release.yml

# SPDX-License-Identifier: MPL-2.0
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
#
# Release workflow — triggered by version tags (v*).
# Builds artifacts, generates changelog via git-cliff, creates a GitHub Release,
# and produces GitHub native build-provenance attestations (OIDC + Sigstore).
name: Release
on:
  push:
    tags:
      - 'v*'
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false
permissions:
  contents: read
jobs:
  build:
    name: Build Artifacts
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Detect project type and build
        id: build
        run: |
          # Auto-detect build system from project files.
          # Order matters: more specific markers checked first.
          if [ -f "mix.exs" ]; then
            echo "::notice::Detected Elixir/Gleam project (mix.exs)"
            echo "build_type=mix" >> "$GITHUB_OUTPUT"
            mix local.hex --force --if-missing
            mix local.rebar --force --if-missing
            mix deps.get --only prod
            MIX_ENV=prod mix release
          elif [ -f "Cargo.toml" ]; then
            echo "::notice::Detected Rust project (Cargo.toml)"
            echo "build_type=cargo" >> "$GITHUB_OUTPUT"
            cargo build --release
          elif [ -f "build.zig" ]; then
            echo "::notice::Detected Zig project (build.zig)"
            echo "build_type=zig" >> "$GITHUB_OUTPUT"
            zig build -Doptimize=ReleaseSafe
          elif [ -f "deno.json" ] || [ -f "deno.jsonc" ]; then
            echo "::notice::Detected Deno project (deno.json)"
            echo "build_type=deno" >> "$GITHUB_OUTPUT"
            deno task build
          elif [ -f "gossamer.conf.json" ]; then
            echo "::notice::Detected Gossamer project (gossamer.conf.json)"
            echo "build_type=gossamer" >> "$GITHUB_OUTPUT"
            gossamer build
          elif [ -f "gleam.toml" ]; then
            echo "::notice::Detected Gleam project (gleam.toml)"
            echo "build_type=gleam" >> "$GITHUB_OUTPUT"
            gleam build
          elif [ -f "rebar.config" ]; then
            echo "::notice::Detected Erlang/Rebar project (rebar.config)"
            echo "build_type=rebar" >> "$GITHUB_OUTPUT"
            rebar3 as prod release
          elif [ -f "Justfile" ] || [ -f "justfile" ]; then
            echo "::notice::Detected Justfile — running 'just build'"
            echo "build_type=just" >> "$GITHUB_OUTPUT"
            just build
          else
            echo "::error::No recognised build system found."
            echo "Expected one of: mix.exs, Cargo.toml, build.zig, deno.json, gossamer.conf.json, gleam.toml, rebar.config, Justfile"
            exit 1
          fi
        # TODO: Upload build artifacts if needed (pin actions/upload-artifact
        #   to a full commit SHA when enabling, per the SHA-pin policy):
        # - uses: actions/upload-artifact@<full-commit-sha>  # vX.Y.Z
        #   with:
        #     name: release-artifacts
        #     path: target/release/
  changelog:
    name: Generate Changelog
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    outputs:
      changelog: ${{ steps.cliff.outputs.content }}
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
      - name: Install git-cliff
        run: |
          curl -sSfL https://github.com/orhun/git-cliff/releases/latest/download/git-cliff-$(uname -m)-unknown-linux-gnu.tar.gz \
            | tar -xz --strip-components=1 -C /usr/local/bin/ git-cliff-*/git-cliff
      - name: Generate changelog for this release
        id: cliff
        run: |
          # Generate changelog for the current tag only
          CHANGELOG=$(git cliff --latest --strip header)
          # Write to output using delimiter to handle multiline
          {
            echo "content<<CLIFF_EOF"
            echo "$CHANGELOG"
            echo "CLIFF_EOF"
          } >> "$GITHUB_OUTPUT"
      - name: Update full CHANGELOG.md
        run: |
          git cliff --output CHANGELOG.md
      - name: Upload updated CHANGELOG.md
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: changelog
          path: CHANGELOG.md
          retention-days: 5
  release:
    name: Create GitHub Release
    needs: [build, changelog]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write
      id-token: write       # mint the OIDC token attestation provenance is signed with
      attestations: write   # write the build-provenance attestation (the "claim")
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      # TODO: Download build artifacts if uploading to the release (pin
      #   actions/download-artifact to a full commit SHA when enabling):
      # - uses: actions/download-artifact@<full-commit-sha>  # vX.Y.Z
      #   with:
      #     name: release-artifacts
      #     path: artifacts/
      - name: Create GitHub Release
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v2
        with:
          body: ${{ needs.changelog.outputs.changelog }}
          draft: false
          prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') }}
          generate_release_notes: false
          # TODO: Add artifact files to the release
          # files: |
          #   artifacts/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      # GitHub native artifact attestation (build provenance). Generates a
      # signed, verifiable claim binding each released artifact to this build
      # (commit, workflow, runner) via OIDC + Sigstore — verify with
      # `gh attest verify <artifact> --repo ${{ github.repository }}`.
      # Replaces the older SLSA-generator job; native attestations need no
      # separate isolated workflow.
      # TODO: point subject-path at the artifacts this release actually ships
      #   (must match the `files:` uploaded above, e.g. artifacts/*).
      - name: Attest build provenance
        if: ${{ hashFiles('artifacts/*') != '' }}   # skip until real artifacts are wired
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: 'artifacts/*'