release.yml

name: Release

on:
  # Traditional flow: push a bare tag `vX` (a human/PAT push triggers the gates
  # + build below). Do NOT create the release from the GitHub Releases UI — that
  # creates a published (immutable) release the build then can't attach to.
  push:
    tags:
      - "v*"
  # UI button (Actions → Release → Run workflow). Pick the branch to release and
  # optionally a version; the tag is created only AFTER the gates pass, so a
  # failing gate never leaves an orphan immutable tag. The tag is pushed with
  # GITHUB_TOKEN, which does not re-trigger this workflow (no double run).
  workflow_dispatch:
    inputs:
      version:
        description: "Version without leading v (blank = auto CalVer YYYYMMDD.NN)"
        required: false
        type: string

permissions:
  contents: write

jobs:
  # Resolve the version, tag and commit to release. On a tag push the tag already
  # exists; on dispatch we compute the version and validate the tag is free, but
  # DO NOT tag yet (the `tag` job below tags only after the gates pass).
  prepare:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.resolve.outputs.version }}
      tag: ${{ steps.resolve.outputs.tag }}
      sha: ${{ steps.resolve.outputs.sha }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
      - id: resolve
        # Untrusted dispatch input passed via env (never interpolated into the
        # script) to avoid shell injection.
        env:
          VERSION_INPUT: ${{ inputs.version }}
        run: go tool task release:resolve

  # Hermetic gates — the same task targets CI runs on every push/PR.
  # The release is blocked unless these pass.
  gate:
    runs-on: ubuntu-latest
    needs: prepare
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ needs.prepare.outputs.sha }}
          submodules: recursive
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
      # pnpm installs the reference, through the firewall (task reference); pnpm 11 needs Node 22.13+.
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 11.27.1
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
        with:
          node-version: "24"

      - run: go tool task lint
      - run: go tool task spec:compliance
      - run: go tool task vuln
      - run: go tool task test:race
      - run: go tool task coverage
      - run: go tool task test:integration
      - run: go tool task reference
      - run: go tool task parity:contract
      - run: go tool task parity:network

  # Runtime lane (real Docker containers). ubuntu-latest ships Docker.
  gate-runtime:
    # A tag push or a dispatch: this repository's own code, so spin-stack's docker8 fleet (see
    # go-cli.yml), where the whole runtime matrix is one job.
    runs-on: runs-on/fleet=docker8/env=production
    # e2e, the whole runtime matrix and publish parity in one job; the matrix alone is about 45
    # min on a 4-vCPU runner.
    timeout-minutes: 90
    needs: prepare
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ needs.prepare.outputs.sha }}
          submodules: recursive
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
      # pnpm installs the reference, through the firewall (task reference); pnpm 11 needs Node 22.13+.
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 11.27.1
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
        with:
          node-version: "24"
      # parity:runtime exports build cache (build.cache-to-*, build.output-oci-*),
      # which the default docker driver cannot do — its precondition fails ~1s in.
      # Reuse the same runner prep as the go-cli.yml runtime job, or a tagged
      # release stalls on a default-driver runner.
      - run: go tool task ci:prepare-runner

      - run: go tool task reference
      - run: go tool task test:e2e
      - run: go tool task parity:runtime
      # OCI publish parity (features/templates publish into a throwaway registry).
      # Runs daily in go-cli.yml; gate it on release too so a tag cannot ship a
      # regression in the publish path that daily CI would only catch afterwards.
      - run: go tool task parity:publish
      - if: always()
        run: go tool task clean

  # Create the tag ONLY on the dispatch path and ONLY after the gates pass, so a
  # failing gate never leaves an orphan (immutable) tag. On a tag push this job is
  # skipped (the tag already exists). The GITHUB_TOKEN push does not re-trigger the
  # workflow, so there is no second run.
  tag:
    runs-on: ubuntu-latest
    needs: [prepare, gate, gate-runtime]
    if: github.event_name == 'workflow_dispatch'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ needs.prepare.outputs.sha }}
          fetch-depth: 0
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
      - env:
          RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
          RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
        run: go tool task release:tag

  goreleaser:
    runs-on: ubuntu-latest
    needs: [prepare, gate, gate-runtime, tag]
    # `tag` is skipped on the push path, so gate on explicit success/skip rather
    # than the default all-succeeded semantics.
    if: |
      always() &&
      needs.gate.result == 'success' &&
      needs.gate-runtime.result == 'success' &&
      (needs.tag.result == 'success' || needs.tag.result == 'skipped')
    # Scoped least-privilege for the publishing job:
    #   contents: write  -> create the draft GitHub Release
    #   packages: write  -> push images to GHCR (ghcr.io/spin-stack/devcontainer-cli)
    #   id-token: write  -> cosign keyless (OIDC) signing of the pushed image
    permissions:
      contents: write
      packages: write
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          # Build at the tag so GoReleaser runs in release (not snapshot) mode.
          ref: ${{ needs.prepare.outputs.tag }}
          fetch-depth: 0
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod

      # syft powers the sboms: block in .goreleaser.yml and the image SBOM below.
      - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3

      # Multi-arch image build (arm64 emulated) + buildx driver for the
      # dockers:/docker_manifests: blocks in .goreleaser.yml.
      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      # GHCR login. Only reached on the tag path (this workflow is push.tags),
      # never on PRs, so images are pushed exclusively from an approved tag run.
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      # The released image's base, by digest from versions.yaml.
      - run: go tool task release:env

      - uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # --- Post-publish: smoke test, sign, and record the image digest. ---
      - name: Smoke test (docker run --version)
        env:
          RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
        run: go tool task release:smoke

      - name: Record image digest
        id: digest
        env:
          RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
        run: go tool task release:digest

      # Move the mutable :latest tag to this release's digest. Best-effort: a
      # `latest` tag is incompatible with GHCR immutable tags, so if the registry
      # rejects the update the versioned release still succeeds.
      - name: Update :latest (best-effort)
        continue-on-error: true
        env:
          RELEASE_DIGEST: ${{ steps.digest.outputs.digest }}
        run: go tool task release:latest

      # Image-level SBOM + keyless provenance signature (release:sign).
      - name: Sign image and attest SBOM (cosign keyless)
        env:
          RELEASE_DIGEST: ${{ steps.digest.outputs.digest }}
        run: go tool task release:sign

  # Non-gating: perf/distribution metrics recorded per release, never blocks.
  metrics:
    runs-on: ubuntu-latest
    needs: [prepare, goreleaser]
    continue-on-error: true
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ needs.prepare.outputs.tag }}
          submodules: recursive
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
      # pnpm installs the reference, through the firewall (task reference); pnpm 11 needs Node 22.13+.
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 11.27.1
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
        with:
          node-version: "24"

      - run: go tool task build:cross
      - run: go tool task reference
      - run: go tool task metrics
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        if: always()
        with:
          name: metrics
          path: artifacts/metrics.json
          if-no-files-found: warn