release.yml

name: OSQuery Release

permissions:
  contents: write
  packages: write
  actions: write
  pull-requests: write
  attestations: write
  id-token: write

on:
  push:
    branches: [master]
    paths-ignore:
      - "**/*.md"
  workflow_dispatch:
    inputs:
      version:
        description: "Version to Release (e.g., v1.2.3)"
        required: true
        type: string

env:
  REGISTRY: "ghcr.io"
  ORGANISATION: ${{ github.repository_owner }}
  REPOSITORY: ${{ github.event.repository.name }}
  CMAKE_OSX_DEPLOYMENT_TARGET: "10.15"
  CMAKE_BUILD_TYPE: Release
  BINARY_NAME: osqueryd

# =============================================================================
# JOBS
# =============================================================================

jobs:
  # cmake needs 3 semver components and no leading "v"
  version:
    name: "Resolve Version"
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.resolve.outputs.version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Resolve version
        id: resolve
        env:
          INPUT_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          v="${INPUT_VERSION:-}"
          [ -n "$v" ] || v="$(git describe --tags --abbrev=0 2>/dev/null || true)"
          v="${v#v}"
          case "$v" in
            [0-9]*.[0-9]*.[0-9]*) ;;
            *) echo "::warning::Unusable version '$v'; falling back to 0.0.0" ; v="0.0.0" ;;
          esac
          echo "Resolved version: $v"
          echo "version=$v" >> "$GITHUB_OUTPUT"

  build_macos:
    name: "Build C Client for (${{ matrix.os }} ${{ matrix.os_arch }})"
    runs-on: ${{ matrix.os }}
    needs: [version]
    if: |
      github.event_name == 'push' || 
      github.event_name == 'workflow_dispatch'
    defaults:
      run:
        shell: bash
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: "macOS x86-64"
            os: macos-15-intel
            os_arch: x86-64
            cmake_arch: x86_64
            artifact_name: osquery-macos-x64
          - name: "macOS ARM64"
            os: macos-15 # pinned: Xcode 26 on macos-latest fails to compile boost mpl
            os_arch: arm64
            cmake_arch: arm64
            artifact_name: osquery-macos-arm64

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Install Xcode Command Line Tools
        shell: bash
        run: |
          # Install Xcode if not already installed
          if ! xcode-select -p >/dev/null 2>&1; then
            echo "Installing Xcode Command Line Tools..."
            xcode-select --install
            # Wait for installation to complete
            while ! xcode-select -p >/dev/null 2>&1; do
              echo "Waiting for Xcode Command Line Tools installation..."
              sleep 10
            done
          fi

      - name: Install macOS Dependencies
        run: brew install ccache git git-lfs cmake python clang-format flex bison cppcheck
        shell: bash

      # ccache 4.x defaults to ~/Library/Caches/ccache on macOS
      - name: Configure ccache
        run: |
          echo "CCACHE_DIR=$HOME/.ccache" >> $GITHUB_ENV
          echo "CCACHE_MAXSIZE=2G" >> $GITHUB_ENV
          echo "CCACHE_COMPRESS=1" >> $GITHUB_ENV

      - name: Cache ccache
        uses: actions/cache@v4
        with:
          path: ~/.ccache
          key: ${{ runner.os }}-${{ matrix.os_arch }}-ccache-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.os_arch }}-ccache-

      - name: Setup Build Environment
        run: |
          echo "Setting up build environment for ${{ matrix.os_arch }}..."
          export SDKROOT=$(xcrun --show-sdk-path)
          export CFLAGS="-isysroot $SDKROOT"
          export CXXFLAGS="-isysroot $SDKROOT"
          
          echo "SDKROOT=$SDKROOT" >> $GITHUB_ENV
          echo "CFLAGS=-isysroot $SDKROOT" >> $GITHUB_ENV
          echo "CXXFLAGS=-isysroot $SDKROOT" >> $GITHUB_ENV
          
      - name: Configure CMake
        run: |
          echo "Creating build directory and configuring..."
          mkdir -p build && cd build
          
          cmake \
            -DCMAKE_OSX_DEPLOYMENT_TARGET=${{ env.CMAKE_OSX_DEPLOYMENT_TARGET }} \
            -DCMAKE_BUILD_TYPE=${{ env.CMAKE_BUILD_TYPE }} \
            -DCMAKE_C_COMPILER=clang \
            -DCMAKE_CXX_COMPILER=clang++ \
            -DCMAKE_OSX_SYSROOT=$SDKROOT \
            -DCMAKE_OSX_ARCHITECTURES=${{ matrix.cmake_arch }} \
            -DOSQUERY_VERSION="${{ needs.version.outputs.version }}" \
            ..
            
          echo "CMake configuration completed"

      - name: Build Project
        run: |
          echo "Starting build for ${{ matrix.os_arch }}..."
          cd build
          
          CPU_COUNT=$(sysctl -n hw.ncpu)
          echo "Building with $CPU_COUNT parallel jobs"
          time cmake --build . -j $CPU_COUNT
          
          echo "Build completed successfully"

      - name: ccache statistics
        if: always()
        run: ccache --show-stats

      - name: Upload client artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact_name }}
          path: build/osquery/${{ env.BINARY_NAME }}
          if-no-files-found: warn
          retention-days: 30
          compression-level: 9


  create_universal_macos:
    name: "Create Universal macOS Binary"
    needs: [build_macos]
    runs-on: macos-latest
    if: |
      (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
      !failure() && !cancelled()
    
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Download macOS x86-64 Binary
        uses: actions/download-artifact@v4
        with:
          name: osquery-macos-x64
          path: x64-artifacts/

