release.yml

name: Release
on:
  release:
    types: [published]
jobs:
  version:
    name: Start Release
    runs-on: ubuntu-latest

    environment:
      name: GitHub
      url: https://github.com/SierraSoftworks/git-tool/releases

    permissions:
      id-token: write
      contents: read

    env:
      SENTRY_ORG: sierra-softworks
      SENTRY_PROJECT: git-tool

    steps:
      - name: get secrets - sentry
        uses: hashicorp/vault-action@v4.0.0
        with:
          url: https://vault.sierrasoftworks.com
          method: jwt
          path: github-actions
          role: deploy
          jwtGithubAudience: https://vault.sierrasoftworks.com
          secrets: |
            secrets/data/repos/SierraSoftworks/git-tool/sentry token | SENTRY_AUTH_TOKEN;

      - name: Install Sentry CLI
        run: npm install -g @sentry/cli

      - name: Check out code
        uses: actions/checkout@v7

      - name: Create Sentry Release
        run: |
          VERSION="git-tool@${{ github.event.release.tag_name }}"
          sentry-cli releases new "$VERSION"
          sentry-cli releases set-commits "$VERSION" --auto

      - name: Generate Package Version
        shell: pwsh
        run: |
          $VERSION="$('${{ github.event.release.tag_name }}'.substring(1))"
          Add-Content -Path $env:GITHUB_ENV -Value "VERSION=$VERSION"
          Write-Host $VERSION

      - name: Set Package Version
        run: sed -i "s/^version\s*=\s*\".*\"/version = \"$VERSION\"/g" Cargo.toml

      - name: Stash Versioned Cargo.toml
        uses: actions/upload-artifact@v7
        with:
          name: cargofile
          path: Cargo.toml

  build:
    name: ${{ matrix.os }}-${{ matrix.arch }}-release
    runs-on: ${{ matrix.run_on }}
    continue-on-error: true

    environment:
      name: GitHub
      url: https://github.com/SierraSoftworks/git-tool/releases

    permissions:
      id-token: write
      contents: write
      attestations: write

    env:
      SENTRY_ORG: sierra-softworks
      SENTRY_PROJECT: git-tool

    needs:
      - version
    strategy:
      matrix:
        include:
          # Windows builds
          - arch: amd64
            os: windows
            run_on: windows-latest
            target: x86_64-pc-windows-msvc
            extension: .exe

          # Linux builds
          - arch: amd64
            run_on: ubuntu-latest
            os: linux
            target: x86_64-unknown-linux-gnu
            setup: |
              sudo apt-get update
              sudo apt-get install -y libdbus-1-3 libdbus-1-dev
            strip: strip --strip-debug
          # - arch: "386"
          #   os: linux
          #   run_on: ubuntu-latest
          #   target: i686-unknown-linux-gnu
          #   experimental: true
          #   setup: |
          #     sudo apt-get update
          #     sudo apt-get install -y libdbus-1-3 libdbus-1-dev gcc-multilib
          - arch: "arm64"
            os: linux
            run_on: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            experimental: true
            builder: cross
            setup: |
              # cross builds the binary inside its own container, but the debug
              # symbols are stripped on the host (after the Sentry upload), so we
              # still need the aarch64 strip utility available here.
              sudo apt-get update
              sudo apt-get install -y binutils-aarch64-linux-gnu
            strip: aarch64-linux-gnu-strip --strip-debug

          # Apple MacOS builds
          - arch: amd64
            run_on: macos-latest
            os: darwin
            target: x86_64-apple-darwin
          - arch: arm64
            run_on: macos-latest
            os: darwin
            target: aarch64-apple-darwin

    steps:
      - name: setup dependencies
        run: ${{ matrix.setup }}
        if: matrix.setup

