release.yml

name: release

# Publishes signed, multi-arch (amd64 + arm64) container images to GHCR.
# Fires on a `v*` tag (the clean semver release) and can be run manually
# (workflow_dispatch) to validate without minting a tag. Each arch builds on its
# NATIVE runner (no slow QEMU emulation of the Rust build), pushes by digest,
# then a merge job assembles the multi-arch manifest and cosign keyless-signs it.
on:
  push:
    tags: ['v*']
  workflow_dispatch:

permissions:
  contents: read
  packages: write      # push to ghcr.io/<owner>/<repo>
  id-token: write      # cosign keyless signing via GitHub OIDC (Fulcio/Rekor)

env:
  IMAGE: ghcr.io/${{ github.repository }}

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v5
      - uses: docker/setup-buildx-action@v3
      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: ${{ matrix.platform }}
          provenance: true
          sbom: true
          cache-from: type=gha,scope=${{ matrix.platform }}
          cache-to: type=gha,mode=max,scope=${{ matrix.platform }}
          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          touch "/tmp/digests/${DIGEST#sha256:}"
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digest-${{ strategy.job-index }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digest-*
          merge-multiple: true
      - uses: docker/setup-buildx-action@v3
      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Image metadata (tags)
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
            type=sha
      - name: Create multi-arch manifest
        working-directory: /tmp/digests
        run: |
          # shellcheck disable=SC2046  # deliberate word-splitting: expand the tag
          # flags and per-arch digests into separate argv (canonical buildx pattern).
          docker buildx imagetools create \
            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf "${IMAGE}@sha256:%s " *)
        env:
          IMAGE: ${{ env.IMAGE }}
      - name: Inspect
        run: docker buildx imagetools inspect "${IMAGE}:${VERSION}"
        env:
          IMAGE: ${{ env.IMAGE }}
          VERSION: ${{ steps.meta.outputs.version }}
      - name: Install cosign
        uses: sigstore/cosign-installer@v3
      - name: Sign the multi-arch image (keyless)
        run: |
          DIGEST=$(docker buildx imagetools inspect "${IMAGE}:${VERSION}" \
            --format '{{json .Manifest}}' | jq -r .digest)
          cosign sign --yes "${IMAGE}@${DIGEST}"
        env:
          IMAGE: ${{ env.IMAGE }}
          VERSION: ${{ steps.meta.outputs.version }}