release.yaml

name: goreleaser

on:
    workflow_dispatch:
    push:
        tags: ["v*"]

permissions:
    contents: read

jobs:
    goreleaser:
        runs-on: ubuntu-latest
        permissions:
            contents: write
            actions: read
            id-token: write
            attestations: write
        steps:
            - name: Checkout
              uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
              with:
                  fetch-depth: 0
                  ref: ${{ github.sha }}

            - name: Require the complete validation matrix for this exact commit
              env:
                  GH_TOKEN: ${{ github.token }}
              shell: bash
              run: |
                  set -euo pipefail
                  gate() {
                    local workflow="$1" summary_job="$2"
                    local runs run run_id attempt url jobs
                    runs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/workflows/${workflow}/runs?head_sha=${GITHUB_SHA}&per_page=100") \
                      || { echo "::error::cannot list ${workflow} runs for ${GITHUB_SHA}"; exit 1; }
                    run=$(jq -c '[.[].workflow_runs[] | select(.status == "completed" and .conclusion == "success")] | sort_by(.updated_at) | last // empty' <<<"$runs")
                    if [ -z "$run" ]; then
                      echo "::error::no completed successful ${workflow} run exists for ${GITHUB_SHA}; dispatch it at this commit before tagging"
                      exit 1
                    fi
                    run_id=$(jq -r '.id' <<<"$run")
                    attempt=$(jq -r '.run_attempt' <<<"$run")
                    url=$(jq -r '.html_url' <<<"$run")
                    jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${run_id}/jobs?per_page=100") \
                      || { echo "::error::cannot list the jobs of run ${run_id}"; exit 1; }
                    if ! jq -e --arg job "$summary_job" '[.[].jobs[] | select(.name == $job and .conclusion == "success")] | length == 1' <<<"$jobs" >/dev/null; then
                      echo "::error::required summary job '${summary_job}' is not successful in ${url}"
                      exit 1
                    fi
                    echo "accepted ${workflow} run ${run_id} (attempt ${attempt}) for ${GITHUB_SHA}: ${url}" | tee -a "$GITHUB_STEP_SUMMARY"
                  }
                  gate jobs.yaml "Required matrix"
                  gate vulncheck.yaml "Required vulnerability checks"

            - name: Verify tagged release ref
              shell: bash
              run: |
                  set -euo pipefail
                  if [[ "${GITHUB_REF_TYPE}" != "tag" || "${GITHUB_REF_NAME}" != v* ]]; then
                    echo "Releases must run from a v* tag, not ${GITHUB_REF}." >&2
                    exit 1
                  fi
                  if [[ "$(git rev-list -n 1 "${GITHUB_REF_NAME}")" != "${GITHUB_SHA}" ]]; then
                    echo "${GITHUB_REF_NAME} does not resolve to ${GITHUB_SHA}." >&2
                    exit 1
                  fi
                  release_version="${GITHUB_REF_NAME#v}"
                  grep -Fqx "## Release ${GITHUB_REF_NAME}" CHANGELOG.md
                  grep -Fqx "export const version = \"${release_version}\";" web-app/src/version.tsx

            - name: Set up Go
              uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
              with:
                  go-version-file: "go.mod"
                  cache: true

            - name: Verify maintained dependency releases
              env:
                  GH_TOKEN: ${{ github.token }}
              run: hack/deps-release-check.sh online

            - name: Set up Node
              uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.0.0
              with:
                  node-version-file: ".nvmrc"

            - name: Verify embedded web assets
              working-directory: web-app
              run: |
                  set -euo pipefail
                  corepack enable
                  yarn install --immutable
                  yarn build
                  ./optimize-embed.sh
                  git diff --exit-code -- build src/version.tsx
                  RELEASE_METADATA_MUST_BE_FINAL=1 yarn exec playwright test --project=unit e2e/version-metadata.unit.ts --reporter=line

            - name: Verify clean checkout
              run: |
                  set -euo pipefail
                  if [ -n "$(git status --porcelain)" ]; then
                    echo "Refusing to release from a dirty working tree:" >&2
                    git status --porcelain >&2
                    exit 1
                  fi

            - name: Login to Docker Hub
              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKERHUB_USERNAME }}
                  password: ${{ secrets.DOCKERHUB_TOKEN }}

            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
              with:
                  version: v0.36.1

            - name: Install Cosign
              uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
              with:
                  cosign-release: v3.1.3

            - name: Install Syft
              uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
              with:
                  syft-version: v1.51.1

            - name: Refuse to overwrite a published release
              env:
                  GH_TOKEN: ${{ github.token }}
              run: |
                  set -euo pipefail
                  if release=$(gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${GITHUB_REF_NAME}"); then
                    jq -e '.draft == true' <<<"$release"
                  else
                    jq -e '.status == "404"' <<<"$release"
                  fi

            - name: Run GoReleaser
              uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
              with:
                  version: v2.17.1
                  args: release --clean
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

            - name: Verify checksum signatures and resolve the immutable image
              id: image
              env:
                  GH_TOKEN: ${{ github.token }}
              run: |
                  set -euo pipefail
                  identity="https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release.yaml@${GITHUB_REF}"
                  issuer="https://token.actions.githubusercontent.com"
                  for checksum in dist/*_checksums.txt; do
                    cosign verify-blob --bundle "${checksum}.sigstore.json" --certificate-identity "$identity" --certificate-oidc-issuer "$issuer" "$checksum"
                  done
                  image="docker.io/${GITHUB_REPOSITORY}"
                  digest=$(docker buildx imagetools inspect "$image:${GITHUB_REF_NAME}" --format '{{.Manifest.Digest}}')
                  [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]
                  cosign verify --certificate-identity "$identity" --certificate-oidc-issuer "$issuer" "$image@$digest"
                  echo "name=$image" >> "$GITHUB_OUTPUT"
                  echo "digest=$digest" >> "$GITHUB_OUTPUT"
                  syft scan "registry:$image@$digest" -o spdx-json=dist/image.spdx.json --quiet
                  cosign attest --yes --type spdxjson --predicate dist/image.spdx.json "$image@$digest"
                  cosign verify-attestation --type spdxjson --certificate-identity "$identity" --certificate-oidc-issuer "$issuer" "$image@$digest"
                  gh release upload "$GITHUB_REF_NAME" dist/image.spdx.json --clobber

            - name: Attest the checksum manifest
              uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
              with:
                  subject-path: dist/*_checksums.txt

            - name: Attest the OCI image
              uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
              with:
                  subject-name: ${{ steps.image.outputs.name }}
                  subject-digest: ${{ steps.image.outputs.digest }}
                  push-to-registry: true

            - name: Verify provenance before the draft is ready to publish
              env:
                  GH_TOKEN: ${{ github.token }}
                  IMAGE: ${{ steps.image.outputs.name }}
                  DIGEST: ${{ steps.image.outputs.digest }}
              run: |
                  set -euo pipefail
                  for checksum in dist/*_checksums.txt; do
                    gh attestation verify "$checksum" --repo "$GITHUB_REPOSITORY"
                  done
                  gh attestation verify "oci://$IMAGE@$DIGEST" --repo "$GITHUB_REPOSITORY"
                  echo "Draft assets, signatures, SBOMs and provenance verified. Publishing this draft enables the separate latest-image promotion gate." >> "$GITHUB_STEP_SUMMARY"