release.yml

name: Release Binaries

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing release tag to build, for example v1.1.0"
        required: true
        type: string

permissions:
  contents: write

jobs:
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            archive_ext: tar.gz
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            archive_ext: zip
          - os: macos-13
            target: x86_64-apple-darwin
            archive_ext: tar.gz
          - os: macos-14
            target: aarch64-apple-darwin
            archive_ext: tar.gz
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag || github.ref_name }}

      - name: Install Rust toolchain
        run: rustup toolchain install 1.95.0 --profile minimal

      - name: Add Rust target
        run: rustup target add ${{ matrix.target }}

      - name: Build release binary
        run: cargo build --release --locked --target ${{ matrix.target }} -p cerberus-cli

      - name: Package artifact
        shell: pwsh
        env:
          TARGET: ${{ matrix.target }}
          TAG_NAME: ${{ inputs.tag || github.ref_name }}
          ARCHIVE_EXT: ${{ matrix.archive_ext }}
        run: |
          $ErrorActionPreference = "Stop"
          $packageName = "cerberus-$env:TAG_NAME-$env:TARGET"
          $dist = Join-Path "dist" $packageName
          New-Item -ItemType Directory -Path $dist | Out-Null

          $binary = if ($env:TARGET -like "*windows*") { "cerberus.exe" } else { "cerberus" }
          Copy-Item "target/$env:TARGET/release/$binary" "$dist/$binary"
          Copy-Item "README.md" "$dist/README.md"
          Copy-Item "LICENSE" "$dist/LICENSE"

          if ($env:ARCHIVE_EXT -eq "zip") {
            Compress-Archive -Path "$dist/*" -DestinationPath "dist/$packageName.zip" -Force
          } else {
            tar -czf "dist/$packageName.tar.gz" -C "dist" $packageName
          }

      - name: Upload build artifact
        uses: actions/upload-artifact@v4
        with:
          name: cerberus-${{ matrix.target }}
          path: dist/cerberus-${{ inputs.tag || github.ref_name }}-${{ matrix.target }}.${{ matrix.archive_ext }}
          if-no-files-found: error

  publish:
    name: Publish GitHub release assets
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@v4

      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: Publish assets
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ inputs.tag || github.ref_name }}
        run: |
          set -euo pipefail

          cat > release-notes.md <<'NOTES'
          Hardened Static CT checkpoint verification, monitoring durability, DNS enrichment, webhook signing, packaging, docs, CI, and dependency policy.

          Prebuilt binaries are attached for Linux x86_64, Windows x86_64, macOS x86_64, and macOS ARM64.
          NOTES

          if gh release view "$TAG_NAME" >/dev/null 2>&1; then
            gh release upload "$TAG_NAME" dist/* --clobber
          else
            gh release create "$TAG_NAME" dist/* \
              --verify-tag \
              --title "$TAG_NAME - Static CT verification hardening" \
              --notes-file release-notes.md
          fi