release.yml

name: Build Release Binaries

on:
  push:
    branches: [master]
    paths:
      - 'Cargo.toml'
      - 'Cargo.lock'   # a lock-only version sync must still trigger a build, or `cargo check --locked` fails on the next real change
      - 'src/**'
      - '.github/workflows/release.yml'
  workflow_dispatch:

# Serialise releases. Two releases minutes apart is not unusual, and every run
# ends by pushing a regenerated CHANGELOG.md to master — concurrent runs race
# that push and one of them loses it. Queue instead of colliding.
#
# cancel-in-progress is deliberately FALSE. The release job DELETES its tag and
# GitHub release before recreating them (see the `gh release delete` step), so a
# run cancelled at the wrong moment can leave the tag gone and nothing
# republished. A superseded build wasting 35 minutes is far cheaper than a
# half-published release someone has to repair by hand.
concurrency:
  group: release-binaries
  cancel-in-progress: false

jobs:
  build:
    strategy:
      # Don't cancel the other arch if one fails — we want partial
      # builds (e.g. x86_64 succeeds, aarch64 hits a transient GHCR
      # flake) to still produce artifacts we can release manually.
      # Without this, the v23.12.15 build had x86_64 marked as
      # "cancelled" because aarch64 timed out fetching the cross-rs
      # docker image.
      fail-fast: false
      matrix:
        include:
          # image_digest pins the cross-rs build container by content digest.
          # cross built from git always defaults to the mutable ":main" tag
          # (cross src/docker/shared.rs DEFAULT_IMAGE_VERSION), so without
          # this pin the toolchain container could change under us between
          # releases. To bump: docker manifest inspect ghcr.io/cross-rs/<target>:main
          - target: x86_64-unknown-linux-musl
            arch: x86_64
            runner: ubuntu-latest
            image_digest: sha256:f084277a81b3cdf05526f6cb2756b8d2a185e18f7f74a7aa90df9ee4b79855e2
          - target: aarch64-unknown-linux-musl
            arch: aarch64
            runner: ubuntu-latest
            image_digest: sha256:d4eea544818d42a15c090b2102b03c1a63a282505c9ab4b6bb7abb76b028a706
          # 32-bit ARM: Raspberry Pi running a 32-bit OS, older ARM NAS boxes.
          # Added 2026-07-28 — setup.sh no longer compiles on a user's machine
          # during an upgrade, so an architecture with no published binary
          # silently stops receiving updates. Verified to compile clean with
          # `cross check` against this image before adding.
          #
          # riscv64 is deliberately NOT here: the cross musl image for
          # riscv64gc ships no riscv64-linux-musl-gcc, so the C dependencies
          # (libz-sys et al) cannot build. The gnu target would work but would
          # not be a static binary, losing the "runs on any distro" property
          # every other artifact here has. WolfNet, which has no C deps, does
          # publish riscv64.
          - target: armv7-unknown-linux-musleabihf
            arch: armv7
            runner: ubuntu-latest
            image_digest: sha256:d943ceb3dccf755f6c0e45bd0d359f45b9e81bc007c916439af8aad2b85905c9

    runs-on: ${{ matrix.runner }}
    # Bound the wall-clock so a stuck network call doesn't hold a
    # runner for the full 6-hour GitHub default.
    #
    # 60, not 30: a cross build of this crate takes 21-27 minutes
    # depending on arch and runner luck (measured across v25.6.2-v25.6.4:
    # aarch64 21 and 26, armv7 25 and 27, x86_64 25 and 26). A 30-minute
    # cap left nothing in hand, and on v25.6.5 aarch64 crossed it — the
    # job was cancelled mid-compile, `release` needs every matrix leg, so
    # it was skipped and no release was cut at all despite two of three
    # binaries building fine. 60 keeps the runaway guard the comment above
    # asks for while leaving room for a slow runner.
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

      - name: Install Rust
        # SHA-pinned to master per the action's README: when the toolchain
        # is passed as an explicit input (instead of encoded in the @rev),
        # the pinned rev should be master.
        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
        with:
          toolchain: stable
          targets: ${{ matrix.target }}

      - name: Warnings are errors
        # Operator rule (2026-06-11): a compiler warning fails the release.
        # Runs natively on the runner (fast, no cross/env-passthrough
        # dependency) BEFORE the slow cross builds, so a warning fails in
        # ~2 minutes instead of 20.
        env:
          RUSTFLAGS: "-D warnings"
        # --locked: build the exact committed Cargo.lock, never re-resolve to
        # "latest compatible". A float drifted `time` onto a version that broke
        # `cookie` 0.16.2 on rustc 1.96 and failed the v24.39.0 release.
        run: cargo check --locked