      - name: Get Rust Stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: get secrets - sentry
        uses: hashicorp/vault-action@v4.0.0
        with:
          url: https://vault.sierrasoftworks.com
          method: jwt
          path: github-actions
          role: deploy
          jwtGithubAudience: https://vault.sierrasoftworks.com
          secrets: |
            secrets/data/repos/SierraSoftworks/git-tool/sentry token | SENTRY_AUTH_TOKEN;

      - name: Install Sentry CLI
        run: npm install -g @sentry/cli

      - name: Check out code
        uses: actions/checkout@v7

      - name: Fetch Versioned Cargo.toml
        uses: actions/download-artifact@v8
        with:
          name: cargofile

      - name: install protoc
        if: matrix.builder != 'cross'
        uses: SierraSoftworks/setup-protoc@v3.0.1
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Cross
        if: matrix.builder == 'cross'
        shell: bash
        run: |
          curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
          cargo binstall --no-confirm cross

      - name: cargo build
        run: ${{ matrix.builder || 'cargo' }} build --release --target ${{ matrix.target }} ${{ matrix.flags }}

      - name: Reclaim cache ownership from cross
        if: matrix.builder == 'cross'
        run: sudo chown -R "$(id -u):$(id -g)" "$HOME/.cargo" target

      - name: Upload Debug Symbols to Sentry
        run: |
          sentry-cli upload-dif -o sierra-softworks -p git-tool --include-sources ./target/${{ matrix.target }}/release/

      - name: Strip Debug Symbols
        run: |
          ${{ matrix.strip }} target/${{ matrix.target }}/release/git-tool${{ matrix.extension }}
        if: matrix.strip

      - name: Upload GitHub Release Artifacts
        uses: SierraSoftworks/gh-releases@v1.0.10
        with:
          files: "target/${{ matrix.target }}/release/git-tool${{ matrix.extension }} | git-tool-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.extension }}"
          token: ${{ secrets.GITHUB_TOKEN }}
          overwrite: "true"

      # - uses: anchore/sbom-action@v0
      #   with:
      #     file: "target/${{ matrix.target }}/release/git-tool${{ matrix.extension }}"
      #     format: 'spdx-json'
      #     output-file: 'sbom.spdx.json'
      #     upload-artifact: false
      #     artifact-name: "sbom-${{ matrix.os }}-${{ matrix.arch}}.spdx.json"

      # - uses: actions/attest-sbom@v1
      #   with:
      #     subject-name: "git-tool-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.extension }}"
      #     subject-path: "target/${{ matrix.target }}/release/git-tool${{ matrix.extension }}"
      #     sbom-path: 'sbom.spdx.json'

  tap:
    name: Update Homebrew Tap
    runs-on: ubuntu-latest
    needs:
      - build

    steps:
      - name: Update Homebrew Tap
        uses: SierraSoftworks/actions-tap@v1
        with:
          app-id: ${{ secrets.TAP_APP_ID }}
          private-key: ${{ secrets.TAP_APP_PRIVATE_KEY }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          aliases: major minor

  sentry:
    name: Finalize Release
    runs-on: ubuntu-latest
    needs:
      - version
      - build

    environment:
      name: GitHub
      url: https://github.com/SierraSoftworks/git-tool/releases

    permissions:
      id-token: write
      contents: read

    env:
      SENTRY_ORG: sierra-softworks
      SENTRY_PROJECT: git-tool

    steps:
      - name: get secrets - sentry
        uses: hashicorp/vault-action@v4.0.0
        with:
          url: https://vault.sierrasoftworks.com
          method: jwt
          path: github-actions
          role: deploy
          jwtGithubAudience: https://vault.sierrasoftworks.com
          secrets: |
            secrets/data/repos/SierraSoftworks/git-tool/sentry token | SENTRY_AUTH_TOKEN;

      - name: Install Sentry CLI
        run: npm install -g @sentry/cli

      - name: Finalize Sentry Release
        run: |
          VERSION="git-tool@${{ github.event.release.tag_name }}"
          sentry-cli releases finalize "$VERSION"