release.yml

name: Release

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
  workflow_dispatch:

permissions: read-all

env:
  CARGO_TERM_COLOR: always
  APP_ID: io.github.cosmic-applet-mare
  # Retry transient crates.io/registry download failures instead of failing.
  CARGO_NET_RETRY: "10"

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        target:
          - x86_64-unknown-linux-gnu
          - aarch64-unknown-linux-gnu
        variant:
          - applet
          - standalone
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-24.04-arm
          - variant: applet
            binary: cosmic-applet-mare
            pkg_name: cosmic-applet-mare
            cargo_args: ""
            deb_variant: ""
            rpm_variant: ""
          - variant: standalone
            binary: mare-player
            pkg_name: mare-player
            cargo_args: "--no-default-features --features wgpu"
            deb_variant: "--variant=standalone"
            rpm_variant: "--variant=standalone"

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libdbus-1-dev \
            libsecret-1-dev \
            libxkbcommon-dev \
            libwayland-dev \
            libinput-dev \
            libudev-dev \
            libseat-dev \
            libexpat1-dev \
            libgstreamer1.0-dev \
            libgstreamer-plugins-base1.0-dev

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Install packaging tools
        uses: cargo-bins/cargo-binstall@b874e25ea559687bec77e281e9b271aa1367b624 # v1.23.0

      # `just` and `cargo-deb` ship prebuilt binaries that binstall can fetch.
      # `cargo-generate-rpm` does not advertise binstall metadata, so binstall
      # falls back to a bare `cargo install` (no `--locked`) that breaks on
      # unpinned transitive deps. Install it from source with `--locked` so it
      # uses the crate's own tested Cargo.lock.
      - run: cargo binstall --no-confirm just cargo-deb
      - run: cargo install cargo-generate-rpm --locked

      - name: Build release binary
        run: |
          cargo build --release ${{ matrix.cargo_args }}
          # For standalone, the binary is still named cosmic-applet-mare;
          # copy it to the expected name
          if [ "${{ matrix.variant }}" = "standalone" ]; then
            cp target/release/cosmic-applet-mare target/release/${{ matrix.binary }}
          else
            # Applet: also build the out-of-process video-window companion
            # (referenced by the applet .deb/.rpm assets and bundled below).
            cargo build --release -p mare-video-window
          fi

      - name: Build .deb package
        run: cargo deb --no-build ${{ matrix.deb_variant }}

      - name: Build .rpm package
        run: |
          strip -s target/release/${{ matrix.binary }}
          cargo generate-rpm ${{ matrix.rpm_variant }}

      - name: Prepare tarball
        run: |
          ARCH=$(uname -m)
          DIR=${{ matrix.pkg_name }}
          mkdir -p "$DIR"
          cp target/release/${{ matrix.binary }} "$DIR/"
          # Applet bundles the out-of-process video-window companion too.
          if [ "${{ matrix.variant }}" = "applet" ]; then
            cp target/release/mare-video-window "$DIR/"
          fi
          cp resources/app.desktop "$DIR/${{ env.APP_ID }}.desktop"
          cp resources/app.metainfo.xml "$DIR/${{ env.APP_ID }}.metainfo.xml"
          cp resources/icon.svg "$DIR/${{ env.APP_ID }}.svg"
          cp LICENSE "$DIR/"
          strip -s "$DIR/${{ matrix.binary }}"
          tar -czvf "${{ matrix.pkg_name }}-${ARCH}.tar.gz" "$DIR"

      - name: Collect packages
        run: |
          mkdir -p dist
          cp target/debian/*.deb dist/
          cp target/generate-rpm/*.rpm dist/
          cp ${{ matrix.pkg_name }}-*.tar.gz dist/

