release.yaml

# Reusable Release Workflow for ConductorOne Connectors
#
# Documentation:
#   - docs/release-workflow.md - Pipeline overview, security properties, testing
#   - docs/diagrams/DIAGRAM_RULES.md - When to update documentation
#
# When modifying this file, update documentation if you change:
#   - Job structure or dependencies → update docs/diagrams/release-workflow.dot
#   - Security properties → update docs/release-workflow.md
#   - Run `make docs` to regenerate the diagram

name: Reusable Release Workflow

on:
  workflow_call:
    inputs:
      tag:
        required: true
        type: string
      release_storage_name:
        required: false
        type: string
        default: ""
        description: "Optional release storage path segment. Defaults to the repository name."
      lambda:
        required: false
        type: boolean
        default: true
        description: "Whether to release with Lambda image support."
      docker:
        required: false
        type: boolean
        default: true
        description: "Whether to release with Docker image support."
      dockerfile_template:
        required: false
        type: string
        default: ""
        description: "Path to a custom Dockerfile template in the caller repo (relative to repo root). Only valid when lambda is false. Supports ${REPO_NAME} substitution."
      docker_extra_files:
        required: false
        type: string
        default: ""
        description: "Comma-separated list of extra files/directories from the caller repo to include in the Docker build context (e.g., 'java,config'). Only valid when dockerfile_template is set."
      msi:
        required: false
        type: boolean
        default: true
        description: "Whether to build MSI Windows installers."
      msi_wxs_path:
        required: false
        type: string
        default: ""
        description: "Path to a custom WXS file in the caller repo for MSI generation (relative to repo root). If not provided, uses default template."
    secrets:
      RELENG_GITHUB_TOKEN:
        required: true
      APPLE_SIGNING_KEY_P12:
        required: true
      APPLE_SIGNING_KEY_P12_PASSWORD:
        required: true
      AC_PASSWORD:
        required: true
      AC_PROVIDER:
        required: true
      DATADOG_API_KEY:
        required: true
      GORELEASER_PRO_KEY:
        required: false
        description: "GoReleaser Pro license key for MSI builds. Required when msi is true."

env:
  CDN_BASE_URL: "https://dist.conductorone.com"
  S3_BUCKET: "connector-artifact-registry"
  GENERATED_DIR: "_generated"

permissions: {}

concurrency:
  group: release-${{ github.repository }}-${{ inputs.tag }}
  cancel-in-progress: false

jobs:
  validate-inputs:
    runs-on: ubuntu-latest
    steps:
      - name: Validate tag format
        env:
          TAG: ${{ inputs.tag }}
        run: |
          # Strict semver regex with 'v' prefix (per https://semver.org)
          # Supports: v1.2.3, v1.2.3-alpha, v1.2.3-alpha.1, v1.2.3+build, v1.2.3-rc.1+build.123
          SEMVER_REGEX='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-((0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*)(\.(0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*))*))?(\+([0-9a-zA-Z-]+(\.[0-9a-zA-Z-]+)*))?$'
          if [[ ! "$TAG" =~ $SEMVER_REGEX ]]; then
            echo "::error::Tag must be valid semver starting with 'v' (e.g., v1.2.3, v1.0.0-rc.1). Got: $TAG"
            exit 1
          fi
          echo "✅ Tag format valid: $TAG"

      - name: Validate dockerfile_template requires lambda=false
        if: inputs.dockerfile_template != '' && inputs.lambda == true
        run: |
          echo "::error::dockerfile_template can only be used when lambda is false"
          exit 1

      - name: Validate release_storage_name has safe path segment
        if: inputs.release_storage_name != ''
        env:
          RELEASE_STORAGE_NAME: ${{ inputs.release_storage_name }}
        run: |
          if [[ ! "$RELEASE_STORAGE_NAME" =~ ^[a-z][a-z0-9-]{0,99}$ ]]; then
            echo "::error::release_storage_name must match ^[a-z][a-z0-9-]{0,99}$ to align with registry release target validation. Got: $RELEASE_STORAGE_NAME"
            exit 1
          fi