      - name: Resource-safety gate + test suite
        # Operator rule (2026-08-06): WolfStack must never be capable of
        # taking down the estate it manages. `cargo check` compiles but runs
        # NOTHING, so until this step existed the test suite — including
        # tests/resource_safety.rs — never ran in CI at all, and every rule it
        # encodes was advisory.
        #
        # What this gates:
        #   - every outbound HTTP client bounds its CONNECT, not just the
        #     request. A SYN to an unroutable host holds a descriptor for the
        #     kernel's ~130s retry window; a client on a timer stacks those
        #     until the fd table is gone. That is the 2026-08-05 fleet
        #     meltdown: 2,422 SYN-SENT, 2,868 CLOSE-WAIT, ~700 sockets/min
        #     across twelve production nodes.
        #   - sysinfo never refreshes all processes off the demand path. It
        #     caches an open /proc/<pid>/stat handle per process and claims
        #     HALF of RLIMIT_NOFILE to do it.
        #
        # Runs natively BEFORE the slow cross builds, same reasoning as the
        # warnings gate above: a violation fails in ~2 minutes, not 20.
        # Only on the x86_64 leg — the rules are host-independent and running
        # them three times buys nothing.
        if: matrix.arch == 'x86_64'
        env:
          RUSTFLAGS: "-D warnings"
        run: cargo test --locked

      - name: Install cross
        # Pinned to an exact commit (last crates.io release v0.2.5 is from
        # 2023, so git install is required). --locked builds cross with its
        # own committed Cargo.lock — the whole cross toolchain is now
        # deterministic instead of tracking cross-rs HEAD on every release.
        run: cargo install cross --git https://github.com/cross-rs/cross --rev 64b5bb4d3d34de062552b9a2093affe77b4ad16a --locked

      - name: Pin libz-sys to working version
        run: |
          cargo update -p libz-sys --precise 1.1.25

      - name: Pre-pull cross-rs docker image with retries
        # `cross build` pulls the build image on first invocation. GHCR's
        # token endpoint occasionally times out and the build dies with
        # exit 125 (docker auth failure). Pull explicitly with 5 retries +
        # exponential-ish backoff so a transient outage doesn't fail the
        # whole release. Pulled by digest (see matrix.image_digest) so the
        # build container is immutable.
        run: |
          IMAGE="ghcr.io/cross-rs/${{ matrix.target }}@${{ matrix.image_digest }}"
          for attempt in 1 2 3 4 5; do
            echo "::group::Pull attempt $attempt for $IMAGE"
            if docker pull "$IMAGE"; then
              echo "::endgroup::"
              echo "✓ pulled $IMAGE on attempt $attempt"
              exit 0
            fi
            echo "::endgroup::"
            wait=$((attempt * 15))
            echo "::warning::pull attempt $attempt failed, sleeping ${wait}s before retry"
            sleep $wait
          done
          echo "::error::Failed to pull $IMAGE after 5 attempts. GHCR may be having an outage; re-run this job (gh run rerun --failed)."
          exit 1

      - name: Build static binary
        # CROSS_TARGET_<TRIPLE>_IMAGE overrides cross's default mutable
        # ":main" image with the digest-pinned one we just pulled (cross
        # src/docker/image.rs ImageReference: a full name is used verbatim;
        # env-var naming per cross src/config.rs build_var_name() = triple
        # uppercased with - replaced by _).
        run: |
          VAR="CROSS_TARGET_$(echo '${{ matrix.target }}' | tr '[:lower:]-' '[:upper:]_')_IMAGE"
          export "$VAR=ghcr.io/cross-rs/${{ matrix.target }}@${{ matrix.image_digest }}"
          cross build --release --target ${{ matrix.target }}

      - name: Get version
        id: version
        run: echo "version=$(grep '^version' Cargo.toml | head -1 | sed 's/.*\"\(.*\)\".*/\1/')" >> "$GITHUB_OUTPUT"

      - name: Package binary
        run: |
          mkdir -p dist
          cp target/${{ matrix.target }}/release/wolfstack dist/wolfstack-${{ matrix.arch }}
          chmod +x dist/wolfstack-${{ matrix.arch }}

      - name: Upload artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: wolfstack-${{ matrix.arch }}
          path: dist/wolfstack-${{ matrix.arch }}

  release:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write       # gh release create
      id-token: write       # cosign keyless OIDC + attest provenance
      attestations: write   # actions/attest-build-provenance
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
        with:
          # Need full history so we can extract the release commit body
          # for release notes, and regenerate CHANGELOG.md.
          fetch-depth: 0

      - name: Get version
        id: version
        run: echo "version=$(grep '^version' Cargo.toml | head -1 | sed 's/.*\"\(.*\)\".*/\1/')" >> "$GITHUB_OUTPUT"

      - name: Download all artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          path: dist
          merge-multiple: true

      - name: Compute SHA-256 checksums
        run: |
          cd dist
          sha256sum wolfstack-* > SHA256SUMS

