release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      mode:
        description: Release mode (dry-run validates release flow without publishing)
        required: true
        default: dry-run
        type: choice
        options:
          - dry-run
          - publish

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions: {}

jobs:
  maven-central:
    name: Publish to Maven Central
    runs-on: ubuntu-latest
    timeout-minutes: 60
    environment: release

    permissions:
      id-token: write # needed for OIDC-based Sigstore keyless signing and SLSA attestation
      attestations: write # needed to create SLSA build provenance attestations

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
        with:
          disable-sudo-and-containers: true
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: temurin
          java-version: '21'

      - name: Set up SBOM tools
        uses: ./.github/actions/setup-sbom-tools
        with:
          github-token: ${{ github.token }}

      - name: Import GPG key
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
        run: |
          gpg --batch --import <<< "${GPG_PRIVATE_KEY}"
          echo "allow-loopback-pinentry" >> ~/.gnupg/gpg-agent.conf
          gpgconf --kill gpg-agent

      - name: Validate publish dispatch is run on a tag
        if: ${{ github.event_name == 'workflow_dispatch' && inputs.mode == 'publish' && !startsWith(github.ref, 'refs/tags/v') }}
        run: |
          echo "::error::Publish mode requires a tag ref (refs/tags/v*). Dispatch this workflow from the release tag."
          exit 1

      - name: Build release artifacts
        run: ./mvnw -B -ntp -P integration-tests,generate-sbom,release -Dsigstore.skip=false -Daether.checksums.omitChecksumsForExtensions=.asc,.sigstore.json clean deploy

      - name: Scan SBOM for vulnerabilities
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
        with:
          scan-type: sbom
          scan-ref: target/bom_all.json
          format: table
          severity: HIGH,CRITICAL
          ignore-unfixed: true
          exit-code: '1'

      - name: Deploy to Maven Central
        if: ${{ startsWith(github.ref, 'refs/tags/v') && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'publish')) }}
        env:
          JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          JRELEASER_MAVENCENTRAL_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
          JRELEASER_MAVENCENTRAL_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}
          JRELEASER_NEXUS2_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
          JRELEASER_NEXUS2_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}
          JRELEASER_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
          JRELEASER_GPG_KEYNAME: ${{ secrets.GPG_KEY_ID }}
        run: ./mvnw -B -ntp -DskipTests jreleaser:deploy

      - name: Validate release configuration (dry-run mode)
        if: ${{ github.event_name == 'workflow_dispatch' && inputs.mode == 'dry-run' }}
        env:
          JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          JRELEASER_MAVENCENTRAL_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
          JRELEASER_MAVENCENTRAL_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}
          JRELEASER_NEXUS2_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
          JRELEASER_NEXUS2_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}
          JRELEASER_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
          JRELEASER_GPG_KEYNAME: ${{ secrets.GPG_KEY_ID }}
        run: ./mvnw -B -ntp -DskipTests jreleaser:deploy -Djreleaser.dry.run=true

      - name: Prepare CLI fat JAR
        if: ${{ startsWith(github.ref, 'refs/tags/v') && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'publish')) }}
        run: |
          mkdir -p out/cli-fatjar
          cp cli/target/codesign-cli-*-bin.jar out/cli-fatjar/

      - name: Upload CLI fat JAR
        if: ${{ startsWith(github.ref, 'refs/tags/v') && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'publish')) }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: cli-fatjar
          path: out/cli-fatjar/
          retention-days: 1
          if-no-files-found: error

      - name: Attest build provenance
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        if: ${{ startsWith(github.ref, 'refs/tags/v') && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'publish')) }}
        with:
          subject-path: |
            api/target/staging-deploy/**/*.jar
            api/target/staging-deploy/**/*.pom
            maven-plugin/target/staging-deploy/**/*.jar
            maven-plugin/target/staging-deploy/**/*.pom
            cli/target/staging-deploy/**/*.jar
            cli/target/staging-deploy/**/*.pom

  native-build:
    name: Native binaries
    if: ${{ startsWith(github.ref, 'refs/tags/v') && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'publish')) }}
    uses: ./.github/workflows/reusable-native-build.yml
    with:
      artifact-retention-days: 1

  assemble-and-release:
    name: Assemble archives and publish GitHub release
    needs: [maven-central, native-build]
    if: ${{ startsWith(github.ref, 'refs/tags/v') && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'publish')) }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment: release

    permissions:
      contents: write # needed to create GitHub release and upload artifacts
      id-token: write # needed for OIDC-based Sigstore keyless signing
      attestations: write # needed to create GitHub attestations via JReleaser catalog
      issues: write # needed by JReleaser to apply the 'released' label to issues

