release.yml

---
name: release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: Existing release tag to publish assets for (for retries)
        required: true
        type: string

permissions:
  contents: write
  id-token: write

concurrency:
  group: release-${{ github.event.release.tag_name || inputs.tag }}
  cancel-in-progress: false

jobs:
  build:
    strategy:
      matrix:
        include:
          - runner: macos-latest
            goos: darwin
            goarch: amd64
            cc: clang -arch x86_64
          - runner: macos-latest
            goos: darwin
            goarch: arm64
          - runner: ubuntu-latest
            goos: linux
            goarch: amd64
          - runner: ubuntu-24.04-arm
            goos: linux
            goarch: arm64
    runs-on: ${{ matrix.runner }}
    env:
      TAG_NAME: ${{ github.event.release.tag_name || inputs.tag }}
    steps:
      - name: Validate tag
        shell: bash
        run: |
          set -euo pipefail
          [[ "${TAG_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([-.].*)?$ ]] || {
            echo "invalid release tag: ${TAG_NAME}"
            exit 1
          }

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ env.TAG_NAME }}

      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Build
        env:
          CGO_ENABLED: "1"
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CC: ${{ matrix.cc || '' }}
        run: |
          set -euo pipefail
          VERSION="${TAG_NAME#v}"
          go build -trimpath -ldflags="-s -w -X main.version=${VERSION}" -o tero ./cmd/tero

      - name: Package
        run: |
          set -euo pipefail
          VERSION="${TAG_NAME#v}"
          ARCHIVE="tero_${VERSION}_${{ matrix.goos }}_${{ matrix.goarch }}.tar.gz"
          tar czf "${ARCHIVE}" tero LICENSE
          shasum -a 256 "${ARCHIVE}" > "${ARCHIVE}.sha256"
          echo "ARCHIVE=${ARCHIVE}" >> "$GITHUB_ENV"

      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: tero-${{ matrix.goos }}-${{ matrix.goarch }}
          path: |
            tero_*.tar.gz
            tero_*.tar.gz.sha256

  release:
    needs: build
    runs-on: ubuntu-latest
    env:
      TAG_NAME: ${{ github.event.release.tag_name || inputs.tag }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

      - name: Validate tag and ancestry
        shell: bash
        run: |
          set -euo pipefail
          [[ "${TAG_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([-.].*)?$ ]] || {
            echo "invalid release tag: ${TAG_NAME}"
            exit 1
          }
          git rev-parse -q --verify "refs/tags/${TAG_NAME}" >/dev/null || {
            echo "tag ${TAG_NAME} does not exist in repository"
            exit 1
          }
          git fetch origin master --force
          TAG_COMMIT="$(git rev-list -n1 "${TAG_NAME}")"
          git merge-base --is-ancestor "${TAG_COMMIT}" "origin/master" || {
            echo "tag ${TAG_NAME} does not point to commit reachable from master"
            exit 1
          }

      - name: Install cosign
        run: |
          set -euo pipefail
          COSIGN_VERSION=v2.4.1
          mkdir -p "$HOME/.local/bin"
          curl --retry 5 --retry-all-errors --connect-timeout 10 --max-time 120 -sSfL \
            "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-amd64" \
            -o "$HOME/.local/bin/cosign"
          chmod +x "$HOME/.local/bin/cosign"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          path: artifacts
          merge-multiple: true

      - name: Create checksums
        working-directory: artifacts
        run: |
          set -euo pipefail
          cat ./*.sha256 > checksums.txt
          rm ./*.sha256

      - name: Sign checksums (keyless)
        working-directory: artifacts
        env:
          COSIGN_YES: "true"
        run: |
          set -euo pipefail
          COSIGN_CACHE_DIR="$(mktemp -d)"
          trap 'rm -rf "$COSIGN_CACHE_DIR"' EXIT
          env XDG_CACHE_HOME="$COSIGN_CACHE_DIR" cosign sign-blob \
            --output-signature checksums.txt.sig \
            --output-certificate checksums.txt.pem \
            checksums.txt \
            --yes

