release.yaml

# Release workflow for cargo-rail
#
# Triggered by a version tag created by cargo-rail. The exact tagged commit must
# pass the complete release gate before any binary is built or uploaded. Every
# archive is built and smoke-tested on its native architecture, attested, and
# published with deterministic SHA-256 manifests.

name: Release

permissions:
  contents: read

on:
  push:
    tags:
      - v[0-9]+.*
  workflow_dispatch:
    inputs:
      tag:
        description: Existing release tag to verify and publish
        required: true
        type: string

env:
  CARGO_INCREMENTAL: 0
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}

concurrency:
  group: release-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
  cancel-in-progress: false

jobs:
  verify-release:
    name: Verify Exact Release Commit
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: read
    outputs:
      matrix: ${{ steps.targets.outputs.matrix }}
      target_count: ${{ steps.targets.outputs.count }}
      version: ${{ steps.release.outputs.version }}
      release_sha: ${{ steps.release.outputs.release_sha }}
    steps:
      - name: Validate release tag
        shell: bash
        run: |
          if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?$ ]]; then
            echo "Invalid release tag: $RELEASE_TAG" >&2
            exit 1
          fi

      - name: Checkout exact tag
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ env.RELEASE_TAG }}

      - name: Bind tag, commit, version, and target matrix
        id: release
        shell: bash
        run: |
          set -euo pipefail

          head_sha="$(git rev-parse HEAD)"
          tag_sha="$(git rev-list -n 1 "$RELEASE_TAG")"
          if [ "$head_sha" != "$tag_sha" ]; then
            echo "Release tag does not resolve to the checked-out commit." >&2
            echo "HEAD=$head_sha tag=$tag_sha" >&2
            exit 1
          fi
          if [ "$GITHUB_EVENT_NAME" = "push" ] && [ "$tag_sha" != "$GITHUB_SHA" ]; then
            echo "Release tag does not resolve to the GitHub push event SHA." >&2
            echo "tag=$tag_sha event=$GITHUB_SHA" >&2
            exit 1
          fi
          echo "release_sha=$tag_sha" >> "$GITHUB_OUTPUT"

          python3 - <<'PY' >> "$GITHUB_OUTPUT"
          import os
          import pathlib
          import tomllib

          manifest = tomllib.loads(pathlib.Path("Cargo.toml").read_text())
          version = manifest["package"]["version"]
          tag_version = os.environ["RELEASE_TAG"].removeprefix("v")
          if version != tag_version:
              raise SystemExit(f"tag v{tag_version} does not match Cargo package version {version}")

          msrv = manifest["workspace"]["package"]["rust-version"]
          print(f"version={version}")
          print(f"msrv={msrv}")
          PY

      - name: Load supported release targets
        id: targets
        shell: bash
        run: |
          set -euo pipefail
          jq -e '
            length > 0
            and all(.[]; .target and .os and (.archive == "tar" or .archive == "zip"))
            and ((map(.target) | length) == (map(.target) | unique | length))
          ' \
            distribution/release-targets.json >/dev/null
          echo "matrix=$(jq -c '{include: .}' distribution/release-targets.json)" >> "$GITHUB_OUTPUT"
          echo "count=$(jq 'length' distribution/release-targets.json)" >> "$GITHUB_OUTPUT"

      - name: Verify GitHub Release exists
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          for attempt in {1..24}; do
            if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY"; then
              exit 0
            fi
            echo "GitHub Release $RELEASE_TAG not visible yet; retrying ($attempt/24)..."
            sleep 5
          done
          echo "GitHub Release $RELEASE_TAG was not created by cargo-rail in time." >&2
          exit 1

      - name: Install MSRV toolchain
        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88  # master
        with:
          toolchain: ${{ steps.release.outputs.msrv }}

      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88  # master
        with:
          toolchain: stable
          components: clippy, rustfmt

      - name: Install just
        uses: taiki-e/install-action@2ca9b94c269419b7b0c711c09d0b21c4e1d51145  # v2
        with:
          tool: just

