENTITY" dist/solidityguard-scanner
            codesign --force --options runtime --timestamp \
              --sign "$APPLE_SIGNING_IDENTITY" dist/solidityguard-report-gen
            echo "Verifying signatures..."
            codesign -dvv dist/solidityguard-scanner
            codesign -dvv dist/solidityguard-report-gen
          else
            echo "No signing identity — skipping binary signing"
          fi
          mkdir -p ../src-tauri/binaries
          cp dist/solidityguard-scanner ../src-tauri/binaries/
          cp dist/solidityguard-report-gen ../src-tauri/binaries/

      - name: Build web frontend
        run: |
          cd apps/web/frontend
          npm ci
          npm run build

      - name: Build desktop app (with signing)
        id: tauri_build
        continue-on-error: true
        env:
          # Apple code signing — Tauri reads these automatically
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          # Apple notarization
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          cd apps/desktop
          npm ci
          npm run tauri:build

      - name: Create DMG fallback
        if: steps.tauri_build.outcome == 'failure'
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          APP_PATH="apps/desktop/src-tauri/target/release/bundle/macos/SolidityGuard.app"
          DMG_DIR="apps/desktop/src-tauri/target/release/bundle/dmg"
          mkdir -p "$DMG_DIR"
          if [ -d "$APP_PATH" ]; then
            echo "Creating DMG with create-dmg..."
            create-dmg \
              --volname "SolidityGuard" \
              --window-pos 200 120 \
              --window-size 600 400 \
              --icon-size 100 \
              --icon "SolidityGuard.app" 150 190 \
              --app-drop-link 450 190 \
              "$DMG_DIR/SolidityGuard_${APP_VERSION#v}_aarch64.dmg" \
              "$APP_PATH" || \
            hdiutil create -volname "SolidityGuard" -srcfolder "$APP_PATH" \
              -ov -format UDZO "$DMG_DIR/SolidityGuard_${APP_VERSION#v}_aarch64.dmg"
            # Sign the DMG
            if [ -n "$APPLE_SIGNING_IDENTITY" ]; then
              codesign --force --sign "$APPLE_SIGNING_IDENTITY" "$DMG_DIR"/*.dmg || true
            fi
          else
            echo "::error::No .app bundle found — build failed before bundling"
            exit 1
          fi

      - name: Clean up keychain
        if: always()
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          if [ -f "$KEYCHAIN_PATH" ]; then
            security delete-keychain "$KEYCHAIN_PATH" 2>/dev/null || true
          fi

      - name: Upload dmg
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: solidityguard-macos-dmg
          path: apps/desktop/src-tauri/target/release/bundle/dmg/*.dmg

  # ── Desktop: Windows (signed) ──────────────────────────────────────
  build-windows:
    name: Windows (msi + exe, signed)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: apps/desktop/src-tauri

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Build scanner binaries (Windows)
        shell: pwsh
        run: |
          cd apps/desktop/pyinstaller
          pip install -r requirements-build.txt
          pyinstaller solidityguard-scanner.spec --clean
          pyinstaller solidityguard-report-gen.spec --clean
          ./dist/solidityguard-scanner.exe --help
          New-Item -ItemType Directory -Force -Path ../src-tauri/binaries
          Copy-Item dist/solidityguard-scanner.exe ../src-tauri/binaries/
          Copy-Item dist/solidityguard-report-gen.exe ../src-tauri/binaries/

      - name: Build web frontend
        run: |
          cd apps/web/frontend
          npm ci
          npm run build

      - name: Build desktop app
        env:
          # Windows code signing — Tauri reads these automatically
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          cd apps/desktop
          npm ci
          npm run tauri:build

      - name: Sign Windows binaries
        if: env.WINDOWS_CERTIFICATE != ''
        env:
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
        shell: pwsh
        run: |
          $cert = [System.Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
          $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
          [System.IO.File]::WriteAllBytes($certPath, $cert)

          # Sign MSI
          Get-ChildItem "apps/desktop/src-tauri/target/release/bundle/msi/*.msi" | ForEach-Object {
            & signtool sign /f $certPath /p $env:WINDOWS_CERTIFICATE_PASSWORD `
              /t http://timestamp.digicert.com /fd SHA256 $_.FullName
          }

          # Sign EXE
          Get-ChildItem "apps/desktop/src-tauri/target/release/bundle/nsis/*.exe" | ForEach-Object {
            & signtool sign /f $certPath /p $env:WINDOWS_CERTIFICATE_PASSWORD `
              /t http://timestamp.digicert.com /fd SHA256 $_.FullName
          }

          Remove-Item $certPath -Force

      - name: Upload msi
        uses: actions/upload-artifact@v4
        with:
          name: solidityguard-windows-msi
          path: apps/desktop/src-tauri/target/release/bundle/msi/*.msi

      - name: Upload nsis
        uses: actions/upload-artifact@v4
        with:
          name: solidityguard-windows-nsis
          path: apps/desktop/src-tauri/target/release/bundle/nsis/*.exe

  # ── Create Release ─────────────────────────────────────────────────
  release:
    name: Create Release
    needs: [build-cli, build-skill, build-linux, build-macos, build-windows]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: List artifacts
        run: find artifacts -type f | sort

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          name: "${{ env.APP_NAME }} ${{ github.ref_name }}"
          draft: false
          prerelease: ${{ contains(github.ref_name, 'beta') || contains(github.ref_name, 'alpha') || contains(github.ref_name, 'rc') }}
          body: |
            ## SolidityGuard ${{ github.ref_name }}

            Smart contract security audit tool with **104 vulnerability patterns**, **9 analysis tools**, **multi-agent team architecture**, and **100% detection rate** on 85/85 CTF benchmark challenges (DeFiVulnLabs + Paradigm CTF + R3CTF 2025 + HTB Cyber Apocalypse 2025).