      - name: Validate dockerfile_template has safe path
        if: inputs.dockerfile_template != ''
        env:
          DOCKERFILE_TEMPLATE: ${{ inputs.dockerfile_template }}
        run: |
          if [[ "$DOCKERFILE_TEMPLATE" == /* ]] || [[ "$DOCKERFILE_TEMPLATE" == *".."* ]] || [[ ! "$DOCKERFILE_TEMPLATE" =~ ^[A-Za-z0-9._/-]+$ ]]; then
            echo "::error::dockerfile_template must be a relative path with safe characters and without '..' traversal. Got: $DOCKERFILE_TEMPLATE"
            exit 1
          fi

      - name: Validate docker_extra_files requires dockerfile_template
        if: inputs.docker_extra_files != '' && inputs.dockerfile_template == ''
        run: |
          echo "::error::docker_extra_files can only be used when dockerfile_template is set"
          exit 1

      - name: Validate docker_extra_files have safe paths
        if: inputs.docker_extra_files != ''
        env:
          DOCKER_EXTRA_FILES: ${{ inputs.docker_extra_files }}
        run: |
          IFS=',' read -ra FILES <<< "$DOCKER_EXTRA_FILES"
          for file in "${FILES[@]}"; do
            file="${file#"${file%%[![:space:]]*}"}"
            file="${file%"${file##*[![:space:]]}"}"
            if [[ -z "$file" ]] || [[ "$file" == /* ]] || [[ "$file" == *".."* ]] || [[ ! "$file" =~ ^[A-Za-z0-9._/-]+$ ]]; then
              echo "::error::docker_extra_files entries must be relative paths with safe characters and without '..' traversal. Got: $file"
              exit 1
            fi
          done

      - name: Validate msi_wxs_path has no path traversal
        if: inputs.msi_wxs_path != ''
        env:
          WXS_PATH: ${{ inputs.msi_wxs_path }}
        run: |
          if [[ "$WXS_PATH" == /* ]] || [[ "$WXS_PATH" == *".."* ]] || [[ ! "$WXS_PATH" =~ ^[A-Za-z0-9._/-]+$ ]]; then
            echo "::error::msi_wxs_path must be a relative path with safe characters and without '..' traversal. Got: $WXS_PATH"
            exit 1
          fi

      - name: Validate GORELEASER_PRO_KEY when msi enabled
        if: inputs.msi == true
        env:
          HAS_KEY: ${{ secrets.GORELEASER_PRO_KEY != '' }}
        run: |
          if [ "$HAS_KEY" != "true" ]; then
            echo "::error::GORELEASER_PRO_KEY secret is required when msi is true"
            exit 1
          fi

  determine-workflows-ref:
    needs: validate-inputs
    runs-on: ubuntu-latest
    permissions:
      actions: read
    outputs:
      ref: ${{ steps.workflow-version.outputs.sha }}
    steps:
      - name: Determine workflows ref
        id: workflow-version
        uses: canonical/get-workflow-version-action@v1
        with:
          repository-name: "ConductorOne/github-workflows"
          file-name: "release.yaml"
          github-token: ${{ secrets.GITHUB_TOKEN }}

  goreleaser-binaries:
    needs: determine-workflows-ref
    runs-on: macos-latest
    permissions:
      contents: read
      id-token: write # <-- needed for cosign keyless (OIDC)
    outputs:
      s3_directory: ${{ steps.s3-directory.outputs.S3_DIRECTORY }}
      binaries_manifest: ${{ steps.generate-binaries-manifest.outputs.binaries_manifest }}
      binaries_checksums: ${{ steps.output-checksums.outputs.checksums }}
      released_at: ${{ steps.release-meta.outputs.released_at }}
    steps:
      - name: Checkout caller repo
        uses: actions/checkout@v5
        with:
          path: _caller
          repository: ${{ github.event.repository.full_name }}
          ref: refs/tags/${{ inputs.tag }}
          fetch-depth: 0
          persist-credentials: false

      - name: Verify caller checkout matches release tag
        working-directory: _caller
        shell: bash
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          tag_commit="$(git rev-list -n 1 "refs/tags/$RELEASE_TAG")"
          head_commit="$(git rev-parse HEAD)"
          if [ "$head_commit" != "$tag_commit" ]; then
            echo "::error::Checked out $head_commit but refs/tags/$RELEASE_TAG resolves to $tag_commit"
            exit 1
          fi
          echo "Verified $RELEASE_TAG at $head_commit"

      - name: Checkout connector workflows
        uses: actions/checkout@v5
        with:
          path: _workflows
          repository: ConductorOne/github-workflows
          ref: ${{ needs.determine-workflows-ref.outputs.ref }}
          persist-credentials: false

