release.yml

name: Release

# Release is triggered by pushing a vX.Y.Z tag.
#
# PREREQUISITE: Before tagging, merge develop → main via PR.
# The tag must point to a commit on main, NOT develop.
# GitFlow: develop (default) → PR → main → tag → release.
#
# This workflow does NOT sync main — main must already be up to date.

on:
  push:
    tags:
      - 'v*'

env:
  CARGO_TERM_COLOR: always
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  verify-main:
    name: Verify tag is on main
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Check tag is on main
        run: |
          git fetch origin main
          TAG_SHA=$(git rev-parse "${{ github.ref }}^{commit}")
          MAIN_SHA=$(git rev-parse origin/main)
          echo "Tag: $TAG_SHA"
          echo "main: $MAIN_SHA"
          if [ "$TAG_SHA" = "$MAIN_SHA" ]; then
            echo "✅ Tag is main HEAD"
          elif git merge-base --is-ancestor "$TAG_SHA" origin/main 2>/dev/null; then
            echo "✅ Tag commit $TAG_SHA is in main history"
          else
            echo "::error::Tag commit $TAG_SHA is NOT on main."
            echo "Merge develop → main via PR before tagging."
            exit 1
          fi

  build-release:
    needs: [verify-main]
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux x86_64
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            artifact: cora-x86_64-unknown-linux-gnu
            ext: tar.gz
          # Linux ARM64
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            artifact: cora-aarch64-unknown-linux-gnu
            ext: tar.gz
          # macOS Apple Silicon
          - os: macos-latest
            target: aarch64-apple-darwin
            artifact: cora-aarch64-apple-darwin
            ext: tar.gz
          # Windows x86_64
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact: cora-x86_64-pc-windows-msvc
            ext: zip

    steps:
      - uses: actions/checkout@v6

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y musl-tools

      - name: Build release binary
        run: cargo build --release --target ${{ matrix.target }} --features tree-sitter

      - name: Strip binary (Unix)
        if: runner.os != 'Windows'
        run: strip target/${{ matrix.target }}/release/cora

      - name: Extract version
        id: version
        shell: bash
        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT

      - name: Package (Unix)
        if: runner.os != 'Windows'
        run: |
          mkdir -p release
          cp target/${{ matrix.target }}/release/cora release/cora
          cd release
          tar czf ${{ matrix.artifact }}-${{ steps.version.outputs.VERSION }}.${{ matrix.ext }} cora

      - name: Package (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          mkdir release
          cp target/${{ matrix.target }}/release/cora.exe release/${{ matrix.artifact }}.exe
          cd release
          7z a ${{ matrix.artifact }}-${{ steps.version.outputs.VERSION }}.${{ matrix.ext }} ${{ matrix.artifact }}.exe

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.artifact }}-${{ steps.version.outputs.VERSION }}
          path: release/${{ matrix.artifact }}-${{ steps.version.outputs.VERSION }}.${{ matrix.ext }}

  publish-crates:
    name: Publish to crates.io
    needs: [verify-main]
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - uses: actions/checkout@v6

      - uses: dtolnay/rust-toolchain@stable

      - name: Publish to crates.io
        run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }} --allow-dirty

  release:
    name: Create GitHub Release
    needs: [build-release]
    runs-on: ubuntu-latest
    # Least privilege, scoped to this job only:
    #   contents: write  -> create the GitHub Release and upload assets
    #   id-token: write  -> mint the GitHub OIDC token cosign exchanges for a
    #                       short-lived Sigstore (Fulcio) signing certificate (#591)
    permissions:
      contents: write
      id-token: write

    steps:
      - uses: actions/checkout@v6

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: release-artifacts
          merge-multiple: true

      - name: List artifacts
        run: ls -la release-artifacts/

      - name: Generate SHA256 checksums
        run: |
          cd release-artifacts
          sha256sum * > checksums-sha256.txt
          cat checksums-sha256.txt

      # Keyless signing (#591). Ordering matters: sign BEFORE creating the
      # release. If signing fails the job stops here and no release is
      # published, so we never ship a release that lacks its signature.
      # One signature over the checksums file covers every archive, because
      # install.sh / `cora upgrade` verify each archive against that file.
      # sigstore/cosign-installer v3.10.1, pinned by commit SHA.
      - name: Install cosign
        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5
        with:
          cosign-release: 'v2.6.5'

      - name: Sign checksums with cosign (keyless)
        working-directory: release-artifacts
        run: |
          cosign sign-blob --yes \
            --bundle checksums-sha256.txt.sigstore.json \
            checksums-sha256.txt
          test -s checksums-sha256.txt.sigstore.json

      # Fail the job (before publishing) if the bundle does not verify against
      # this exact workflow identity.
      - name: Verify the fresh signature
        working-directory: release-artifacts
        run: |
          cosign verify-blob \
            --bundle checksums-sha256.txt.sigstore.json \
            --certificate-identity "https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release.yml@${GITHUB_REF}" \
            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
            checksums-sha256.txt

      - name: Extract version from tag
        id: version
        run: |
          TAG_VERSION="${GITHUB_REF#refs/tags/}"
          SEMVER="${TAG_VERSION#v}"
          # Validate semver format (digits.digits.digits only — prevents sed injection)
          if ! echo "$SEMVER" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "ERROR: Invalid semver format: $SEMVER"
            exit 1
          fi
          echo "TAG=$TAG_VERSION" >> $GITHUB_OUTPUT
          echo "VERSION=$SEMVER" >> $GITHUB_OUTPUT

      - name: Extract changelog for this version
        id: changelog
        run: |
          CHANGELOG_EXCERPT=$(sed -n '/^## \['"${{ steps.version.outputs.VERSION }}"'\]/,/^## \[/p' CHANGELOG.md | sed '$d' | tail -n +2)
          {
            printf '## What'\''s New in %s\n\n' "${{ steps.version.outputs.TAG }}"
            printf '%s\n\n' "$CHANGELOG_EXCERPT"
            printf '### 📦 Platforms\n\n'
            printf '| Platform | File |\n'
            printf '|----------|------|\n'
            printf '| Linux (x86_64) | `cora-x86_64-unknown-linux-gnu-%s.tar.gz` |\n' "${{ steps.version.outputs.TAG }}"
            printf '| Linux (ARM64) | `cora-aarch64-unknown-linux-gnu-%s.tar.gz` |\n' "${{ steps.version.outputs.TAG }}"
            printf '| macOS (Apple Silicon) | `cora-aarch64-apple-darwin-%s.tar.gz` |\n' "${{ steps.version.outputs.TAG }}"
            printf '| Windows (x86_64) | `cora-x86_64-pc-windows-msvc-%s.zip` |\n\n' "${{ steps.version.outputs.TAG }}"
            printf '### 🚀 Quick Start\n\n'
            printf '```bash\n'
            printf '# Quick install (Linux / macOS)\n'
            printf 'curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-code/main/install.sh | sh\n\n'
            printf '# Or via cargo\n'
            printf 'cargo install cora\n\n'
            printf '# Init project\n'
            printf 'cora init\n\n'
            printf '# Review staged changes\n'
            printf 'CORA_API_KEY=your-key cora review --staged\n'
            printf '```\n\n'
            printf '**Full changelog:** https://github.com/codecoradev/cora-code/blob/main/CHANGELOG.md\n'
          } > release-notes.md

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.version.outputs.TAG }}
          name: Release ${{ steps.version.outputs.TAG }}
          body_path: release-notes.md
          files: release-artifacts/*
          draft: false
          prerelease: ${{ contains(steps.version.outputs.TAG, '-') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}