release.yml

name: Release

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+*'

permissions:
  contents: read

env:
  WAYBILL_VERSION: v0.2.0
  WAYBILL_SHA256: 5f946e48de62f44d205ef92a21864f55fc49a7da4f71619aec0c1e4cd1c617bb

jobs:
  verify:
    name: Build, Test & Verify dist
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: package.json
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Build, lint & test
        run: |
          npm run build
          npm run lint
          npm test

      - name: Verify committed dist/ matches source
        run: |
          npm run pack
          if [ -n "$(git status --porcelain dist/)" ]; then
            echo "::error::dist/ is out of date. Run 'npm run pack' and commit the result before tagging."
            git --no-pager diff --stat dist/
            exit 1
          fi

  github-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs: verify
    permissions:
      contents: write
      id-token: write # For cosign keyless signing
      attestations: write # For GitHub artifact attestations
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Extract version from tag
        run: |
          echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
          echo "MAJOR=${GITHUB_REF_NAME%%.*}" >> "$GITHUB_ENV"

      - name: Install waybill
        run: |
          curl -sSfL -o waybill.tar.gz \
            "https://github.com/kusari-oss/waybill/releases/download/${WAYBILL_VERSION}/waybill-${WAYBILL_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
          echo "${WAYBILL_SHA256}  waybill.tar.gz" | sha256sum -c -
          tar -xzf waybill.tar.gz
          sudo install -m 0755 "waybill-${WAYBILL_VERSION}-x86_64-unknown-linux-gnu/waybill" /usr/local/bin/waybill
          waybill --version

      - name: Generate SBOM (SPDX 2.3)
        run: |
          waybill sbom scan --path . \
            --exclude-path dist \
            --exclude-scope dev,build,test \
            --format spdx-2.3-json \
            --output "prow-github-actions-${VERSION}.spdx.json"

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Sign SBOM
        run: |
          cosign sign-blob --yes \
            --bundle "prow-github-actions-${VERSION}.spdx.json.bundle" \
            "prow-github-actions-${VERSION}.spdx.json"

      - name: Attest build provenance
        id: provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: |
            dist/index.js
            prow-github-actions-${{ env.VERSION }}.spdx.json

      - name: Rename provenance bundle
        env:
          BUNDLE_PATH: ${{ steps.provenance.outputs.bundle-path }}
        run: cp "$BUNDLE_PATH" "prow-github-actions-${VERSION}.intoto.jsonl"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          tag_name: ${{ github.ref_name }}
          name: prow-github-actions ${{ env.VERSION }}
          generate_release_notes: true
          files: |
            prow-github-actions-${{ env.VERSION }}.spdx.json
            prow-github-actions-${{ env.VERSION }}.spdx.json.bundle
            prow-github-actions-${{ env.VERSION }}.intoto.jsonl
          body: |
            ## Usage

            ```yaml
            - uses: ${{ github.repository }}@${{ github.ref_name }}
            ```

            ## SBOM and provenance

            An SPDX 2.3 SBOM of the runtime dependencies, generated with
            [waybill](https://github.com/kusari-oss/waybill), is attached as
            `prow-github-actions-${{ env.VERSION }}.spdx.json` and signed with
            [cosign](https://github.com/sigstore/cosign) (keyless). SLSA build
            provenance covering both `dist/index.js` and the SBOM is attached as
            `prow-github-actions-${{ env.VERSION }}.intoto.jsonl`.

            Verify the SBOM signature:
            ```bash
            cosign verify-blob \
              --bundle prow-github-actions-${{ env.VERSION }}.spdx.json.bundle \
              --certificate-identity-regexp="https://github.com/${{ github.repository }}" \
              --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
              prow-github-actions-${{ env.VERSION }}.spdx.json
            ```

            Verify the provenance of the bundled action:
            ```bash
            gh attestation verify dist/index.js --repo ${{ github.repository }}
            ```
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}

      - name: Prepend curated release notes
        if: ${{ hashFiles(format('docs/releases/v{0}.md', env.VERSION)) != '' }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release view "$GITHUB_REF_NAME" --json body -q .body > generated-notes.md
          cat "docs/releases/v${VERSION}.md" generated-notes.md > release-notes.md
          gh release edit "$GITHUB_REF_NAME" --notes-file release-notes.md

      - name: Update floating major tag
        if: ${{ !contains(github.ref_name, '-') }}
        run: |
          git tag -f "$MAJOR" "$GITHUB_REF_NAME"
          git push -f origin "refs/tags/$MAJOR"