      - name: Derive AWS role names
        id: role-names
        working-directory: _workflows
        shell: bash
        env:
          REPO_OWNER: ${{ github.event.repository.owner.login }}
          REPO_NAME: ${{ github.event.repository.name }}
        run: |
          bash ./scripts/derive-iam-role-name.sh \
            --prefix GHA-Artifacts- \
            --suffix "${REPO_OWNER}-${REPO_NAME}" \
            --output-name gha_artifacts_role_name >> "$GITHUB_OUTPUT"

      - name: Set up Go for caller
        uses: actions/setup-go@v6
        with:
          go-version-file: "_caller/go.mod"
          cache: false

      - name: Calculate S3 directory
        id: s3-directory
        shell: bash
        run: |
          ORG="${{ github.event.repository.owner.login }}"
          REPO="${{ github.event.repository.name }}"
          STORAGE_NAME="${{ inputs.release_storage_name }}"
          TAG="${{ inputs.tag }}"
          if [ -z "$STORAGE_NAME" ]; then
            STORAGE_NAME="$REPO"
          fi
          echo "S3_DIRECTORY=releases/$ORG/$STORAGE_NAME/$TAG" >> "$GITHUB_OUTPUT"

      - name: Generate configs for binaries
        working-directory: _workflows
        env:
          REPO_NAME: ${{ github.event.repository.name }}
          # For provenance predicate template
          WORKFLOWS_REF: ${{ needs.determine-workflows-ref.outputs.ref }}
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          mkdir -p "${GENERATED_DIR}"
          export BUILD_STARTED_ON=$(date -u +"%Y-%m-%dT%H:%M:%SZ")

          envsubst < .gon-amd64-template.json | tee "${GENERATED_DIR}/.gon-amd64.json"
          envsubst < .gon-arm64-template.json | tee "${GENERATED_DIR}/.gon-arm64.json"
          envsubst < templates/.goreleaser-binaries-template.yaml.tmpl | tee "${GENERATED_DIR}/.goreleaser.binaries.yaml"
          envsubst < templates/.slsa-provenance-predicate-template.json.tmpl | tee "${GENERATED_DIR}/predicate.json"

      - name: Set up Gon
        run: brew tap conductorone/gon && brew install conductorone/gon/gon

      - name: Import Keychain Certs
        uses: apple-actions/import-codesign-certs@v1
        with:
          p12-file-base64: ${{ secrets.APPLE_SIGNING_KEY_P12 }}
          p12-password: ${{ secrets.APPLE_SIGNING_KEY_P12_PASSWORD }}

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Download syft
        uses: anchore/sbom-action/download-syft@v0

      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
          aws-region: us-west-2

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          workdir: _caller
          version: "~> v2.13"
          args: release --clean --config ../_workflows/_generated/.goreleaser.binaries.yaml
        env:
          GITHUB_TOKEN: ${{ secrets.RELENG_GITHUB_TOKEN }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
          AC_PROVIDER: ${{ secrets.AC_PROVIDER }}

      - name: Generate SLSA provenance for archives
        working-directory: _workflows
        env:
          CALLER_DIST: ../_caller/dist
        shell: bash
        run: |
          set -euo pipefail

          PROVENANCE_COUNT=0

          # Find all downloadable archives (not checksums, not signatures, not sboms)
          for artifact in "${CALLER_DIST}"/*.zip "${CALLER_DIST}"/*.tar.gz; do
            [ -f "$artifact" ] || continue
            # Skip if it's not an archive we want to attest
            [[ "$artifact" == *checksums* ]] && continue

            BASENAME=$(basename "$artifact")
            echo "Generating provenance for: $BASENAME"
            cosign attest-blob \
              --yes \
              --predicate "${GENERATED_DIR}/predicate.json" \
              --type slsaprovenance1 \
              --bundle "${CALLER_DIST}/${BASENAME}.provenance.sigstore.json" \
              "$artifact" > /dev/null
            echo "✅ Created ${BASENAME}.provenance.sigstore.json"
            ((PROVENANCE_COUNT++)) || true
          done

