release.yaml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write
  id-token: write
  attestations: write
  artifact-metadata: write

jobs:
  release:
    name: Qualify and publish
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Check out the tagged source
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: false

      - name: Install Syft
        id: syft
        uses: anchore/sbom-action/download-syft@v0
        with:
          syft-version: v1.44.0

      - name: Load and verify the release signing key
        env:
          CODEFLY_RELEASE_SIGNING_KEY_PATH: ${{ runner.temp }}/codefly-release-signing-key.pem
          RELEASE_SIGNING_KEY: ${{ secrets.CODEFLY_RELEASE_SIGNING_KEY }}
        run: |
          set -euo pipefail
          umask 077
          printf '%s' "$RELEASE_SIGNING_KEY" > "$CODEFLY_RELEASE_SIGNING_KEY_PATH"
          openssl pkey -in "$CODEFLY_RELEASE_SIGNING_KEY_PATH" -check -noout
          key_fingerprint="$(
            openssl pkey -in "$CODEFLY_RELEASE_SIGNING_KEY_PATH" -pubout -outform DER |
              sha256sum | cut -d' ' -f1
          )"
          certificate_fingerprint="$(
            openssl x509 -in pkg/cliupdate/release-signing-cert.pem -pubkey -noout |
              openssl pkey -pubin -outform DER |
              sha256sum | cut -d' ' -f1
          )"
          test "$key_fingerprint" = "$certificate_fingerprint"

      - name: Qualify the clean tag
        env:
          CODEFLY_RELEASE_SIGNING_KEY_PATH: ${{ runner.temp }}/codefly-release-signing-key.pem
          RELEASE_TAG: ${{ github.ref_name }}
          SYFT_PATH: ${{ steps.syft.outputs.cmd }}
        run: |
          set -euo pipefail
          manifest_version="$(sed -n 's/^version:[[:space:]]*//p' pkg/cli/info.yaml)"
          test "$RELEASE_TAG" = "v$manifest_version"
          test "$(git rev-list -n 1 "$RELEASE_TAG")" = "$GITHUB_SHA"
          git diff --exit-code
          # The released Gateway imports Core's tree-sitter-backed project
          # inspection. Build inside the maintained cross image so the clean
          # tag is qualified with CGO and real compilers for every target.
          docker run --rm \
            -e CODEFLY_RELEASE_SIGNING_KEY_PATH \
            -e RELEASE_TAG \
            -v "$GITHUB_WORKSPACE:/workspace" \
            -v "$RUNNER_TEMP:$RUNNER_TEMP" \
            -v "$SYFT_PATH:/usr/local/bin/syft:ro" \
            -w /workspace \
            ghcr.io/goreleaser/goreleaser-cross:v1.26.4 \
            check
          docker run --rm \
            -e CODEFLY_RELEASE_SIGNING_KEY_PATH \
            -e RELEASE_TAG \
            -v "$GITHUB_WORKSPACE:/workspace" \
            -v "$RUNNER_TEMP:$RUNNER_TEMP" \
            -v "$SYFT_PATH:/usr/local/bin/syft:ro" \
            -w /workspace \
            ghcr.io/goreleaser/goreleaser-cross:v1.26.4 \
            release --snapshot --clean

          for target in darwin:amd64 darwin:arm64 linux:amd64 linux:arm64; do
            goos="${target%%:*}"
            goarch="${target##*:}"
            jq -e --arg goos "$goos" --arg goarch "$goarch" \
              '[.[] | select(.type == "Archive" and .goos == $goos and .goarch == $goarch)] | length == 1' \
              dist/artifacts.json
          done
          jq -e '[.[] | select(.type == "SBOM")] | length == 4' dist/artifacts.json
          jq -e '[.[] | select(.type == "Signature")] | length == 1' dist/artifacts.json
          test -s dist/checksums.txt
          test -s dist/checksums.txt.sig

          openssl x509 -in pkg/cliupdate/release-signing-cert.pem -pubkey -noout > "$RUNNER_TEMP/codefly-release-public-key.pem"
          openssl dgst -sha256 \
            -verify "$RUNNER_TEMP/codefly-release-public-key.pem" \
            -signature dist/checksums.txt.sig \
            dist/checksums.txt
          (cd dist && sha256sum --check checksums.txt)

