hishtory/.github/workflows/slsa-releaser.yml

name: SLSA Client Releaser
on:
  workflow_dispatch:
  push:
    branches: [ master ]
    tags:
      - "*" 

permissions: read-all
      
jobs:
  # ldflags to embed the commit hash in the binary
  args:
    runs-on: ubuntu-latest
    outputs:
      ldflags: ${{ steps.ldflags.outputs.value }}
    steps:
      - id: checkout
        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.3.4
        with:
          fetch-depth: 0
      - id: ldflags
        run: |
          echo "::set-output name=value::$(./scripts/client-ldflags)"          

  # Trusted builders
  build-linux-amd64:
    permissions:
      id-token: write
      contents: write
      actions: read
    needs: args
    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.2.1
    with:
      config-file: .github/slsa/.slsa-goreleaser-linux-amd64.yml
      go-version: 1.21
      evaluated-envs: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
      compile-builder: true # See github.com/slsa-framework/slsa-github-generator/issues/942
  build-linux-arm64:
    permissions:
      id-token: write
      contents: write
      actions: read
    needs: args
    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.2.1
    with:
      config-file: .github/slsa/.slsa-goreleaser-linux-arm64.yml
      go-version: 1.21
      evaluated-envs: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
      compile-builder: true # See github.com/slsa-framework/slsa-github-generator/issues/942
  build-linux-arm7:
    permissions:
      id-token: write
      contents: write
      actions: read
    needs: args
    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.2.1
    with:
      config-file: .github/slsa/.slsa-goreleaser-linux-arm7.yml
      go-version: 1.21
      evaluated-envs: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
      compile-builder: true # See github.com/slsa-framework/slsa-github-generator/issues/942
  build-freebsd-amd64:
    permissions:
      id-token: write
      contents: write
      actions: read
    needs: args
    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.2.1
    with:
      config-file: .github/slsa/.slsa-goreleaser-freebsd-amd64.yml
      go-version: 1.21
      evaluated-envs: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
      compile-builder: true # See github.com/slsa-framework/slsa-github-generator/issues/942
  build-netbsd-amd64:
    permissions:
      id-token: write
      contents: write
      actions: read
    needs: args
    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.2.1
    with:
      config-file: .github/slsa/.slsa-goreleaser-netbsd-amd64.yml
      go-version: 1.21
      evaluated-envs: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
      compile-builder: true # See github.com/slsa-framework/slsa-github-generator/issues/942
  build-darwin-amd64:
    permissions:
      id-token: write
      contents: write
      actions: read
    needs: 
      - args 
    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.2.1
    with:
      config-file: .github/slsa/.slsa-goreleaser-darwin-amd64.yml
      go-version: 1.21
      evaluated-envs: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
      compile-builder: true # See github.com/slsa-framework/slsa-github-generator/issues/942
  build-darwin-arm64:
    permissions:
      id-token: write
      contents: write
      actions: read
    needs: 
      - args 
    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.2.1
    with:
      config-file: .github/slsa/.slsa-goreleaser-darwin-arm64.yml
      go-version: 1.21
      evaluated-envs: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
      compile-builder: true # See github.com/slsa-framework/slsa-github-generator/issues/942
      
  # Sign the binaries and upload the signed binaries
  macos_signer:
    runs-on: macos-11.0
    needs: 
      - build-darwin-amd64 
      - build-darwin-arm64 
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v2
      - name: Setup tmate session
        uses: mxschmitt/action-tmate@v3
        with:
          limit-access-to-actor: true
          detached: true
      - name: Download and sign the latest executables
        env: 
          GH_TOKEN: ${{ github.token }}
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
          MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
        run: |
          export GITHUB_TOKEN="${{ secrets.GITHUB_TOKEN }}"
          sleep 300
          gh run download -n hishtory-darwin-amd64
          gh run download -n hishtory-darwin-arm64
          brew install coreutils
          python3 scripts/actions-sign.py          
      - name: Upload Artifacts
        uses: actions/upload-artifact@v3
        with:
          name: hishtory-darwin-arm64
          path: hishtory-darwin-arm64
      - name: Upload Artifacts
        uses: actions/upload-artifact@v3
        with:
          name: hishtory-darwin-amd64
          path: hishtory-darwin-amd64
      - name: Upload Artifacts
        uses: actions/upload-artifact@v3
        with:
          name: hishtory-darwin-arm64-unsigned
          path: hishtory-darwin-arm64-unsigned
      - name: Upload Artifacts
        uses: actions/upload-artifact@v3
        with:
          name: hishtory-darwin-amd64-unsigned
          path: hishtory-darwin-amd64-unsigned
      - name: Release
        uses: softprops/action-gh-release@v1
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: |
            hishtory-darwin-arm64
            hishtory-darwin-arm64-unsigned
            hishtory-darwin-amd64
            hishtory-darwin-amd64-unsigned            
      - name: Trigger the backend API service so it knows a release is finished
        run: |
          curl https://api.hishtory.dev/api/v1/trigger-cron          

  # Validate the signed binaries
  validate:
    permissions:
      contents: read
    runs-on: macos-latest
    needs: 
      - build-linux-amd64 
      - build-darwin-amd64 
      - build-darwin-arm64 
      - macos_signer
    steps:
      - uses: actions/checkout@v4
      - name: Set up Go
        uses: actions/setup-go@v3
        with:
          go-version: 1.21
      - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
        with:
          name: hishtory-linux-amd64
      - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
        with:
          name: hishtory-linux-amd64.intoto.jsonl
      - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
        with:
          name: hishtory-linux-arm64
      - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
        with:
          name: hishtory-linux-arm64.intoto.jsonl
      - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
        with:
          name: hishtory-darwin-amd64
      - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
        with:
          name: hishtory-darwin-amd64.intoto.jsonl
      - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
        with:
          name: hishtory-darwin-amd64-unsigned
      - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
        with:
          name: hishtory-darwin-arm64
      - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
        with:
          name: hishtory-darwin-arm64.intoto.jsonl
      - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
        with:
          name: hishtory-darwin-arm64-unsigned
      - name: Validate Release
        run: |
          go build; ./hishtory install
          python3 scripts/actions-validate.py
          # TODO: Run validation using hishtory built at HEAD too          
      - name: Setup tmate session
        uses: mxschmitt/action-tmate@v3
        with:
          limit-access-to-actor: true
          detached: true