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
        with:
          disable-sudo-and-containers: true
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      # GraalVM is required here (instead of plain Temurin) because JReleaser
      # validates the native-image version even though no native compilation
      # happens in this job.
      - name: Set up GraalVM
        uses: graalvm/setup-graalvm@60c26726de13f8b90771df4bc1641a52a3159994 # v1.5.2
        with:
          java-version: '25'
          distribution: 'graalvm-community'

      - name: Download native binary (linux-x86_64)
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: csi-codesign-linux-x86_64
          path: out/linux-x86_64

      - name: Download native binary (linux-aarch_64)
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: csi-codesign-linux-aarch_64
          path: out/linux-aarch_64

      - name: Download native binary (osx-aarch_64)
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: csi-codesign-osx-aarch_64
          path: out/osx-aarch_64

      - name: Download native binary (osx-x86_64)
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: csi-codesign-osx-x86_64
          path: out/osx-x86_64

      - name: Download native binary (windows-x86_64)
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: csi-codesign-windows-x86_64
          path: out/windows-x86_64

      - name: Download CLI fat JAR
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: cli-fatjar
          path: out/cli-fatjar

      - name: Restore executable permissions on Linux and macOS binaries
        run: chmod +x out/linux-x86_64/csi-codesign out/linux-aarch_64/csi-codesign out/osx-aarch_64/csi-codesign out/osx-x86_64/csi-codesign

      - name: Create platform archives
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          mkdir -p out/archives
          for platform in linux-x86_64 linux-aarch_64 osx-x86_64 osx-aarch_64; do
            tar -czf "out/archives/csi-codesign-${VERSION}-${platform}.tar.gz" -C "out/${platform}" csi-codesign
          done
          (cd out/windows-x86_64 && zip "../../out/archives/csi-codesign-${VERSION}-windows-x86_64.zip" csi-codesign.exe)

      - name: Import GPG key
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
        run: |
          gpg --batch --import <<< "${GPG_PRIVATE_KEY}"
          echo "allow-loopback-pinentry" >> ~/.gnupg/gpg-agent.conf
          gpgconf --kill gpg-agent

      - name: Create staging directories required by JReleaser validation
        run: mkdir -p api/target/staging-deploy maven-plugin/target/staging-deploy cli/target/staging-deploy

      - name: Sign archives
        env:
          JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Maven Central and Nexus2 credentials are not used by jreleaser:sign,
          # but JReleaser validates the full configuration on startup.
          JRELEASER_MAVENCENTRAL_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
          JRELEASER_MAVENCENTRAL_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}
          JRELEASER_NEXUS2_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
          JRELEASER_NEXUS2_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}
          JRELEASER_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
          JRELEASER_GPG_KEYNAME: ${{ secrets.GPG_KEY_ID }}
        run: ./mvnw -B -ntp -N -DskipTests jreleaser:sign

      - name: Catalog distribution artifacts
        env:
          JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Maven Central and Nexus2 credentials are not used by jreleaser:catalog,
          # but JReleaser validates the full configuration on startup.
          JRELEASER_MAVENCENTRAL_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
          JRELEASER_MAVENCENTRAL_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}
          JRELEASER_NEXUS2_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
          JRELEASER_NEXUS2_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}
          JRELEASER_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
          JRELEASER_GPG_KEYNAME: ${{ secrets.GPG_KEY_ID }}
        run: ./mvnw -B -ntp -N -DskipTests jreleaser:catalog

      - name: Create GitHub release and upload archives
        env:
          JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Maven Central and Nexus2 credentials are not used by jreleaser:release,
          # but JReleaser validates the full configuration on startup.
          JRELEASER_MAVENCENTRAL_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
          JRELEASER_MAVENCENTRAL_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}
          JRELEASER_NEXUS2_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
          JRELEASER_NEXUS2_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}
        run: ./mvnw -B -ntp -N -DskipTests jreleaser:release