release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions: read-all

jobs:
  build:
    name: Build & Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      attestations: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.26"
          cache-dependency-path: go.sum

      - name: Extract version from tag
        id: version
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Build binaries
        env:
          VERSION: ${{ steps.version.outputs.VERSION }}
        run: |
          mkdir -p build

          # Bare metal binaries (no client-go, ~7MB)
          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
            -ldflags "-s -w -X main.version=${VERSION}" \
            -o build/defensia-agent-linux-amd64 \
            ./cmd/defensia-agent

          CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build \
            -ldflags "-s -w -X main.version=${VERSION}" \
            -o build/defensia-agent-linux-arm64 \
            ./cmd/defensia-agent

          # K8s binaries (includes client-go, ~33MB)
          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
            -tags kubernetes \
            -ldflags "-s -w -X main.version=${VERSION}" \
            -o build/defensia-agent-linux-amd64-k8s \
            ./cmd/defensia-agent

          CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build \
            -tags kubernetes \
            -ldflags "-s -w -X main.version=${VERSION}" \
            -o build/defensia-agent-linux-arm64-k8s \
            ./cmd/defensia-agent

      - name: Generate checksums
        working-directory: build
        run: |
          sha256sum defensia-agent-linux-amd64 > defensia-agent-linux-amd64.sha256
          sha256sum defensia-agent-linux-arm64 > defensia-agent-linux-arm64.sha256
          sha256sum defensia-agent-linux-amd64-k8s > defensia-agent-linux-amd64-k8s.sha256
          sha256sum defensia-agent-linux-arm64-k8s > defensia-agent-linux-arm64-k8s.sha256
          cat *.sha256 > checksums.txt

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Sign release artifacts
        env:
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
        working-directory: build
        run: |
          cosign sign-blob --key env://COSIGN_PRIVATE_KEY --yes \
            --output-signature defensia-agent-linux-amd64.sig \
            defensia-agent-linux-amd64
          cosign sign-blob --key env://COSIGN_PRIVATE_KEY --yes \
            --output-signature defensia-agent-linux-arm64.sig \
            defensia-agent-linux-arm64
          cosign sign-blob --key env://COSIGN_PRIVATE_KEY --yes \
            --output-signature defensia-agent-linux-amd64-k8s.sig \
            defensia-agent-linux-amd64-k8s
          cosign sign-blob --key env://COSIGN_PRIVATE_KEY --yes \
            --output-signature defensia-agent-linux-arm64-k8s.sig \
            defensia-agent-linux-arm64-k8s
          cosign sign-blob --key env://COSIGN_PRIVATE_KEY --yes \
            --output-signature checksums.txt.sig \
            checksums.txt

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: |
            build/defensia-agent-linux-amd64
            build/defensia-agent-linux-arm64
            build/defensia-agent-linux-amd64-k8s
            build/defensia-agent-linux-arm64-k8s

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          token: ${{ secrets.BOT_TOKEN }}
          name: ${{ steps.version.outputs.VERSION }}
          fail_on_unmatched_files: true
          make_latest: true
          body: |
            ## Defensia Agent ${{ steps.version.outputs.VERSION }}

            ### Install
            ```bash
            curl -fsSL https://defensia.cloud/install.sh | sudo bash -s -- --token <YOUR_TOKEN>
            ```

            ### Docker
            ```bash
            docker run -d --privileged --net=host --pid=host \
              -v /var/log:/var/log:ro \
              -v /var/run/docker.sock:/var/run/docker.sock:ro \
              -e DEFENSIA_TOKEN=<YOUR_TOKEN> \
              ghcr.io/defensia/agent:${{ steps.version.outputs.VERSION }}
            ```

            ### Manual download
            | Platform | Binary |
            |---|---|
            | Linux x86_64 | `defensia-agent-linux-amd64` |
            | Linux ARM64  | `defensia-agent-linux-arm64` |
            | Linux x86_64 (K8s) | `defensia-agent-linux-amd64-k8s` |
            | Linux ARM64 (K8s)  | `defensia-agent-linux-arm64-k8s` |

          files: |
            build/defensia-agent-linux-amd64
            build/defensia-agent-linux-amd64.sha256
            build/defensia-agent-linux-amd64.sig
            build/defensia-agent-linux-arm64
            build/defensia-agent-linux-arm64.sha256
            build/defensia-agent-linux-arm64.sig
            build/defensia-agent-linux-amd64-k8s
            build/defensia-agent-linux-amd64-k8s.sha256
            build/defensia-agent-linux-amd64-k8s.sig
            build/defensia-agent-linux-arm64-k8s
            build/defensia-agent-linux-arm64-k8s.sha256
            build/defensia-agent-linux-arm64-k8s.sig
            build/checksums.txt
            build/checksums.txt.sig
            install.sh

  docker:
    name: Docker Image
    runs-on: ubuntu-latest
    needs: build
    permissions:
      packages: write
      id-token: write
      attestations: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Extract version from tag
        id: version
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Set up QEMU (multi-arch)
        uses: docker/setup-qemu-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
        continue-on-error: true