      - name: Publish the immutable release and Homebrew cask
        env:
          CODEFLY_RELEASE_SIGNING_KEY_PATH: ${{ runner.temp }}/codefly-release-signing-key.pem
          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
          GH_TOKEN: ${{ secrets.GH_PAT }}
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
          MACOS_SIGN_P12: ${{ secrets.CODEFLY_MACOS_SIGN_P12 }}
          MACOS_SIGN_PASSWORD: ${{ secrets.CODEFLY_MACOS_SIGN_PASSWORD }}
          MACOS_NOTARY_ISSUER_ID: ${{ secrets.CODEFLY_MACOS_NOTARY_ISSUER_ID }}
          MACOS_NOTARY_KEY_ID: ${{ secrets.CODEFLY_MACOS_NOTARY_KEY_ID }}
          MACOS_NOTARY_KEY: ${{ secrets.CODEFLY_MACOS_NOTARY_KEY }}
          RELEASE_TAG: ${{ github.ref_name }}
          SYFT_PATH: ${{ steps.syft.outputs.cmd }}
        run: |
          set -euo pipefail
          test "$(gh api "repos/codefly-dev/cli/commits/$RELEASE_TAG" --jq .sha)" = "$GITHUB_SHA"
          docker run --rm \
            -e CODEFLY_RELEASE_SIGNING_KEY_PATH \
            -e GITHUB_TOKEN \
            -e GH_TOKEN \
            -e HOMEBREW_TAP_GITHUB_TOKEN \
            -e MACOS_SIGN_P12 \
            -e MACOS_SIGN_PASSWORD \
            -e MACOS_NOTARY_ISSUER_ID \
            -e MACOS_NOTARY_KEY_ID \
            -e MACOS_NOTARY_KEY \
            -e RELEASE_TAG \
            -v "$GITHUB_WORKSPACE:/workspace" \
            -v "$RUNNER_TEMP:$RUNNER_TEMP" \
            -v "$SYFT_PATH:/usr/local/bin/syft:ro" \
            -w /workspace \
            ghcr.io/goreleaser/goreleaser-cross:v1.26.4 \
            release --clean

  attest:
    name: Attest published artifacts
    needs: release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      id-token: write
      attestations: write
      artifact-metadata: write
    steps:
      - name: Download published artifacts
        env:
          GH_TOKEN: ${{ secrets.GH_PAT }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/release-assets"
          gh release download "$RELEASE_TAG" \
            --repo codefly-dev/cli \
            --dir "$RUNNER_TEMP/release-assets" \
            --pattern "codefly_*.tar.gz" \
            --pattern "codefly_*.sbom.json" \
            --pattern checksums.txt

      - name: Attest released archives
        uses: actions/attest@v4
        with:
          subject-checksums: ${{ runner.temp }}/release-assets/checksums.txt

      - name: Attest published SBOMs
        uses: actions/attest@v4
        with:
          subject-path: "${{ runner.temp }}/release-assets/*.sbom.json"

  verify:
    name: Verify published release
    needs: attest
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Check out the tagged source
        uses: actions/checkout@v5

      - name: Verify the published release
        env:
          GH_TOKEN: ${{ secrets.GH_PAT }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          version="${RELEASE_TAG#v}"
          release_json="$(
            gh api \
              -H "X-GitHub-Api-Version: 2026-03-10" \
              "repos/codefly-dev/cli/releases/tags/$RELEASE_TAG"
          )"
          test "$(jq -r .immutable <<<"$release_json")" = "true"
          test "$(gh api "repos/codefly-dev/cli/commits/$RELEASE_TAG" --jq .sha)" = "$GITHUB_SHA"

          openssl x509 -in pkg/cliupdate/release-signing-cert.pem -pubkey -noout > "$RUNNER_TEMP/codefly-release-public-key.pem"

          for target in darwin_amd64 darwin_arm64 linux_amd64 linux_arm64; do
            archive="codefly_${version}_${target}.tar.gz"
            sbom="${archive}.sbom.json"
            jq -e --arg name "$archive" '[.assets[].name] | index($name) != null' <<<"$release_json"
            jq -e --arg name "$sbom" '[.assets[].name] | index($name) != null' <<<"$release_json"
          done
          for name in checksums.txt checksums.txt.sig; do
            jq -e --arg name "$name" '[.assets[].name] | index($name) != null' <<<"$release_json"
          done

          verify_dir="$(mktemp -d)"
          gh release download "$RELEASE_TAG" \
            --repo codefly-dev/cli \
            --dir "$verify_dir" \
            --pattern "codefly_${version}_*.tar.gz" \
            --pattern "codefly_${version}_*.sbom.json" \
            --pattern checksums.txt \
            --pattern checksums.txt.sig
          openssl dgst -sha256 \
            -verify "$RUNNER_TEMP/codefly-release-public-key.pem" \
            -signature "$verify_dir/checksums.txt.sig" \
            "$verify_dir/checksums.txt"
          (cd "$verify_dir" && sha256sum --check checksums.txt)
          for artifact in \
            "$verify_dir"/codefly_"${version}"_*.tar.gz \
            "$verify_dir"/codefly_"${version}"_*.sbom.json; do
            gh attestation verify "$artifact" --repo codefly-dev/cli
          done

          RELEASE_PRERELEASE="$(jq -r .prerelease <<<"$release_json")" \
            RELEASE_TAG="$RELEASE_TAG" \
            sh .github/scripts/verify-homebrew-cask.sh