NotAlterra/.github/workflows/release.yml

name: CI

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

permissions: read-all

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - run: cargo check --workspace
      - run: cargo test --workspace
      - run: cargo clippy --workspace -- -D warnings
      - run: |
          cargo install cargo-audit cargo-deny
          cargo audit
          cargo deny check advisories bans
      - run: cargo doc --no-deps --document-private-items --workspace
      - name: Upload doc artifact
        if: github.ref == 'refs/heads/main'
        uses: actions/upload-pages-artifact@v5
        with:
          path: target/doc

  pages:
    needs: check
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pages: write
      id-token: write
    steps:
      - uses: actions/deploy-pages@v5

  build:
    needs: check
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Install Windows target
        run: |
          rustup target add x86_64-pc-windows-gnu
          sudo apt-get update && sudo apt-get install -y mingw-w64
      - name: Build Linux
        run: cargo build --release
      - name: Build Windows
        run: cargo build --release --target x86_64-pc-windows-gnu
      - name: Package
        run: |
          mkdir -p builds
          cp target/release/notalterra notalterra
          tar -czf builds/notalterra-${GITHUB_REF_NAME}-linux-amd64.tar.gz notalterra
          cp target/x86_64-pc-windows-gnu/release/notalterra.exe NotAlterra.exe
          zip -q builds/notalterra-${GITHUB_REF_NAME}-windows-x64.zip NotAlterra.exe
      - name: Generate SBOM
        uses: anchore/sbom-action@v0.17.0
        with:
          path: .
          format: cyclonedx-json
          output-file: builds/notalterra-${{ github.ref_name }}-sbom.cdx.json
      - name: Clean up extra SBOM
        run: rm -f builds/NotAlterra-build.cyclonedx.json
      - name: Generate hashes
        id: hash
        run: |
          set -e
          cd builds
          hashes=$(sha256sum * | base64 -w0)
          echo "hashes=$hashes" >> "$GITHUB_OUTPUT"
      - name: Upload binaries as artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-binaries
          path: builds/

  provenance:
    needs: build
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      id-token: write
      contents: write
      actions: read
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      base64-subjects: "${{ needs.build.outputs.hashes }}"
      upload-assets: false

  release:
    needs: [build, provenance]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: builds/
      - name: Rename duplicate SBOM
        run: |
          src=$(find builds -name "NotAlterra-build.cyclonedx.json" -type f 2>/dev/null | head -1)
          if [ -n "$src" ]; then
            mv "$src" "builds/NotAlterra-${GITHUB_REF_NAME}-sbom.cdx.json"
          fi
      - name: Create draft release
        uses: softprops/action-gh-release@v2
        with:
          files: builds/*/*
          body_path: _release.md
          draft: true