release.yml

name: Build, tag and attach releases

on:
  release:
    types: [published]
  workflow_dispatch:

concurrency:
  # Cancel previous runs of this workflow if they are testing the same branch
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  create-phar:
    runs-on: ubuntu-latest
    name: Create Strauss phar on new release
    steps:
      - name: Resolve release tag
        id: resolve_release_tag
        uses: actions/github-script@v9
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            let tagName = context.payload.release?.tag_name;

            if (!tagName) {
              try {
                const latestRelease = await github.rest.repos.getLatestRelease({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                });
                tagName = latestRelease.data.tag_name;
              } catch (error) {
                core.setFailed(`Unable to determine the latest published release tag: ${error.message}`);
                return;
              }
            }

            if (!tagName) {
              core.setFailed('Unable to determine a release tag for this workflow run.');
              return;
            }

            core.info(`Using release tag ${tagName}`);
            core.setOutput('tag', tagName);

      - name: Git checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ steps.resolve_release_tag.outputs.tag }}

      - name: Install PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: 7.4
          tools: composer:v2
          extensions: fileinfo, gd

      - name: Install dependencies
        run: composer install --no-dev --prefer-dist --no-progress

      - name: "Edit `strauss/bin/strauss` to update the version number"
        env:
          CURRENT_RELEASE: ${{ steps.resolve_release_tag.outputs.tag }}
        run: |
          find bin -name 'strauss' -exec sed -i "s/}, '[[:digit:]]*\.[[:digit:]]*\.[[:digit:]]*');/}, '$CURRENT_RELEASE');/" {} +

      - name: Commit updated README.md
        uses: stefanzweifel/git-auto-commit-action@v7
        with:
          branch: master
          file_pattern: "bin/strauss"
          commit_message: "🤖 Update version number in bin"

      - name: Create .phar
        run: ./scripts/createphar.sh

      - name: Test run strauss
        run: php strauss.phar --version

      - name: Check version
        run: |
          TAG_NAME="${{ steps.resolve_release_tag.outputs.tag }}"
          CURRENT_VERSION="$(php strauss.phar --version | sed -e 's#^.\+ \([0-9.]\+\)$#\1#')"
          if [ "${TAG_NAME#v}" != "${CURRENT_VERSION}" ]; then
            echo "::error::Latest tag differs from current version"
            exit 10
          fi

      - name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@v7
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.PASSPHRASE }}

      # https://phar.io/howto/sign-and-upload-to-github.html
      # https://keys.openpgp.org/about/usage/
      # https://github.com/marketplace/actions/import-gpg
      # gpg --armor --export-secret-key BrianHenryIE@gmail.com | pbcopy
      # Specify exactly which key to export or it will export the first, expired key, and you will copy the wrong information to your secrets.
      # gpg --armor --export-secret-key BE6D3AB4AD637A11A26983AD3915D8F4028A0673 | pbcopy
      # TODO: command to pipe to gh CLI tool to set secret.
      - name: Check GPG key validity
        env:
          GPG_USER: ${{ secrets.GPG_USER }}
        run: |
          KEY_INFO="$(gpg --batch --list-secret-keys --with-colons "$GPG_USER" 2>/dev/null || true)"

          if [ -z "$KEY_INFO" ]; then
            echo "::error title=GPG key not available::Unable to find an imported secret GPG key for '$GPG_USER'."
            exit 1
          fi

          NOW="$(date +%s)"
          PARSED_KEY_INFO="$(printf '%s\n' "$KEY_INFO" | awk -F: -v now="$NOW" '
            $1=="sec" {
              total++;
              current_expiry=$7;
              current_valid=(current_expiry=="" || current_expiry=="0" || current_expiry>now);
              if (current_valid) {
                valid_total++;
              }
              next;
            }
            $1=="fpr" {
              if (current_valid && valid_fpr=="") {
                valid_fpr=$10;
                valid_expiry=current_expiry;
              }
              if (!current_valid && expired_fpr=="") {
                expired_fpr=$10;
                expired_expiry=current_expiry;
              }
              current_valid="";
              current_expiry="";
            }
            END {
              print "TOTAL_KEYS=" total+0;
              print "VALID_KEYS=" valid_total+0;
              print "KEY_FINGERPRINT=" valid_fpr;
              print "KEY_EXPIRY=" valid_expiry;
              print "EXPIRED_FINGERPRINT=" expired_fpr;
              print "EXPIRED_EXPIRY=" expired_expiry;
            }
          ')"