      - name: Download macOS ARM64 Binary
        uses: actions/download-artifact@v4
        with:
          name: osquery-macos-arm64
          path: arm64-artifacts/

      - name: Create Universal Binary
        run: |
          echo "Creating universal macOS binary..."
          X64_BINARY="x64-artifacts/${{ env.BINARY_NAME }}"
          ARM64_BINARY="arm64-artifacts/${{ env.BINARY_NAME }}"
          
          echo "Creating universal binary with lipo..."
          mkdir -p artifacts
          lipo -create "$X64_BINARY" "$ARM64_BINARY" -output ./artifacts/${{ env.BINARY_NAME }}
          
          # Verify universal binary
          echo "Universal binary info:"
          lipo -info ./artifacts/${{ env.BINARY_NAME }}
          file ./artifacts/${{ env.BINARY_NAME }}
          
      - name: Sign MacOS package
        uses: ./.github/steps/sign-macos-package
        with:
          apple_certificate_p12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
          apple_certificate_password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          apple_developer_id: ${{ secrets.APPLE_DEVELOPER_ID }}
          apple_id_username: ${{ secrets.APPLE_ID_USERNAME }}
          apple_id_password: ${{ secrets.APPLE_ID_PASSWORD }}
          apple_team_id: ${{ secrets.APPLE_TEAM_ID }}
          binary_name: ${{ env.BINARY_NAME }}

      - name: Upload Universal Binary
        uses: actions/upload-artifact@v4
        with:
          name: osquery-mac-universal
          path: artifacts/
          retention-days: 30
          compression-level: 9


  build_windows:
    name: "Build C Client for (${{ matrix.os }} ${{ matrix.os_arch }})"
    runs-on: ${{ matrix.os }}
    needs: [version]
    if: |
      github.event_name == 'push' || 
      github.event_name == 'workflow_dispatch'
    defaults:
      run:
        shell: cmd
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: "Windows x64"
            os: windows-2022 # pinned: windows-latest is VS 2026; generator below needs VS 17
            os_arch: x64
            artifact_name: osquery-windows-amd64

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Setup MSBuild
        uses: microsoft/setup-msbuild@v2
      
      - name: Setup Visual Studio Build Tools
        uses: ilammy/msvc-dev-cmd@v1
        with:
          arch: ${{ matrix.os_arch }}      
      
      - name: Configure CMake for ${{ matrix.os }}
        run: |
          mkdir build
          cd build
          cmake -G "Visual Studio 17 2022" -A ${{ matrix.os_arch }} -DOSQUERY_VERSION="${{ needs.version.outputs.version }}" ..

      - name: Build OSQuery for Windows ${{ matrix.os_arch }} with MSBuild
        run: |
          cd build
          cmake --build . --config RelWithDebInfo -j10

      - name: Sign Windows package
        uses: ./.github/steps/sign-windows-package
        with:
          azure_tenant_id: ${{ secrets.AZURE_TENANT_ID }}
          azure_client_id: ${{ secrets.AZURE_CLIENT_ID }}
          azure_client_secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          signing_endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          code_signing_account_name: ${{ secrets.AZURE_CODE_SIGNING_ACCOUNT_NAME }}
          certificate_profile_name: ${{ secrets.AZURE_CERTIFICATE_PROFILE_NAME }}
          binary_path: build/osquery/RelWithDebInfo/${{ env.BINARY_NAME }}.exe

      - name: Upload Windows OSQuery artifact
        if: runner.os == 'Windows'
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact_name }}
          path: "build/osquery/RelWithDebInfo/${{ env.BINARY_NAME }}.exe"
          if-no-files-found: warn
          retention-days: 30
          compression-level: 9


  release:
    name: "Create Release"
    needs: [build_macos, create_universal_macos, build_windows]
    runs-on: ubuntu-latest
    if: |
      github.event_name == 'workflow_dispatch' && 
      inputs.version != ''
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: release-artifacts

      - name: Prepare release artifacts
        run: |
          set -e
          mkdir -p final-artifacts/clients

          # macOS
          if [ -d "release-artifacts/osquery-mac-universal" ]; then
            tar -czf "final-artifacts/clients/osquery-macos-universal.tar.gz" \
              -C "release-artifacts/osquery-mac-universal" ${{ env.BINARY_NAME }}
          fi
          # Windows
          if [ -d "release-artifacts/osquery-windows-amd64" ]; then
            (cd "release-artifacts/osquery-windows-amd64" && \
              zip "${GITHUB_WORKSPACE}/final-artifacts/clients/osquery-windows-amd64.zip" ${{ env.BINARY_NAME }}.exe)
          fi

          MISSING=""
          [ -f "final-artifacts/clients/osquery-macos-universal.tar.gz" ] || MISSING="$MISSING macOS"
          [ -f "final-artifacts/clients/osquery-windows-amd64.zip" ] || MISSING="$MISSING Windows"
          if [ -n "$MISSING" ]; then
            echo "::error::Missing release artifacts:$MISSING"
            exit 1
          fi

          ls -lh final-artifacts/clients/

      - name: Generate release header
        run: |
          cat > RELEASE_HEADER.md <<EOF
          ## OSQuery Clients
          - **macOS** (Universal): \`osquery-macos-universal.tar.gz\`
          - **Windows** (amd64): \`osquery-windows-amd64.zip\`
          EOF

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.version }}
          name: "🦩 ${{ inputs.version }}"
          draft: false
          prerelease: false
          token: ${{ secrets.GITHUB_TOKEN }}
          body_path: RELEASE_HEADER.md
          files: |
            final-artifacts/clients/*