release-please.yml

---
name: Release Please

on:
  workflow_run:
    workflows: ["Tests"]
    types: [completed]
    branches: [main]
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  release-please:
    name: Release Please
    runs-on: ubuntu-24.04
    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
          fetch-depth: 2

      - name: Check for relevant changes
        id: check_changes
        if: github.event_name == 'workflow_run'
        run: |
          CHANGED=$(git diff --name-only HEAD^1 HEAD 2>/dev/null || git diff --name-only HEAD~1 HEAD 2>/dev/null || git log --name-only --pretty=format: HEAD | grep -v '^$' || true)
          if [ -z "$CHANGED" ]; then
            echo "::notice::Could not determine changed files. Proceeding with release check."
            echo "skip_release=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          RELEVANT=$(echo "$CHANGED" | grep -Ev '/$' | grep -Ev '\.(md)$|^(assets|demo|spec)/|^\.gitignore$|^\.luacheckrc$|^lefthook\.yml$' || true)
          if [ -z "$RELEVANT" ]; then
            echo "::notice::No relevant changes detected. Skipping release."
            echo "skip_release=true" >> "$GITHUB_OUTPUT"
          else
            echo "::notice::Relevant changes detected: $(echo "$RELEVANT" | tr '\n' ' ')"
            echo "skip_release=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Release Please
        if: ${{ !env.ACT && steps.check_changes.outputs.skip_release != 'true' }}
        uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4.1.3
        id: release
        with:
          token: ${{ secrets.PAT }}

  build-release:
    name: Build Release Artifacts
    needs: release-please
    if: ${{ needs.release-please.outputs.release_created == 'true' || needs.release-please.outputs.release_created == true }}
    strategy:
      matrix:
        include:
          - os: ubuntu-24.04
            name: linux-x86_64
            target: linux
          - os: ubuntu-24.04-arm
            name: linux-aarch64
            target: linux
          - os: macos-latest
            name: macos-arm64
            target: macos
          - os: macos-latest
            name: macos-x86_64
            target: macos
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
      id-token: write
      attestations: write
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install System Dependencies (Linux)
        if: matrix.target == 'linux'
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq build-essential cmake luarocks lua5.4 liblua5.4-dev

      - name: Install System Dependencies (macOS)
        if: matrix.target == 'macos'
        run: |
          brew install cmake luarocks lua@5.4

      - name: Install Lux
        uses: lumen-oss/gh-actions-lux@bd58f7b97fe2147910580a33b677efadf746e179 # v1.0.1
        with:
          version: 0.28.2

      - name: Install just
        uses: extractions/setup-just@dd310ad5a97d8e7b41793f8ef055398d51ad4de6 # v2.0.0

      - name: Build Executable (Linux)
        if: matrix.target == 'linux'
        run: |
          export LUA_PREFIX="/usr"
          MULTIARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH)
          export LUA_LIB="/usr/lib/${MULTIARCH}/liblua5.4.a"
          just build

      - name: Build Executable (macOS x86_64)
        if: matrix.target == 'macos' && matrix.name == 'macos-x86_64'
        run: |
          export LUA_VERSION="5.4"
          export MACOSX_DEPLOYMENT_TARGET="11.0"

          # Build Lua 5.4 from source for x86_64
          # (Homebrew lua@5.4 on ARM64 only provides arm64 libraries)
          LUA_SRC_DIR="${{ runner.temp }}/lua-5.4.7"
          curl -sL https://www.lua.org/ftp/lua-5.4.7.tar.gz | tar xz -C "${{ runner.temp }}"
          cd "$LUA_SRC_DIR"
          make macosx CC="clang -arch x86_64" AR="ar rc" MYCFLAGS="-arch x86_64" MYLDFLAGS="-arch x86_64"
          make local
          cd "${{ github.workspace }}"

          export LUA_PREFIX="$LUA_SRC_DIR/install"
          export LUA_LIB="$LUA_SRC_DIR/install/lib/liblua.a"
          export LUA_INCLUDE="$LUA_SRC_DIR/install/include"
          export CMAKE_OSX_ARCHITECTURES="x86_64"
          export CC="clang -arch x86_64"
          just build