            ---

            ### Components

            | Component | Description |
            |-----------|-------------|
            | **Desktop App** | Native desktop application (Tauri v2) for Windows, macOS, and Linux |
            | **Web App** | React frontend + FastAPI backend — deployed at [solidityguard.org](https://solidityguard.org) |
            | **CLI** | Python CLI tool for terminal-based auditing (download `.whl` from release assets) |
            | **OpenClaw Skill** | AI agent skill for [OpenClaw](https://openclaw.ai) — install via ClawHub |

            ---

            ### Desktop Downloads

            | Platform | File | Description |
            |----------|------|-------------|
            | **Linux** | `.deb` | Debian / Ubuntu package (apt install) |
            | **Linux** | `.AppImage` | Portable — no installation needed, just run |
            | **macOS** | `.dmg` | Drag-and-drop disk image installer |
            | **Windows** | `.msi` | Windows Installer (MSI) |
            | **Windows** | `.exe` | NSIS installer with auto-updater |

            ### CLI Install

            ```bash
            # Download .whl from release assets, then:
            pip install solidityguard-*.whl
            solidityguard audit ./contracts
            ```

            Or install from source:
            ```bash
            git clone https://github.com/alt-research/SolidityGuard.git
            cd SolidityGuard/apps/cli && pip install -e .
            ```

            ### OpenClaw Skill Install

            ```bash
            # Via ClawHub
            npx clawhub@latest install solidityguard

            # Manual — download and extract to skills directory
            tar xzf solidityguard-openclaw-skill.tar.gz -C ~/.openclaw/skills/
            ```

            ---

            ### What's Included

            - **104 vulnerability patterns** (ETH-001 to ETH-104) covering reentrancy, access control, DeFi, proxy, oracle, transient storage, EIP-7702, ERC-4337, and more
            - **50+ pattern detectors** with 100% benchmark detection rate
            - **9-tool integration** — Slither, Aderyn, Mythril, Foundry, Echidna, Medusa, Halmos, Certora, EVMBench
            - **7-phase deep audit** — scan, verify, parallel agents, exploit PoC, dynamic verification, fuzz, report
            - **Multi-agent team architecture** — 9 specialized sub-agents working in parallel
            - **Professional reports** — OpenZeppelin / Trail of Bits style (Markdown + PDF)
            - **Real-time progress** — WebSocket streaming for live audit updates
            - **EVMBench integration** — detect, patch, and exploit modes for benchmark evaluation
            - **OWASP 2025 aligned** — covers all Smart Contract Top 10 categories

            ### Benchmarks

            | Benchmark | Result |
            |-----------|--------|
            | DeFiVulnLabs | 56/56 contracts (100%) |
            | Paradigm CTF 2021 | 10/10 static challenges (100%) |
            | Paradigm CTF 2022 | 7/7 static challenges (100%) |
            | Paradigm CTF 2023 | 7/7 static challenges (100%) |
            | R3CTF 2025 | 2/2 challenges (100%) |
            | HTB Cyber Apocalypse 2025 | 3/3 challenges (100%) |
            | **Combined** | **85/85 (100%)** |
            | EVMBench | 120/120 vulns across 40 audits (100%) |

            ### System Requirements

            - **Desktop**: Windows 10+, macOS 12+, Ubuntu 22.04+ / Debian 12+
            - **CLI**: Python 3.10+
            - **Optional tools**: Slither, Aderyn, Mythril, Foundry (for full multi-tool scanning)

            ### Quick Start

            **Desktop:**
            1. Download the installer for your platform
            2. Install and launch SolidityGuard
            3. Sign in with Google
            4. Upload `.sol` / `.vy` files or select a local contracts directory
            5. Configure scan mode and tools, then start the audit

            **CLI:**
            ```bash
            # Install from release .whl or from source
            pip install solidityguard-*.whl
            solidityguard audit ./contracts --mode full
            solidityguard report --input findings.json --output report.md
            ```

            **OpenClaw:**
            Just ask your AI agent: "Audit my contracts for security vulnerabilities"

            ---

            *Built with [Tauri v2](https://v2.tauri.app) + React + TypeScript + FastAPI + Python*
          files: |
            artifacts/**/*.deb
            artifacts/**/*.AppImage
            artifacts/**/*.dmg
            artifacts/**/*.msi
            artifacts/**/*.exe
            artifacts/**/*.tar.gz
            artifacts/**/*.zip
            artifacts/**/*.whl