release.yml

name: Release protoc plugins

# Triggered by pushing a tag matching v*.
# Builds protoc-gen-buffa and protoc-gen-buffa-packaging for
# Linux (x86_64, aarch64), macOS (x86_64, aarch64), and Windows (x86_64).
# Creates a GitHub release with the binaries, SHA-256 checksums,
# SLSA build provenance attestations, and cosign signatures.

on:
  push:
    tags: ['v*']
  # Re-release an existing tag when the tag-triggered run failed for a
  # workflow-definition reason: a dispatch from main uses main's (fixed)
  # workflow file while building the tag's source, which a re-run of the
  # failed tag run cannot do (re-runs reuse the workflow file at the tag).
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing v* tag to build and release (e.g. v0.7.1)"
        required: true
        type: string

permissions:
  contents: write      # create releases and upload assets
  id-token: write      # Sigstore OIDC (cosign + GitHub attestations)
  attestations: write  # GitHub native attestation API

env:
  # Both binaries share the protoc-gen-buffa- prefix, so every glob
  # in the release/sign/attest steps that matches one matches both.
  BINARY_PREFIX: protoc-gen-buffa
  BINARIES: protoc-gen-buffa protoc-gen-buffa-packaging
  # The tag being released: the pushed tag, or the dispatch input.
  RELEASE_TAG: ${{ inputs.tag || github.ref_name }}

jobs:
  build:
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            name: linux-x86_64
            ext: ""
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
            name: linux-aarch64
            ext: ""
          - target: x86_64-apple-darwin
            os: macos-latest
            name: darwin-x86_64
            ext: ""
          - target: aarch64-apple-darwin
            os: macos-latest
            name: darwin-aarch64
            ext: ""
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            name: windows-x86_64
            ext: ".exe"

    runs-on: ${{ matrix.os }}
    defaults:
      run:
        shell: bash

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag || github.ref_name }}

      # Must name the same toolchain version as rust-toolchain.toml: that
      # file overrides the action-installed default when cargo runs, so a
      # cross-compile target installed on @stable is bypassed and the build
      # fails with E0463 (this bit the v0.7.1 darwin-x86_64 job). Keep in
      # sync with rust-toolchain.toml and ci.yml; bump together.
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@1.95
        with:
          targets: ${{ matrix.target }}

      # musl cross-compilation tools for Linux targets.
      - name: Install musl tools (Linux)
        if: contains(matrix.target, 'linux')
        env:
          TARGET: ${{ matrix.target }}
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools
          # For aarch64 cross-compilation
          if [[ "$TARGET" == "aarch64"* ]]; then
            sudo apt-get install -y gcc-aarch64-linux-gnu
            echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
          fi

      - name: Build
        env:
          TARGET: ${{ matrix.target }}
        run: |
          for bin in $BINARIES; do
            cargo build --release --target "$TARGET" --bin "$bin"
          done

      - name: Package
        env:
          TARGET: ${{ matrix.target }}
          PLATFORM_NAME: ${{ matrix.name }}
          EXT: ${{ matrix.ext }}
        run: |
          mkdir -p dist
          for bin in $BINARIES; do
            asset="${bin}-${RELEASE_TAG}-${PLATFORM_NAME}${EXT}"
            cp "target/${TARGET}/release/${bin}${EXT}" "dist/${asset}"
          done

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.name }}
          path: dist/*

  release:
    needs: build
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Generate checksums
        working-directory: artifacts
        run: |
          sha256sum ${{ env.BINARY_PREFIX }}-* > checksums-sha256.txt
          cat checksums-sha256.txt

      # GitHub-native signed SLSA provenance. Stored in the GitHub
      # attestation API, verifiable without downloading sig/pem:
      #   gh attestation verify <binary> --repo <owner>/buffa
      #
      # Runs before cosign so the glob matches only the binaries.
      - name: Attest build provenance
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: artifacts/${{ env.BINARY_PREFIX }}-*

      - name: Install cosign
        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1 (sha-pinned)

      - name: Sign artifacts with cosign (keyless)
        working-directory: artifacts
        env:
          BINARY_PREFIX: ${{ env.BINARY_PREFIX }}
        run: |
          for file in "${BINARY_PREFIX}"-*; do
            cosign sign-blob --yes \
              --output-signature "${file}.sig" \
              --output-certificate "${file}.pem" \
              "$file"
          done

      - name: Create GitHub release
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 (sha-pinned)
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          generate_release_notes: true
          files: |
            artifacts/${{ env.BINARY_PREFIX }}-*
            artifacts/checksums-sha256.txt