      - name: Generate build-provenance attestation
        # Run BEFORE cosign signing so subject-path matches just the
        # binaries (not the .cosign.bundle files that signing produces).
        # Provenance covers both x86_64 and aarch64 in one attestation.
        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
        with:
          subject-path: |
            dist/wolfstack-x86_64
            dist/wolfstack-aarch64
            dist/wolfstack-armv7

      - name: Install cosign
        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
        with:
          cosign-release: 'v2.4.1'

      - name: Sign binaries with cosign (keyless)
        # Keyless OIDC: no private key to manage. The signing identity
        # is the workflow itself, anchored to the GitHub Actions OIDC
        # token. Verifiers check the cert chain back to Sigstore's
        # Fulcio CA + Rekor transparency log. Verification command is
        # in the release notes.
        run: |
          cd dist
          for f in wolfstack-x86_64 wolfstack-aarch64 wolfstack-armv7; do
            cosign sign-blob --yes \
              --bundle "${f}.cosign.bundle" \
              "$f"
          done

      - name: Generate release notes from release-commit body
        id: notes
        run: |
          # Find the most recent release commit (subject starts "v<version>:")
          # — that's the commit being released. Its body is the release notes.
          # Fallback to a generic note if no v* commit found in last 50.
          BODY=$(git log -50 --grep='^v[0-9]' -1 --pretty=format:'%b' || echo "")
          SUBJECT=$(git log -50 --grep='^v[0-9]' -1 --pretty=format:'%s' || echo "Release")

          {
            echo "## $SUBJECT"
            echo
            if [ -n "$BODY" ]; then
              echo "$BODY"
              echo
            fi
            cat <<'EOF'
          ---

          ## Verifying this release

          Each binary is signed via [cosign](https://docs.sigstore.dev/) keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a [SLSA build provenance](https://slsa.dev/spec/v1.0/provenance) attestation.

          **Verify the cosign signature:**
          ```
          cosign verify-blob \
            --bundle wolfstack-x86_64.cosign.bundle \
            --certificate-identity-regexp 'https://github.com/intelligentwolf/WolfStack/\.github/workflows/release\.yml@.*' \
            --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
            wolfstack-x86_64
          ```

          **Verify the build provenance:**
          ```
          gh attestation verify wolfstack-x86_64 --repo intelligentwolf/WolfStack
          ```

          **Verify the SHA-256 checksum:**
          ```
          sha256sum -c SHA256SUMS
          ```

          ## Artifacts

          - `wolfstack-x86_64` / `wolfstack-aarch64` / `wolfstack-armv7` — static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).
          - `wolfstack-<arch>.cosign.bundle` — cosign signature bundle (cert + signature + Rekor entry).
          - `SHA256SUMS` — checksums for both binaries.

          For per-version history see [CHANGELOG.md](https://github.com/intelligentwolf/WolfStack/blob/master/CHANGELOG.md).
          EOF
          } > release-notes.md

      - name: Create or update release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="v${{ steps.version.outputs.version }}"

          # Delete existing release if it exists (update scenario)
          gh release delete "$VERSION" --yes 2>/dev/null || true
          git push --delete origin "$VERSION" 2>/dev/null || true
          # Drop local tag too — with fetch-depth: 0 the checkout pulls
          # all tags, so a stale local v* tag disagrees with the just-
          # deleted remote one. `gh release create` refuses in that
          # state ("tag exists locally but has not been pushed"). The
          # next step's `--target master` re-creates the tag fresh.
          git tag -d "$VERSION" 2>/dev/null || true

          # Create release with binaries, signatures, and checksums
          gh release create "$VERSION" \
            --target master \
            --title "WolfStack $VERSION" \
            --notes-file release-notes.md \
            dist/wolfstack-x86_64 \
            dist/wolfstack-x86_64.cosign.bundle \
            dist/wolfstack-aarch64 \
            dist/wolfstack-aarch64.cosign.bundle \
            dist/wolfstack-armv7 \
            dist/wolfstack-armv7.cosign.bundle \
            dist/SHA256SUMS

      - name: Regenerate CHANGELOG.md and push back to master
        # Best-effort: CHANGELOG.md is regenerated from `git log` after
        # each release so the file always reflects the latest tagged
        # version. The workflow's path filter excludes CHANGELOG.md, so
        # this push doesn't re-trigger the workflow (no loop).
        # If push fails (branch protection, race) the release is still
        # cut — operator runs `scripts/gen-changelog.sh` locally and
        # commits manually.
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          bash scripts/gen-changelog.sh CHANGELOG.md
          if git diff --quiet CHANGELOG.md; then
            echo "CHANGELOG.md already up to date"
            exit 0
          fi
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
          git add CHANGELOG.md
          git commit -m "chore: regenerate CHANGELOG.md for v${{ steps.version.outputs.version }}"
          git push origin master || {
            echo "::warning::Failed to push CHANGELOG.md update — release was cut, but the file is now stale. Run scripts/gen-changelog.sh locally and commit." >&2
            exit 0
          }