      - name: Upload artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: packages-${{ matrix.variant }}-${{ matrix.target }}
          path: dist/*

  release:
    runs-on: ubuntu-latest
    needs: build
    permissions:
      contents: write
      id-token: write
      attestations: write
    outputs:
      # base64(SHA256SUMS) — the subject list the SLSA generator signs.
      hashes: ${{ steps.hashes.outputs.hashes }}

    steps:
      - name: Checkout (tag annotation + commit changelog)
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # Full history + tags so we can build a changelog from the commits
          # between this tag and the previous release.
          fetch-depth: 0
          ref: ${{ github.ref }}

      - name: Resolve release name
        id: meta
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          NAME=$(git tag -l --format='%(contents:subject)' "$TAG" | head -1)
          if [ -n "$NAME" ]; then
            echo "release_name=${TAG} — ${NAME}" >> "$GITHUB_OUTPUT"
          else
            echo "release_name=${TAG}" >> "$GITHUB_OUTPUT"
          fi

      - name: Download all artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: release
          merge-multiple: true

      - name: Generate checksums
        id: hashes
        run: |
          cd release
          shasum -a 256 *.deb *.rpm *.tar.gz > SHA256SUMS
          # Expose base64(SHA256SUMS) for the SLSA provenance generator job.
          echo "hashes=$(base64 -w0 SHA256SUMS)" >> "$GITHUB_OUTPUT"

      - name: Attest build provenance
        id: attest
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: |
            release/*.deb
            release/*.rpm
            release/*.tar.gz
            release/SHA256SUMS

      # `attest-build-provenance` uploads the attestation to GitHub's
      # attestation store, but OpenSSF Scorecard's Signed-Releases check only
      # inspects *release assets*. Copy the generated Sigstore bundle (a real,
      # verifiable in-toto provenance attestation) into the release so it ships
      # as a `.sigstore` asset the check recognises. The `bundle-path` is an
      # OUTPUT of the action (passing it as an input is a no-op).
      - name: Stage provenance bundle as a release asset
        run: cp "${{ steps.attest.outputs.bundle-path }}" release/provenance.sigstore

      - name: Install git-cliff
        uses: taiki-e/install-action@d8ae1fa96886bc82c05515b8ac15b41515da2c6d # git-cliff

      - name: Generate release notes from commits
        run: |
          set -euo pipefail
          # Grouping and the catch-all live in cliff.toml, so a commit type
          # nobody thought about lands under "Other changes" instead of
          # disappearing — which is how the GPL-3.0 relicense went missing from
          # the v0.3.2 notes.
          git-cliff --current --strip header --output RELEASE_NOTES.md

          TAG="${GITHUB_REF#refs/tags/}"
          PREV=$(git describe --tags --abbrev=0 --match 'v[0-9]*' "${TAG}^" 2>/dev/null || true)
          if [ -n "$PREV" ]; then
            printf '\n**Full Changelog**: https://github.com/%s/compare/%s...%s\n' \
              "$GITHUB_REPOSITORY" "$PREV" "$TAG" >> RELEASE_NOTES.md
          fi
          echo '----- generated release notes -----'
          cat RELEASE_NOTES.md

          body_path: RELEASE_NOTES.md
          files: |
            release/*.deb
            release/*.rpm
            release/*.tar.gz
            release/SHA256SUMS
            release/provenance.sigstore
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # SLSA build provenance as a signed `multiple.intoto.jsonl`, attached to the
  # release. This is what earns Scorecard's Signed-Releases 10/10 tier (which
  # specifically requires a SLSA provenance file), on top of the `.sigstore`
  # bundle above.
  #
  # NOTE: the reusable workflow MUST be pinned to a version *tag*, not a SHA —
  # slsa-verifier derives the trusted builder identity from the tag ref, so a
  # SHA pin would make the generated provenance unverifiable. This is the one
  # sanctioned exception to our "pin actions by SHA" rule.
  provenance:
    needs: [release]
    permissions:
      actions: read # read the workflow ref that becomes the provenance builder id
      id-token: write # keyless Sigstore signing
      contents: write # upload the .intoto.jsonl asset to the release
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: ${{ needs.release.outputs.hashes }}
      upload-assets: true
      upload-tag-name: ${{ github.ref_name }}