release.yml

name: Release

on:
  push:
    branches: [main]

permissions:
  contents: write
  pull-requests: write

env:
  CARGO_TERM_COLOR: always

jobs:
  release-please:
    runs-on: ubuntu-latest
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
    steps:
      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
        id: release
        with:
          release-type: rust
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

  build:
    name: Build ${{ matrix.asset }}
    needs: release-please
    if: ${{ needs.release-please.outputs.release_created }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            asset: grape-linux
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            asset: grape-windows.exe
          - target: aarch64-apple-darwin
            os: macos-latest
            asset: grape-macos
          - target: x86_64-apple-darwin
            os: macos-latest
            asset: grape-macos-x86

    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable branch
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          key: ${{ matrix.target }}

      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libgtk-3-dev \
            libxdo-dev \
            libdbus-1-dev \
            libasound2-dev \
            libglib2.0-dev \
            pkg-config

      - name: Build
        run: cargo build --release --target ${{ matrix.target }}

      - name: Stage binary (Unix)
        if: runner.os != 'Windows'
        run: cp target/${{ matrix.target }}/release/grape ${{ matrix.asset }}

      - name: Stage binary (Windows)
        if: runner.os == 'Windows'
        run: copy target\${{ matrix.target }}\release\grape.exe ${{ matrix.asset }}

      - name: Upload binary to GitHub Release
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          tag_name: ${{ needs.release-please.outputs.tag_name }}
          files: ${{ matrix.asset }}

  # Sign every release asset with the Project-Colony org key (ed25519).
  # Colony >= 0.8.0 verifies these signatures on install and REFUSES a
  # tampered asset; the job fails the release if the secret is missing so
  # an unsigned release cannot ship silently.
  sign:
    name: Sign release assets
    needs: [release-please, build]
    if: ${{ needs.release-please.outputs.release_created }}
    runs-on: ubuntu-latest
    steps:
      - name: Download release binaries
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.release-please.outputs.tag_name }}
        run: |
          mkdir dist
          gh release download "$TAG" -R "${{ github.repository }}" --dir dist
          # Metadata companions are not signable assets.
          rm -f dist/*.sig dist/*.sha256 dist/*.txt dist/*.yml dist/*.json dist/*.asc

      - name: Sign
        env:
          KEY: ${{ secrets.COLONY_SIGNING_KEY_PEM }}
        run: |
          if [ -z "$KEY" ]; then
            echo "::error::COLONY_SIGNING_KEY_PEM is not available - the release would ship unsigned."
            exit 1
          fi
          printf '%s' "$KEY" > /tmp/key.pem
          chmod 600 /tmp/key.pem
          pub=$(mktemp)
          openssl pkey -in /tmp/key.pem -pubout -out "$pub"
          for f in dist/*; do
            openssl pkeyutl -sign -inkey /tmp/key.pem -rawin -in "$f" -out "$f.sig"
            openssl pkeyutl -verify -pubin -inkey "$pub" -rawin -in "$f" -sigfile "$f.sig" >/dev/null
            echo "signed $(basename "$f")"
          done
          rm -f /tmp/key.pem

      - name: Upload signatures
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.release-please.outputs.tag_name }}
        # -R is not optional here. This job has no `actions/checkout`, so there
        # is no git repository for `gh` to infer the target from, and it dies
        # with "not a git repository" AFTER the assets have been signed. The
        # download step above already passes it; this one was missed, and the
        # release shipped unsigned while the job that was meant to prevent
        # exactly that reported the failure too late to stop it.
        run: gh release upload "$TAG" -R "${{ github.repository }}" dist/*.sig --clobber