      - name: Install cargo-nextest
        uses: taiki-e/install-action@2ca9b94c269419b7b0c711c09d0b21c4e1d51145  # v2
        with:
          tool: cargo-nextest

      - name: Install cargo-deny
        uses: taiki-e/install-action@2ca9b94c269419b7b0c711c09d0b21c4e1d51145  # v2
        with:
          tool: cargo-deny

      - name: Install cargo-audit
        uses: taiki-e/install-action@2ca9b94c269419b7b0c711c09d0b21c4e1d51145  # v2
        with:
          tool: cargo-audit

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2.9.1
        with:
          shared-key: cargo-rail-release-gate-v1
          key: ${{ steps.release.outputs.release_sha }}

      - name: Verify action pins
        run: just verify-actions

      - name: Verify MSRV
        run: cargo +${{ steps.release.outputs.msrv }} check --workspace --all-targets --all-features --locked

      - name: Verify formatting
        run: cargo +stable fmt --all -- --check

      # Recovery rebuilds an immutable tag. Rolling Clippy lints belong to the
      # pre-tag gate and must not make a previously published source stop shipping.
      - name: Verify Clippy
        if: github.event_name != 'workflow_dispatch'
        run: cargo +stable clippy --workspace --all-targets --all-features --locked -- -D warnings

      - name: Verify tests
        run: cargo +stable nextest run --workspace --all-features --locked

      - name: Verify documentation
        env:
          RUSTDOCFLAGS: -D warnings
        run: cargo +stable doc --workspace --no-deps --all-features --locked

      - name: Verify dependency policy
        run: cargo deny check all

      - name: Verify security advisories
        run: cargo audit

  upload-assets:
    name: Build and Verify (${{ matrix.target }})
    needs: verify-release
    runs-on: ${{ matrix.os }}
    timeout-minutes: 60
    permissions:
      contents: read
      id-token: write
      attestations: write
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.verify-release.outputs.matrix) }}
    steps:
      - name: Checkout verified commit
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
          ref: ${{ needs.verify-release.outputs.release_sha }}

      - name: Verify checkout identity
        shell: bash
        env:
          RELEASE_SHA: ${{ needs.verify-release.outputs.release_sha }}
        run: test "$(git rev-parse HEAD)" = "$RELEASE_SHA"

      - name: Install Rust
        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88  # master
        with:
          toolchain: stable

      - name: Configure path remapping
        shell: bash
        run: |
          flags="--remap-path-prefix=${GITHUB_WORKSPACE}=/workspace --remap-path-scope=object"
          if [ -n "${RUSTFLAGS:-}" ]; then
            flags="${RUSTFLAGS} ${flags}"
          fi
          echo "RUSTFLAGS=$flags" >> "$GITHUB_ENV"

      - name: Setup target toolchain
        uses: taiki-e/setup-cross-toolchain-action@b8d1a322a6009a2b7220f53996695778eef89b41  # v1.38.0
        with:
          target: ${{ matrix.target }}

      - name: Configure static linking (musl)
        if: contains(matrix.target, '-linux-musl')
        shell: bash
        run: echo "RUSTFLAGS=${RUSTFLAGS} -C target-feature=+crt-static -C link-self-contained=yes" >> "$GITHUB_ENV"

      - name: Configure static linking (Windows)
        if: contains(matrix.target, '-windows-msvc')
        shell: bash
        run: echo "RUSTFLAGS=${RUSTFLAGS} -C target-feature=+crt-static" >> "$GITHUB_ENV"

      - name: Set macOS deployment target
        if: contains(matrix.target, '-apple-darwin')
        shell: bash
        run: echo "MACOSX_DEPLOYMENT_TARGET=11.0" >> "$GITHUB_ENV"

      - name: Build archive
        id: build
        uses: taiki-e/upload-rust-binary-action@f391289bcff6a7f36b6301c0a74199657bbb4561  # v1.28.0
        with:
          bin: cargo-rail
          target: ${{ matrix.target }}
          locked: true
          tar: unix
          zip: windows
          dry-run: true
          dry-run-intended: true