      - name: Build and push
        id: docker-build
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          platforms: linux/amd64,linux/arm64
          build-args: |
            VERSION=${{ steps.version.outputs.VERSION }}
            BUILD_TAGS=kubernetes
          tags: |
            ghcr.io/defensia/agent:latest
            ghcr.io/defensia/agent:${{ steps.version.outputs.VERSION }}
            defensiacloud/agent:latest
            defensiacloud/agent:${{ steps.version.outputs.VERSION }}
          labels: |
            org.opencontainers.image.title=Defensia Agent
            org.opencontainers.image.description=Real-time attack detection and blocking for Linux servers
            org.opencontainers.image.vendor=Defensia
            org.opencontainers.image.source=https://github.com/defensia/agent
            org.opencontainers.image.version=${{ steps.version.outputs.VERSION }}

      - name: Attest Docker image provenance
        uses: actions/attest-build-provenance@v2
        with:
          subject-name: ghcr.io/defensia/agent
          subject-digest: ${{ steps.docker-build.outputs.digest }}
          push-to-registry: true

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Sign Docker image
        env:
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
        run: |
          cosign sign --key env://COSIGN_PRIVATE_KEY \
            --yes \
            ghcr.io/defensia/agent@${{ steps.docker-build.outputs.digest }}

  helm:
    name: Helm Chart
    runs-on: ubuntu-latest
    needs: build
    permissions:
      packages: write
      id-token: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Extract version from tag
        id: version
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Update Chart appVersion
        run: |
          sed -i "s/^appVersion:.*/appVersion: \"${{ steps.version.outputs.VERSION }}\"/" charts/defensia-agent/Chart.yaml

      - name: Login to GHCR (Helm)
        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Login to GHCR (Docker/Cosign)
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Import GPG key
        run: |
          echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import
          gpg --export-secret-keys > /tmp/secring.gpg

      - name: Package chart (signed)
        run: |
          helm package charts/defensia-agent \
            --sign --key "Defensia" --keyring /tmp/secring.gpg \
            -d /tmp/charts

      - name: Install oras
        run: |
          curl -sLO https://github.com/oras-project/oras/releases/download/v1.2.2/oras_1.2.2_linux_amd64.tar.gz
          tar xzf oras_1.2.2_linux_amd64.tar.gz -C /usr/local/bin oras
          rm oras_1.2.2_linux_amd64.tar.gz

      - name: Push chart with provenance to GHCR
        id: helm-push
        run: |
          CHART_VERSION=$(grep '^version:' charts/defensia-agent/Chart.yaml | awk '{print $2}')
          CHART_TGZ="/tmp/charts/defensia-agent-${CHART_VERSION}.tgz"
          CHART_PROV="${CHART_TGZ}.prov"

          # Push chart normally (creates correct Helm OCI manifest)
          OUTPUT=$(helm push "${CHART_TGZ}" oci://ghcr.io/defensia/charts 2>&1)
          echo "$OUTPUT"
          DIGEST=$(echo "$OUTPUT" | grep -oP 'sha256:[a-f0-9]+')
          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"

          # Upload .prov blob to registry
          PROV_BLOB_OUTPUT=$(oras blob push ghcr.io/defensia/charts/defensia-agent "${CHART_PROV}" 2>&1)
          echo "$PROV_BLOB_OUTPUT"
          PROV_DIGEST=$(echo "$PROV_BLOB_OUTPUT" | grep -oP 'sha256:[a-f0-9]+' | head -1)
          PROV_SIZE=$(wc -c < "${CHART_PROV}" | tr -d ' ')

          # Fetch manifest, add .prov as layer, re-push
          # (oras attach uses referrers API which GHCR doesn't support)
          oras manifest fetch ghcr.io/defensia/charts/defensia-agent:${CHART_VERSION} > /tmp/manifest.json

          jq --arg digest "${PROV_DIGEST}" \
             --argjson size ${PROV_SIZE} \
             '.layers += [{"mediaType": "application/vnd.cncf.helm.chart.provenance.v1.prov", "digest": $digest, "size": $size}]' \
             /tmp/manifest.json > /tmp/manifest-signed.json

          oras manifest push \
            --media-type "application/vnd.oci.image.manifest.v1+json" \
            ghcr.io/defensia/charts/defensia-agent:${CHART_VERSION} \
            /tmp/manifest-signed.json