Release.yml

name: CD

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: "Git tag to publish when running manually. Leave empty to build and validate only."
        required: false
        type: string
      c2implant_release_tag:
        description: "C2Implant release tag to import. Leave empty to use latest."
        required: false
        type: string
      c2linuximplant_release_tag:
        description: "C2LinuxImplant release tag to import. Leave empty to use latest."
        required: false
        type: string
  push:
    tags:
      - "*"

env:
  BUILD_DIR: build-release
  BUILD_TYPE: Release
  RELEASE_TARBALL: Release.tar.gz
  RELEASE_ARTIFACT: C2TeamServer-Release

permissions:
  contents: read

jobs:
  build-test-package:
    name: Build, test, package, and validate release
    runs-on: ubuntu-22.04

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip
          cache-dependency-path: |
            C2Client/pyproject.toml
            C2Client/requirements.txt

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            golang-cfssl \
            libegl1 \
            libgl1 \
            libsmbclient-dev \
            libxkbcommon-x11-0 \
            libxcb-cursor0 \
            libxcb-icccm4 \
            libxcb-image0 \
            libxcb-keysyms1 \
            libxcb-render-util0 \
            libxcb-xinerama0

      - name: Install Conan
        run: python -m pip install --upgrade pip "conan==2.24.0"

      - name: Cache Conan packages
        uses: actions/cache@v4
        with:
          path: ~/.conan2
          key: conan-${{ runner.os }}-${{ hashFiles('conanfile.txt', 'conan.lock', 'conan/profiles/linux-gcc13') }}
          restore-keys: |
            conan-${{ runner.os }}-

      - name: Configure CMake
        run: >
          cmake -S "${{ github.workspace }}"
          -B "${{ github.workspace }}/${{ env.BUILD_DIR }}"
          -DCMAKE_BUILD_TYPE="${{ env.BUILD_TYPE }}"
          -DWITH_TESTS=ON
          -DCMAKE_PROJECT_TOP_LEVEL_INCLUDES="${{ github.workspace }}/conan_provider.cmake"
          -DCONAN_HOST_PROFILE="${{ github.workspace }}/conan/profiles/linux-gcc13"
          -DCONAN_BUILD_PROFILE="${{ github.workspace }}/conan/profiles/linux-gcc13"
          -DCONAN_LOCKFILE="${{ github.workspace }}/conan.lock"

      - name: Build
        run: cmake --build "${{ env.BUILD_DIR }}" --config "${{ env.BUILD_TYPE }}" --parallel "$(nproc)"

      - name: Run CTest
        run: ctest --test-dir "${{ env.BUILD_DIR }}" --build-config "${{ env.BUILD_TYPE }}" --output-on-failure --timeout 120

      - name: Install client test dependencies
        run: python -m pip install -e "${{ github.workspace }}/C2Client[test]"

      - name: Run client tests
        env:
          C2_PROTOCOL_PYTHON_ROOT: ${{ github.workspace }}/${{ env.BUILD_DIR }}/generated/python_protocol
          QT_QPA_PLATFORM: offscreen
        run: timeout 180 python -m pytest "${{ github.workspace }}/C2Client/tests" -vv -s

      - name: Run packaging tests
        run: timeout 180 python -m pytest "${{ github.workspace }}/packaging/tests" -vv -s

      - name: Stage TeamServer release bundle
        run: cmake --build "${{ env.BUILD_DIR }}" --target validate_release_bundle --config "${{ env.BUILD_TYPE }}"

      - name: Import implant release assets
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          C2IMPLANT_RELEASE_TAG: ${{ inputs.c2implant_release_tag || '' }}
          C2LINUXIMPLANT_RELEASE_TAG: ${{ inputs.c2linuximplant_release_tag || '' }}
        run: |
          set -euo pipefail

          args=()
          if [ -n "${C2IMPLANT_RELEASE_TAG}" ]; then
            args+=(--windows-tag "${C2IMPLANT_RELEASE_TAG}")
          fi
          if [ -n "${C2LINUXIMPLANT_RELEASE_TAG}" ]; then
            args+=(--linux-tag "${C2LINUXIMPLANT_RELEASE_TAG}")
          fi

          python "${{ github.workspace }}/packaging/import_implant_releases.py" \
            --stage-root "${{ github.workspace }}/${{ env.BUILD_DIR }}/release-staging/Release" \
            --import-root "${{ github.workspace }}/${{ env.BUILD_DIR }}/release-imports" \
            "${args[@]}"

      - name: Validate complete release staging
        run: >
          python "${{ github.workspace }}/packaging/validate_release.py"
          --release-root "${{ github.workspace }}/${{ env.BUILD_DIR }}/release-staging/Release"
          --require-implants

      - name: Create release archive
        run: tar -C "${{ env.BUILD_DIR }}/release-staging" -czf "${{ env.RELEASE_TARBALL }}" Release

      - name: Upload validated release artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.RELEASE_ARTIFACT }}
          path: ${{ env.RELEASE_TARBALL }}
          if-no-files-found: error

  publish:
    name: Publish GitHub release
    runs-on: ubuntu-22.04
    needs: build-test-package
    if: startsWith(github.ref, 'refs/tags/') || (github.event_name == 'workflow_dispatch' && inputs.release_tag != '')
    permissions:
      contents: write

    steps:
      - name: Download validated release artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.RELEASE_ARTIFACT }}

      - name: Upload release
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: ${{ env.RELEASE_TARBALL }}
          asset_name: ${{ env.RELEASE_TARBALL }}
          tag: ${{ inputs.release_tag || github.ref }}
          overwrite: true
          body: "C2TeamServer client, server, TeamServer modules, and validated C2Implant/C2LinuxImplant beacons and modules."