          # Note: checksums provenance is generated in publish-release-manifest job
          # after merging with Windows hashes

          echo "Generated provenance bundles: ${PROVENANCE_COUNT}"
          if [ "$PROVENANCE_COUNT" -eq 0 ]; then
            echo "::error::No provenance bundles were generated - this indicates a build problem"
            exit 1
          fi
          ls "${CALLER_DIST}"/*.provenance.sigstore.json

      - name: Sign SBOMs as attestation bundles
        working-directory: _workflows
        env:
          CALLER_DIST: ../_caller/dist
        shell: bash
        run: |
          set -euo pipefail

          SIGNED_COUNT=0

          # Find all SBOM files generated by GoReleaser (syft)
          # GoReleaser names SBOMs as: archive.zip.sbom.json or archive.tar.gz.sbom.json
          for sbom in "${CALLER_DIST}"/*.sbom.json; do
            [ -f "$sbom" ] || continue

            # Get the archive filename (remove .sbom.json suffix)
            # e.g., "baton-foo-v1.0.0-darwin-amd64.zip.sbom.json" -> "baton-foo-v1.0.0-darwin-amd64.zip"
            SBOM_BASENAME=$(basename "$sbom")
            ARCHIVE_NAME="${SBOM_BASENAME%.sbom.json}"

            # The archive name after stripping .sbom.json already includes the extension (.zip or .tar.gz)
            ARCHIVE="${CALLER_DIST}/${ARCHIVE_NAME}"

            if [ ! -f "$ARCHIVE" ]; then
              echo "::error::Could not find archive for SBOM: $sbom (expected: $ARCHIVE)"
              exit 1
            fi

            echo "Signing SBOM for: $(basename "$ARCHIVE")"
            cosign attest-blob \
              --yes \
              --predicate "$sbom" \
              --type https://spdx.dev/Document \
              --bundle "${ARCHIVE}.sbom.sigstore.json" \
              "$ARCHIVE" > /dev/null
            echo "✅ Created $(basename "$ARCHIVE").sbom.sigstore.json"
            ((SIGNED_COUNT++)) || true
          done

          echo "Generated SBOM bundles: ${SIGNED_COUNT}"
          ls "${CALLER_DIST}"/*.sbom.sigstore.json 2>/dev/null || echo "ℹ️ No SBOM bundles generated (GoReleaser may not have generated SBOMs)"

      - name: Upload binary release artifacts to S3
        working-directory: _workflows
        env:
          S3_BUCKET: ${{ env.S3_BUCKET }}
          S3_DIRECTORY: ${{ steps.s3-directory.outputs.S3_DIRECTORY }}
        shell: bash
        run: |
          set -euo pipefail
          ./scripts/upload-release-artifacts.sh \
            --bucket "$S3_BUCKET" \
            --directory "$S3_DIRECTORY" \
            --base-dir "../_caller/dist"

      - name: Set up Go for workflows
        uses: actions/setup-go@v6
        with:
          go-version-file: "_workflows/go.mod"
          cache: false

      - name: Fetch release metadata
        id: release-meta
        working-directory: _workflows
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          mkdir -p "$GITHUB_WORKSPACE/_release_metadata"
          RELEASE_JSON="$GITHUB_WORKSPACE/_release_metadata/github-release.json"
          CHANGELOG_FILE="$GITHUB_WORKSPACE/_release_metadata/binaries-changelog.md"
          WORKFLOW_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"

          if ! gh api "repos/${{ github.repository }}/releases/tags/${{ inputs.tag }}" > "$RELEASE_JSON" 2>/dev/null; then
            echo '{}' > "$RELEASE_JSON"
          fi

          go run ./cmd/release-metadata \
            -repo-dir ../_caller \
            -tag "${{ inputs.tag }}" \
            -workflow-time "$WORKFLOW_TIME" \
            -github-release-json "$RELEASE_JSON" \
            -changelog-file "$CHANGELOG_FILE" \
            >> "$GITHUB_OUTPUT"

      - name: Generate manifest.json
        id: generate-binaries-manifest
        working-directory: _workflows
        env:
          CALLER_DIST: ../_caller/dist
        run: |
          MANIFEST_JSON=$(go run ./cmd/generate-manifest \
            -asset-dir "${CALLER_DIST}" \
            -repo-name "${{ github.event.repository.name }}" \
            -org-name "${{ github.event.repository.owner.login }}" \
            -tag "${{ inputs.tag }}" \
            -released-at "${{ steps.release-meta.outputs.released_at }}" \
            -base-url "${{ env.CDN_BASE_URL }}/${{ steps.s3-directory.outputs.S3_DIRECTORY }}")