      - name: Verify checksums signature
        working-directory: artifacts
        run: |
          set -euo pipefail
          COSIGN_CACHE_DIR="$(mktemp -d)"
          trap 'rm -rf "$COSIGN_CACHE_DIR"' EXIT
          env XDG_CACHE_HOME="$COSIGN_CACHE_DIR" cosign verify-blob \
            --certificate checksums.txt.pem \
            --signature checksums.txt.sig \
            --certificate-identity-regexp '^https://github\.com/usetero/cli/\.github/workflows/release\.yml@refs/(tags/.*|heads/master)$' \
            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
            checksums.txt

      - name: Upload release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          gh release upload "${TAG_NAME}" \
            artifacts/*.tar.gz \
            artifacts/checksums.txt \
            artifacts/checksums.txt.sig \
            artifacts/checksums.txt.pem \
            scripts/install.sh \
            --clobber

      - name: Generate a token
        id: generate-token
        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
        with:
          app-id: ${{ secrets.TERO_BOT_CLIENT_ID }}
          private-key: ${{ secrets.TERO_BOT_PRIVATE_SIGNING_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: homebrew-tap

      - name: Update Homebrew formula
        if: ${{ !contains(env.TAG_NAME, '-') }}
        env:
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
        run: |
          set -euo pipefail
          VERSION="${TAG_NAME#v}"
          BASE_URL="https://github.com/usetero/cli/releases/download/${TAG_NAME}"

          darwin_amd64_sha=$(awk '/darwin_amd64/ {print $1}' artifacts/checksums.txt)
          darwin_arm64_sha=$(awk '/darwin_arm64/ {print $1}' artifacts/checksums.txt)
          linux_amd64_sha=$(awk '/linux_amd64/ {print $1}' artifacts/checksums.txt)
          linux_arm64_sha=$(awk '/linux_arm64/ {print $1}' artifacts/checksums.txt)

          cat > /tmp/tero.rb <<EOF
          # typed: false
          # frozen_string_literal: true

          class Tero < Formula
            desc "Improve your observability data quality from the terminal"
            homepage "https://usetero.com"
            version "${VERSION}"
            license "Apache-2.0"

            on_macos do
              if Hardware::CPU.intel?
                url "${BASE_URL}/tero_${VERSION}_darwin_amd64.tar.gz"
                sha256 "${darwin_amd64_sha}"

                def install
                  bin.install "tero"
                end
              end
              if Hardware::CPU.arm?
                url "${BASE_URL}/tero_${VERSION}_darwin_arm64.tar.gz"
                sha256 "${darwin_arm64_sha}"

                def install
                  bin.install "tero"
                end
              end
            end

            on_linux do
              if Hardware::CPU.intel? && Hardware::CPU.is_64_bit?
                url "${BASE_URL}/tero_${VERSION}_linux_amd64.tar.gz"
                sha256 "${linux_amd64_sha}"
                def install
                  bin.install "tero"
                end
              end
              if Hardware::CPU.arm? && Hardware::CPU.is_64_bit?
                url "${BASE_URL}/tero_${VERSION}_linux_arm64.tar.gz"
                sha256 "${linux_arm64_sha}"
                def install
                  bin.install "tero"
                end
              end
            end

            test do
              system "#{bin}/tero", "--version"
            end
          end
          EOF

          # Remove leading whitespace from heredoc
          sed -i 's/^          //' /tmp/tero.rb

          cd "$(mktemp -d)"
          git clone "https://x-access-token:${GH_TOKEN}@github.com/usetero/homebrew-tap.git" .
          cp /tmp/tero.rb Formula/tero.rb
          git config user.name "tero-bot[bot]"
          git config user.email "tero-bot[bot]@users.noreply.github.com"
          git add Formula/tero.rb
          git commit -m "tero ${VERSION}"
          git push