      - name: Build Executable (macOS arm64)
        if: matrix.target == 'macos' && matrix.name == 'macos-arm64'
        run: |
          export LUA_VERSION="5.4"
          export LUA_PREFIX="$(brew --prefix lua@5.4)"
          export LUA_LIB="$LUA_PREFIX/lib/liblua.a"
          export LUA_INCLUDE="$LUA_PREFIX/include/lua5.4"
          export MACOSX_DEPLOYMENT_TARGET="11.0"
          just build

      - name: Package Artifacts
        run: |
          mkdir -p staging
          cp roda staging/
          cp LICENSE README.md staging/ 2>/dev/null || true
          cd staging
          tar -czvf ../roda-${{ matrix.name }}.tar.gz *
          cd ..
          if command -v sha256sum >/dev/null 2>&1; then
            sha256sum roda-${{ matrix.name }}.tar.gz > roda-${{ matrix.name }}.tar.gz.sha256
          else
            shasum -a 256 roda-${{ matrix.name }}.tar.gz > roda-${{ matrix.name }}.tar.gz.sha256
          fi

      - name: Verify Binary Architecture
        if: matrix.target == 'macos'
        run: |
          EXPECTED_ARCH="${{ matrix.name == 'macos-arm64' && 'arm64' || 'x86_64' }}"
          ACTUAL_ARCH=$(lipo -archs roda)
          echo "Expected: $EXPECTED_ARCH, Got: $ACTUAL_ARCH"
          if [ "$ACTUAL_ARCH" != "$EXPECTED_ARCH" ]; then
            echo "::error::Binary architecture mismatch! Expected $EXPECTED_ARCH, got $ACTUAL_ARCH"
            exit 1
          fi
          file roda

      - name: Generate Rockspec
        if: matrix.name == 'linux-x86_64'
        run: |
          lx generate-rockspec

      - name: Validate Rockspec
        if: matrix.name == 'linux-x86_64'
        run: |
          luarocks lint *.rockspec

      # SECURITY: Generate SBOM for the current build context
      - name: Generate SBOM
        if: matrix.name == 'linux-x86_64'
        uses: anchore/sbom-action@d94f46e13c6c62f59525ac9a1e147a99dc0b9bf5 # v0.17.0
        with:
          path: .
          format: cyclonedx-json
          output-file: sbom-${{ matrix.name }}.json

      # SECURITY: Generate unforgeable attestations binding each platform's artifact to this OIDC run
      - name: Attest Build Provenance
        uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
        with:
          subject-path: roda-${{ matrix.name }}.tar.gz

      - name: Upload Release Artifacts (with rockspec)
        if: ${{ !env.ACT && matrix.name == 'linux-x86_64' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload ${{ needs.release-please.outputs.tag_name }} \
            roda-${{ matrix.name }}.tar.gz roda-${{ matrix.name }}.tar.gz.sha256 *.rockspec sbom-${{ matrix.name }}.json --clobber

      - name: Upload Release Artifacts (Linux aarch64)
        if: ${{ !env.ACT && matrix.name == 'linux-aarch64' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload ${{ needs.release-please.outputs.tag_name }} \
            roda-${{ matrix.name }}.tar.gz roda-${{ matrix.name }}.tar.gz.sha256 --clobber

      - name: Upload Release Artifacts (macOS)
        if: ${{ !env.ACT && matrix.target == 'macos' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload ${{ needs.release-please.outputs.tag_name }} \
            roda-${{ matrix.name }}.tar.gz roda-${{ matrix.name }}.tar.gz.sha256 --clobber

  update-release-notes:
    name: Add Attestation Verification Instructions
    needs: [release-please, build-release]
    if: |
      always() &&
      (needs.release-please.outputs.release_created == 'true' || needs.release-please.outputs.release_created == true) &&
      needs.build-release.result == 'success'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Append attestation verification instructions
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${{ needs.release-please.outputs.tag_name }}"
          ATTESTATION_BLOCK='

          ---

          ## Verifying GitHub Artifact Attestations

          The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify):

          ```bash
          gh attestation verify <file-path of downloaded artifact> --repo tkolleh/roda.lua
          ```

          You can also download the attestation from [GitHub](https://github.com/tkolleh/roda.lua/attestations) and verify against that directly:

          ```bash
          gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
          ```'
          gh release edit "$TAG" --notes "$(gh release view "$TAG" --json body --jq '.body')${ATTESTATION_BLOCK}"