release.yml

# Usage:
# Set a tag, then push it to trigger the release workflow:
# git tag v0.1.0
# git push origin v0.1.0
#
# Prerequisites:
# - Commits must be signed by a maintainer listed in .auths/allowed_signers
# - No signing secrets needed — CI verifies commits, then signs artifacts with ephemeral keys

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Verify commit signatures
        uses: auths-dev/verify@v1

  build:
    needs: verify
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            asset_name: auths-linux-x86_64
            ext: .tar.gz
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            asset_name: auths-linux-aarch64
            ext: .tar.gz
          - os: macos-latest
            target: aarch64-apple-darwin
            asset_name: auths-macos-aarch64
            ext: .tar.gz
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            asset_name: auths-windows-x86_64
            ext: .zip
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.93"
          targets: ${{ matrix.target }}

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}
          cache-on-failure: true

      - name: Build release binaries
        run: cargo build --release --package auths-cli --target ${{ matrix.target }}

      - name: Package (Unix)
        if: matrix.ext == '.tar.gz'
        run: |
          mkdir -p staging
          cp target/${{ matrix.target }}/release/auths staging/ || true
          cp target/${{ matrix.target }}/release/auths-sign staging/ || true
          cp target/${{ matrix.target }}/release/auths-verify staging/ || true
          tar -czf ${{ matrix.asset_name }}${{ matrix.ext }} -C staging .

      - name: Package (Windows)
        if: matrix.ext == '.zip'
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path staging
          Copy-Item target/${{ matrix.target }}/release/auths.exe staging/ -ErrorAction SilentlyContinue
          Copy-Item target/${{ matrix.target }}/release/auths-sign.exe staging/ -ErrorAction SilentlyContinue
          Copy-Item target/${{ matrix.target }}/release/auths-verify.exe staging/ -ErrorAction SilentlyContinue
          Compress-Archive -Path staging/* -DestinationPath ${{ matrix.asset_name }}${{ matrix.ext }}

      - name: Generate SHA256 checksum (Unix)
        if: matrix.ext == '.tar.gz'
        run: shasum -a 256 ${{ matrix.asset_name }}${{ matrix.ext }} > ${{ matrix.asset_name }}${{ matrix.ext }}.sha256

      - name: Generate SHA256 checksum (Windows)
        if: matrix.ext == '.zip'
        shell: pwsh
        run: |
          $hash = (Get-FileHash ${{ matrix.asset_name }}${{ matrix.ext }} -Algorithm SHA256).Hash.ToLower()
          "$hash  ${{ matrix.asset_name }}${{ matrix.ext }}" | Out-File -Encoding ascii ${{ matrix.asset_name }}${{ matrix.ext }}.sha256

      - name: Sign artifact and log to Sigstore (ephemeral, Unix)
        if: matrix.ext == '.tar.gz'
        run: |
          FILE="${{ matrix.asset_name }}${{ matrix.ext }}"
          ./staging/auths artifact sign "$FILE" \
            --ci \
            --commit "${{ github.sha }}" \
            --ci-platform github \
            --log sigstore-rekor \
            --note "Release ${{ github.ref_name }}"

      - name: Sign artifact and log to Sigstore (ephemeral, Windows)
        if: matrix.ext == '.zip'
        shell: pwsh
        run: |
          $file = "${{ matrix.asset_name }}${{ matrix.ext }}"
          .\staging\auths.exe artifact sign $file `
            --ci `
            --commit $env:GITHUB_SHA `
            --ci-platform github `
            --log sigstore-rekor `
            --note "Release ${{ github.ref_name }}"

      - name: Verify own attestation (Unix)
        if: matrix.ext == '.tar.gz'
        run: ./staging/auths artifact verify "${{ matrix.asset_name }}${{ matrix.ext }}"

      - name: Verify own attestation (Windows)
        if: matrix.ext == '.zip'
        shell: pwsh
        run: .\staging\auths.exe artifact verify "${{ matrix.asset_name }}${{ matrix.ext }}"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.asset_name }}
          path: |
            ${{ matrix.asset_name }}${{ matrix.ext }}
            ${{ matrix.asset_name }}${{ matrix.ext }}.sha256
            ${{ matrix.asset_name }}${{ matrix.ext }}.auths.json

  release:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts/

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: artifacts/**/*
          generate_release_notes: true

  update-homebrew:
    needs: release
    runs-on: ubuntu-latest
    steps:
      - name: Download attestations and extract hashes
        id: hashes
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          BASE="https://github.com/auths-dev/auths/releases/download/v${VERSION}"
          for asset in auths-macos-aarch64 auths-linux-x86_64 auths-linux-aarch64; do
            curl -sL "${BASE}/${asset}.tar.gz.auths.json" -o "${asset}.auths.json"
          done
          extract_hash() { jq -r '.payload.digest.hex' "$1"; }
          {
            echo "version=${VERSION}"
            echo "macos_aarch64=$(extract_hash auths-macos-aarch64.auths.json)"
            echo "linux_x86_64=$(extract_hash auths-linux-x86_64.auths.json)"
            echo "linux_aarch64=$(extract_hash auths-linux-aarch64.auths.json)"
          } >> "$GITHUB_OUTPUT"

      - name: Checkout Homebrew tap
        uses: actions/checkout@v4
        with:
          repository: auths-dev/homebrew-auths-cli
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: homebrew-tap

      - name: Update formula
        run: |
          VERSION="${{ steps.hashes.outputs.version }}"
          cat > homebrew-tap/Formula/auths.rb << FORMULA
          class Auths < Formula
            desc "Cryptographic identity for developers — sign artifacts, replace API keys"
            homepage "https://auths.dev"
            version "${VERSION}"
            license "Apache-2.0"

            on_macos do
              on_arm do
                url "https://github.com/auths-dev/auths/releases/download/v#{version}/auths-macos-aarch64.tar.gz"
                sha256 "${{ steps.hashes.outputs.macos_aarch64 }}"
              end
            end

            on_linux do
              on_intel do
                url "https://github.com/auths-dev/auths/releases/download/v#{version}/auths-linux-x86_64.tar.gz"
                sha256 "${{ steps.hashes.outputs.linux_x86_64 }}"
              end
              on_arm do
                url "https://github.com/auths-dev/auths/releases/download/v#{version}/auths-linux-aarch64.tar.gz"
                sha256 "${{ steps.hashes.outputs.linux_aarch64 }}"
              end
            end

            def install
              bin.install "auths"
              bin.install "auths-sign" if File.exist?("auths-sign")
              bin.install "auths-verify" if File.exist?("auths-verify")
            end

            test do
              assert_match version.to_s, shell_output("#{bin}/auths --version")
            end
          end
          FORMULA

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@v6
        with:
          path: homebrew-tap
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          commit-message: "auths ${{ steps.hashes.outputs.version }}"
          title: "auths ${{ steps.hashes.outputs.version }}"
          body: |
            Automated formula update from [release v${{ steps.hashes.outputs.version }}](https://github.com/auths-dev/auths/releases/tag/v${{ steps.hashes.outputs.version }}).

            SHA256 hashes extracted from `.auths.json` provenance files.
          branch: "update-${{ steps.hashes.outputs.version }}"
          base: main