          TOTAL_KEYS="0"
          VALID_KEYS="0"
          KEY_FINGERPRINT=""
          KEY_EXPIRY=""
          EXPIRED_FINGERPRINT=""
          EXPIRED_EXPIRY=""
          while IFS='=' read -r PARSED_KEY PARSED_VALUE; do
            case "$PARSED_KEY" in
              TOTAL_KEYS) TOTAL_KEYS="$PARSED_VALUE" ;;
              VALID_KEYS) VALID_KEYS="$PARSED_VALUE" ;;
              KEY_FINGERPRINT) KEY_FINGERPRINT="$PARSED_VALUE" ;;
              KEY_EXPIRY) KEY_EXPIRY="$PARSED_VALUE" ;;
              EXPIRED_FINGERPRINT) EXPIRED_FINGERPRINT="$PARSED_VALUE" ;;
              EXPIRED_EXPIRY) EXPIRED_EXPIRY="$PARSED_VALUE" ;;
            esac
          done <<< "$PARSED_KEY_INFO"

          if [ "$TOTAL_KEYS" -eq 0 ]; then
            echo "::error title=GPG key not available::Unable to find an imported secret GPG key for '$GPG_USER'."
            exit 1
          fi

          if [ -z "$KEY_FINGERPRINT" ]; then
            if [ -n "$EXPIRED_EXPIRY" ] && [ "$EXPIRED_EXPIRY" != "0" ]; then
              EXPIRES_AT="$(date -u -d "@$EXPIRED_EXPIRY" '+%Y-%m-%d %H:%M:%S UTC')"
              echo "::error title=GPG key expired::Found $TOTAL_KEYS matching key(s) for '$GPG_USER', but all are expired (for example: $EXPIRED_FINGERPRINT expired on $EXPIRES_AT)."
            else
              echo "::error title=Unable to inspect imported GPG key::Found $TOTAL_KEYS matching key(s) for '$GPG_USER', but none could be validated for signing."
            fi
            echo "Rotate the signing key, update GPG_PRIVATE_KEY / GPG_USER / PASSPHRASE secrets, and rerun this workflow."
            echo "PHAR signing guide: https://phar.io/howto/sign-and-upload-to-github.html"
            echo "OpenPGP key publishing guide: https://keys.openpgp.org/about/usage/"
            exit 1
          fi

          if [ -n "$KEY_EXPIRY" ] && [ "$KEY_EXPIRY" != "0" ]; then
            if [ "$KEY_EXPIRY" -le "$NOW" ]; then
              EXPIRES_AT="$(date -u -d "@$KEY_EXPIRY" '+%Y-%m-%d %H:%M:%S UTC')"

              echo "::error title=GPG key expired::The imported GPG signing key $KEY_FINGERPRINT expired on $EXPIRES_AT."
              echo "Rotate the signing key, update GPG_PRIVATE_KEY / GPG_USER / PASSPHRASE secrets, and rerun this workflow."
              echo "PHAR signing guide: https://phar.io/howto/sign-and-upload-to-github.html"
              echo "OpenPGP key publishing guide: https://keys.openpgp.org/about/usage/"
              exit 1
            fi
          fi

          echo "SIGNING_KEY_FINGERPRINT=$KEY_FINGERPRINT" >> "$GITHUB_ENV"
          echo "Imported $TOTAL_KEYS matching key(s); using non-expired key $KEY_FINGERPRINT for signing."

      - name: Sign the PHAR
        run: |
          ls strauss.phar
          gpg --local-user ${{ secrets.GPG_USER }} \
              --batch \
              --yes \
              --passphrase="${{ secrets.PASSPHRASE }}" \
              --detach-sign \
              --output strauss.phar.asc \
              strauss.phar

      - uses: meeDamian/github-release@2.0
        with:
          tag: ${{ steps.resolve_release_tag.outputs.tag }}
          token: ${{ secrets.GITHUB_TOKEN }}
          files: |
            strauss.phar
            strauss.phar.asc
          gzip: false
          allow_override: true