release.yml

name: Release

on:
  workflow_run:
    workflows: [CI]
    branches: [main]
    types: [completed]
  workflow_dispatch:

permissions:
  contents: write
  issues: write
  pull-requests: write
  id-token: write

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release:
    name: Semantic release
    if: >-
      github.event_name == 'workflow_dispatch' ||
      github.event.workflow_run.conclusion == 'success'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v7
        with:
          node-version: "22"
          cache: pnpm

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Install release tooling
        run: pnpm install --frozen-lockfile --ignore-scripts

      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: pnpm exec semantic-release

      # A bill of materials for what actually ships, and a signature over it.
      #
      # The interesting claim about this package is not its dependency tree: it is
      # that the tree is empty. Nothing here imports anything outside the standard
      # library at runtime. That is worth being able to check rather than assert,
      # so the SBOM is generated from a fresh environment holding nothing but this
      # package, and the step after it fails if anything else turns up. pip is
      # expected, because creating an environment puts it there; a second name
      # beside it would mean this package grew a dependency.
      - name: Describe what ships
        run: |
          python -m venv .sbom
          .sbom/bin/pip install --quiet --disable-pip-version-check .
          python -m pip install --disable-pip-version-check cyclonedx-bom==6.0.0
          python -m cyclonedx_py environment .sbom \
            --output-format json --outfile sbom.json
        shell: bash

      - name: Nothing ships but the package itself
        run: |
          python - <<'CHECK'
          import json
          import sys
          from pathlib import Path

          held = json.loads(Path("sbom.json").read_text())
          named = sorted(one["name"] for one in held.get("components", ()))
          allowed = {"pip", "snesdsp"}
          extra = [one for one in named if one not in allowed]
          print(f"components: {', '.join(named) or 'none'}")
          if extra:
              print(f"::error title=New runtime dependency::{', '.join(extra)}")
              sys.exit(1)
          CHECK
        shell: bash

      # Keyless, so verifying it needs no key from anybody here. What the
      # signature binds is this workflow in this repository, which is the only
      # thing worth binding: it says the file came from the build rather than from
      # somebody's laptop.
      - name: Sign it
        run: |
          python -m pip install --disable-pip-version-check sigstore==4.5.0
          python -m sigstore sign sbom.json --bundle sbom.json.sigstore.json
        shell: bash

      - name: Attach both to the release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          tag=$(git describe --tags --abbrev=0 2>/dev/null || true)
          if [ -z "${tag}" ]; then
            echo "::notice title=No tag::Nothing was released, so there is nothing to attach."
            exit 0
          fi
          gh release upload "${tag}" sbom.json sbom.json.sigstore.json --clobber
        shell: bash