release-assets.yml

name: Release Assets

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag to verify"
        required: true
        type: string
      draft:
        description: "Verify an unpublished draft release"
        required: true
        default: true
        type: boolean

permissions:
  # GitHub hides draft releases from read-only workflow tokens.
  contents: write

jobs:
  verify-macos-crawlctl:
    if: >-
      github.event_name == 'release' ||
      (endsWith(github.workflow_ref, format('@refs/heads/{0}', github.event.repository.default_branch)) &&
      github.ref == format('refs/heads/{0}', github.event.repository.default_branch))
    strategy:
      fail-fast: false
      matrix:
        include:
          - runs-on: macos-15
            arch: arm64
          - runs-on: macos-15-intel
            arch: x86_64
    runs-on: ${{ matrix.runs-on }}
    env:
      RELEASE_TAG: ${{ inputs.tag || github.event.release.tag_name }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          ref: ${{ github.event_name == 'release' && github.event.repository.default_branch || github.workflow_sha }}
          path: trusted
          persist-credentials: false

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: trusted/go.mod
          cache: false

      - name: Verify release provenance
        shell: bash
        run: |
          set -euo pipefail
          release_commit=$(trusted/scripts/verify-crawlctl-release-provenance.sh "$RELEASE_TAG")
          echo "RELEASE_COMMIT=$release_commit" >> "$GITHUB_ENV"

      - name: Download crawlctl assets
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          expected_draft=false
          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
            expected_draft="${{ inputs.draft }}"
          fi
          trusted/scripts/download-crawlctl-release-assets.sh \
            "$RELEASE_TAG" "${{ matrix.arch }}" "$expected_draft" artifacts

      - name: Verify Developer ID signatures
        shell: bash
        run: |
          set -euo pipefail
          archive="artifacts/crawlctl-${RELEASE_TAG}-macos-${{ matrix.arch }}.tar.gz"
          expected=("$archive" "$archive.sha256")
          for path in "${expected[@]}"; do
            test -f "$path"
          done
          trusted/scripts/verify-crawlctl-release.sh \
            "$RELEASE_TAG" "$RELEASE_COMMIT" "$archive"