      - name: Smoke-test tar archive
        if: matrix.archive == 'tar'
        shell: bash
        env:
          ARCHIVE: ${{ steps.build.outputs.tar }}
          VERSION: ${{ needs.verify-release.outputs.version }}
        run: |
          set -euo pipefail
          test -n "$ARCHIVE" && test -f "$ARCHIVE"
          mkdir smoke
          tar -xzf "$ARCHIVE" -C smoke
          binary="$(find smoke -type f -name cargo-rail -print -quit)"
          test -n "$binary"
          chmod +x "$binary"
          test "$("$binary" rail --version)" = "cargo-rail $VERSION"

      - name: Smoke-test zip archive
        if: matrix.archive == 'zip'
        shell: pwsh
        env:
          ARCHIVE: ${{ steps.build.outputs.zip }}
          VERSION: ${{ needs.verify-release.outputs.version }}
        run: |
          if (-not $env:ARCHIVE -or -not (Test-Path $env:ARCHIVE)) {
            throw "release archive was not produced"
          }
          Expand-Archive -Path $env:ARCHIVE -DestinationPath smoke
          $binary = Get-ChildItem smoke -Recurse -Filter cargo-rail.exe | Select-Object -First 1
          if (-not $binary) {
            throw "cargo-rail.exe is missing from $env:ARCHIVE"
          }
          $actual = (& $binary.FullName rail --version).Trim()
          if ($LASTEXITCODE -ne 0 -or $actual -ne "cargo-rail $env:VERSION") {
            throw "archive smoke test failed: $actual"
          }

      - name: Attest archive provenance
        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763  # v4.1.1
        with:
          subject-path: ${{ matrix.archive == 'zip' && steps.build.outputs.zip || steps.build.outputs.tar }}

      - name: Stage verified archive
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
        with:
          name: release-${{ matrix.target }}
          path: ${{ matrix.archive == 'zip' && steps.build.outputs.zip || steps.build.outputs.tar }}
          compression-level: 0
          if-no-files-found: error
          retention-days: 1

  publish-checksums:
    name: Verify and Publish Release Manifests
    needs: [verify-release, upload-assets]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      attestations: read
    steps:
      - name: Collect verified archives
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          pattern: release-*
          merge-multiple: true

      - name: Verify archive set
        env:
          EXPECTED_ARCHIVES: ${{ needs.verify-release.outputs.target_count }}
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          files=(cargo-rail-*.tar.* cargo-rail-*.zip)
          if [ "${#files[@]}" -ne "$EXPECTED_ARCHIVES" ]; then
            echo "Expected $EXPECTED_ARCHIVES release archives, found ${#files[@]}." >&2
            printf '%s\n' "${files[@]}" >&2
            exit 1
          fi

      - name: Generate checksum manifests
        env:
          RELEASE_SHA: ${{ needs.verify-release.outputs.release_sha }}
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          files=(cargo-rail-*.tar.* cargo-rail-*.zip)
          sha256sum "${files[@]}" | sort -k2 > SHA256SUMS
          sha256sum --check SHA256SUMS

          python3 - <<'PY'
          import json
          import os
          import pathlib

          entries = []
          for line in pathlib.Path("SHA256SUMS").read_text().splitlines():
              digest, filename = line.split(maxsplit=1)
              entries.append({"file": filename.lstrip("*").strip(), "sha256": digest})

          payload = {
              "tool": "cargo-rail",
              "tag": os.environ["RELEASE_TAG"],
              "source_commit": os.environ["RELEASE_SHA"],
              "entries": entries,
          }
          pathlib.Path("SHA256SUMS.json").write_text(
              json.dumps(payload, indent=2, sort_keys=True) + "\n"
          )
          PY

      - name: Verify archive provenance
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          files=(cargo-rail-*.tar.* cargo-rail-*.zip)
          for file in "${files[@]}"; do
            gh attestation verify "$file" --repo "$GITHUB_REPOSITORY"
          done

      - name: Publish verified release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          files=(cargo-rail-*.tar.* cargo-rail-*.zip)
          gh release upload "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" \
            "${files[@]}" SHA256SUMS SHA256SUMS.json --clobber