          # Debug output
          echo "$MANIFEST_JSON"

          # Write to GITHUB_OUTPUT for job output
          {
            echo "binaries_manifest<<EOF"
            echo "$MANIFEST_JSON"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Output checksums for merging
        id: output-checksums
        working-directory: _caller
        run: |
          # Find the checksums file generated by GoReleaser
          CHECKSUMS_FILE=$(ls dist/*checksums*.txt 2>/dev/null | head -1)
          if [ -z "$CHECKSUMS_FILE" ]; then
            echo "::error::No checksums file found"
            exit 1
          fi

          echo "Found checksums file: $CHECKSUMS_FILE"

          # Output checksums content for merging with Windows hashes in registry job
          # Use randomized delimiter to prevent injection via filenames containing "EOF"
          DELIM="CHECKSUMS_$(openssl rand -hex 8)"
          {
            echo "checksums<<${DELIM}"
            cat "$CHECKSUMS_FILE"
            echo "${DELIM}"
          } >> "$GITHUB_OUTPUT"

  goreleaser-windows:
    if: inputs.msi == true
    needs: determine-workflows-ref
    runs-on: windows-latest
    permissions:
      contents: read
      id-token: write
    outputs:
      windows_manifest: ${{ steps.generate-windows-manifest.outputs.windows_manifest }}
    steps:
      - name: Enable Git long paths
        shell: pwsh
        run: git config --system core.longpaths true

      - name: Checkout caller repo
        uses: actions/checkout@v5
        with:
          path: _caller
          repository: ${{ github.event.repository.full_name }}
          ref: refs/tags/${{ inputs.tag }}
          fetch-depth: 0
          persist-credentials: false

      - name: Verify caller checkout matches release tag
        working-directory: _caller
        shell: bash
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          tag_commit="$(git rev-list -n 1 "refs/tags/$RELEASE_TAG")"
          head_commit="$(git rev-parse HEAD)"
          if [ "$head_commit" != "$tag_commit" ]; then
            echo "::error::Checked out $head_commit but refs/tags/$RELEASE_TAG resolves to $tag_commit"
            exit 1
          fi
          echo "Verified $RELEASE_TAG at $head_commit"

      - name: Checkout connector workflows
        uses: actions/checkout@v5
        with:
          path: _workflows
          repository: ConductorOne/github-workflows
          ref: ${{ needs.determine-workflows-ref.outputs.ref }}
          persist-credentials: false

      - name: Derive AWS role names
        id: role-names
        working-directory: _workflows
        shell: bash
        env:
          REPO_OWNER: ${{ github.event.repository.owner.login }}
          REPO_NAME: ${{ github.event.repository.name }}
        run: |
          bash ./scripts/derive-iam-role-name.sh \
            --prefix GHA-Artifacts- \
            --suffix "${REPO_OWNER}-${REPO_NAME}" \
            --output-name gha_artifacts_role_name >> "$GITHUB_OUTPUT"

      - name: Set up Go for caller
        uses: actions/setup-go@v6
        with:
          go-version-file: "_caller/go.mod"
          cache: false

      - name: Generate or locate WXS file
        id: wxs
        shell: pwsh
        env:
          REPO_NAME: ${{ github.event.repository.name }}
          CUSTOM_WXS: ${{ inputs.msi_wxs_path }}
        run: |
          New-Item -ItemType Directory -Force -Path "_workflows/_generated"

          if ($env:CUSTOM_WXS -ne "") {
            # Use custom WXS from caller repo
            $wxsPath = "_caller/$env:CUSTOM_WXS"
            if (-not (Test-Path $wxsPath)) {
              Write-Error "Custom WXS file not found: $env:CUSTOM_WXS"
              exit 1
            }
            Write-Host "Using custom WXS: $wxsPath"
            Copy-Item $wxsPath "_workflows/_generated/app.wxs"
            "wxs_path=../_workflows/_generated/app.wxs" >> $env:GITHUB_OUTPUT
          } else {
            # Generate WXS from default template with deterministic UpgradeCode
            Write-Host "Using default WXS template"

            # Generate deterministic UUID v5 from repo name using Python's standard library
            # Uses URL namespace (6ba7b810-9dad-11d1-80b4-00c04fd430c8) per RFC 4122
            $upgradeCode = (python -c "import uuid; print(str(uuid.uuid5(uuid.NAMESPACE_URL, '$env:REPO_NAME')).upper())")

