release.yml

name: Release

# Manually triggered (Actions tab -> Release -> Run workflow) by someone
# with write access to this repo -- deliberately NOT a tag-push trigger,
# so a release/PyPI publish can never fire from a stray tag or from a
# fork/PR (which never has write access or secrets on a public repo
# regardless). Builds standalone binaries for every supported platform
# (PyInstaller can't cross-compile, so each one runs on a real runner of
# that OS/arch), attaches them to a GitHub Release, then publishes to
# PyPI, npm (as platform-specific optionalDependencies packages), and
# GHCR.
#
# Required repo secrets (Settings -> Secrets and variables -> Actions):
#   PYPI_API_TOKEN   - PyPI account -> API tokens
#   NPM_TOKEN        - npmjs.com account -> Access Tokens -> Automation
# GITHUB_TOKEN (GHCR push) is provided automatically, no setup needed.

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to release (e.g. v0.3.0) -- must already exist and match src/secfoo/__about__.py"
        required: true

# Read-only by default; the two jobs that need to write (the GitHub
# Release, the GHCR push) grant themselves exactly that permission.
permissions:
  contents: read

jobs:
  check-version:
    name: Verify tag matches package version
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.check.outputs.version }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          ref: ${{ inputs.tag }}
      - id: check
        run: |
          TAG_VERSION="${{ inputs.tag }}"
          TAG_VERSION="${TAG_VERSION#v}"
          PKG_VERSION=$(grep -oP '(?<=__version__ = ")[^"]+' src/secfoo/__about__.py)
          echo "Tag version:     $TAG_VERSION"
          echo "Package version: $PKG_VERSION"
          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
            echo "::error::Tag ${{ inputs.tag }} does not match src/secfoo/__about__.py's __version__ ($PKG_VERSION). Bump __about__.py and retag."
            exit 1
          fi
          echo "version=$PKG_VERSION" >> "$GITHUB_OUTPUT"

  build-binaries:
    name: Build binary (${{ matrix.name }})
    needs: check-version
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-14
            name: darwin-arm64
          - os: macos-15-intel
            name: darwin-x64
          - os: ubuntu-latest
            name: linux-x64
          - os: ubuntu-24.04-arm
            name: linux-arm64
          - os: windows-latest
            name: win32-x64
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          ref: ${{ inputs.tag }}
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"
      - name: Install package + build deps
        run: pip install -e ".[build]"
      - name: Build binary
        run: pyinstaller packaging/secfoo.spec --distpath dist/binary --workpath build/pyinstaller --noconfirm
      - name: Stage artifact under its final release name
        shell: bash
        run: |
          mkdir -p out
          if [ "${{ runner.os }}" = "Windows" ]; then
            cp dist/binary/secfoo.exe out/secfoo-${{ matrix.name }}.exe
          else
            cp dist/binary/secfoo out/secfoo-${{ matrix.name }}
          fi
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: secfoo-${{ matrix.name }}
          path: out/*
          if-no-files-found: error

  release:
    name: Create GitHub Release
    needs: build-binaries
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          path: artifacts
      - name: Flatten artifacts and compute checksums
        run: |
          mkdir -p release
          find artifacts -type f -exec cp {} release/ \;
          (cd release && sha256sum * > SHA256SUMS)
      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
        with:
          tag_name: ${{ inputs.tag }}
          files: release/*
          generate_release_notes: true

  publish-pypi:
    name: Publish to PyPI
    needs: [check-version]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          ref: ${{ inputs.tag }}
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"
      - run: pip install build twine
      - run: python -m build
      - env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
        run: twine upload dist/*.tar.gz dist/*.whl

  publish-npm:
    name: Publish npm packages
    needs: [check-version, release]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          path: artifacts
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "20"
          registry-url: "https://registry.npmjs.org"
      - name: Populate platform binaries and publish all 6 packages
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          VERSION: ${{ needs.check-version.outputs.version }}
        run: |
          set -euo pipefail
          declare -A DIRS=(
            [darwin-arm64]=npm/secfoo-darwin-arm64
            [darwin-x64]=npm/secfoo-darwin-x64
            [linux-x64]=npm/secfoo-linux-x64
            [linux-arm64]=npm/secfoo-linux-arm64
            [win32-x64]=npm/secfoo-win32-x64
          )
          for plat in "${!DIRS[@]}"; do
            pkgdir="${DIRS[$plat]}"
            mkdir -p "$pkgdir/bin"
            if [ "$plat" = "win32-x64" ]; then
              cp "artifacts/secfoo-$plat/secfoo-$plat.exe" "$pkgdir/bin/secfoo.exe"
            else
              cp "artifacts/secfoo-$plat/secfoo-$plat" "$pkgdir/bin/secfoo"
              chmod +x "$pkgdir/bin/secfoo"
            fi
            npm version "$VERSION" --no-git-tag-version --prefix "$pkgdir" --allow-same-version
            npm publish --access public "$pkgdir"
          done
          npm version "$VERSION" --no-git-tag-version --prefix npm/secfoo --allow-same-version
          npm publish --access public npm/secfoo

  publish-docker:
    name: Publish Docker image (GHCR)
    needs: [check-version, publish-pypi]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          ref: ${{ inputs.tag }}
      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Wait for the new version to be installable from PyPI
        run: sleep 60
      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          context: .
          push: true
          tags: |
            ghcr.io/rakfortltd/secfoo:${{ needs.check-version.outputs.version }}
            ghcr.io/rakfortltd/secfoo:latest