            Write-Host "Generated UpgradeCode for $env:REPO_NAME`: $upgradeCode"

            # Read template and substitute UpgradeCode
            $template = Get-Content "_workflows/templates/.wxs-default-template.wxs" -Raw
            $template = $template -replace '\$\{UPGRADE_CODE\}', $upgradeCode
            $template | Out-File "_workflows/_generated/app.wxs" -Encoding utf8

            "wxs_path=../_workflows/_generated/app.wxs" >> $env:GITHUB_OUTPUT
          }

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Download syft
        uses: anchore/sbom-action/download-syft@v0

      - name: Generate configs for Windows
        working-directory: _workflows
        shell: bash
        env:
          REPO_NAME: ${{ github.event.repository.name }}
          WXS_PATH: ${{ steps.wxs.outputs.wxs_path }}
          WORKFLOWS_REF: ${{ needs.determine-workflows-ref.outputs.ref }}
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          export BUILD_STARTED_ON=$(date -u +"%Y-%m-%dT%H:%M:%SZ")

          # Generate GoReleaser config
          envsubst < templates/.goreleaser-windows-template.yaml.tmpl | tee "_generated/.goreleaser.windows.yaml"

          # Generate provenance predicate
          envsubst < templates/.slsa-provenance-predicate-template.json.tmpl | tee "_generated/predicate.json"

      - name: Run GoReleaser for Windows
        uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser-pro
          workdir: _caller
          version: "~> v2.13"
          args: release --clean --skip=publish --config ../_workflows/_generated/.goreleaser.windows.yaml
        env:
          GITHUB_TOKEN: ${{ secrets.RELENG_GITHUB_TOKEN }}
          GORELEASER_KEY: ${{ secrets.GORELEASER_PRO_KEY }}

      - name: Flatten MSI directory structure
        shell: pwsh
        run: |
          # GoReleaser Pro puts MSI files in dist/msi/<name>/ subdirectory
          # Copy all files to dist root to match binaries job pattern
          $msiDir = "_caller/dist/msi"
          if (Test-Path $msiDir) {
            Get-ChildItem $msiDir -Recurse -File | ForEach-Object {
              Write-Host "Copying $($_.Name) to dist root"
              Copy-Item $_.FullName -Destination "_caller/dist/"
            }
            Write-Host "✅ Flattened MSI directory structure"
          }

      - name: Generate SLSA provenance for Windows artifacts
        working-directory: _workflows
        shell: bash
        env:
          CALLER_DIST: ../_caller/dist
        run: |
          set -euo pipefail

          PROVENANCE_COUNT=0

          # Find all downloadable archives (zip and msi files)
          # MSI files are flattened to dist root by previous step
          for artifact in "${CALLER_DIST}"/*.zip "${CALLER_DIST}"/*.msi; do
            [ -f "$artifact" ] || continue
            [[ "$artifact" == *checksums* ]] && continue

            BASENAME=$(basename "$artifact")
            echo "Generating provenance for: $BASENAME"
            cosign attest-blob \
              --yes \
              --predicate "_generated/predicate.json" \
              --type slsaprovenance1 \
              --bundle "${CALLER_DIST}/${BASENAME}.provenance.sigstore.json" \
              "$artifact" > /dev/null
            echo "✅ Created ${BASENAME}.provenance.sigstore.json"
            ((PROVENANCE_COUNT++)) || true
          done

          echo "Generated provenance bundles: ${PROVENANCE_COUNT}"
          if [ "$PROVENANCE_COUNT" -eq 0 ]; then
            echo "::error::No provenance bundles were generated - this indicates a build problem"
            exit 1
          fi
          ls "${CALLER_DIST}"/*.provenance.sigstore.json

      - name: Sign SBOMs as attestation bundles
        working-directory: _workflows
        shell: bash
        env:
          CALLER_DIST: ../_caller/dist
        run: |
          set -euo pipefail

          SIGNED_COUNT=0

          # Require every Windows release artifact to have an SPDX SBOM.
          # MSI files are flattened to dist root by the previous step.
          for artifact in "${CALLER_DIST}"/*.zip "${CALLER_DIST}"/*.msi; do
            [ -f "$artifact" ] || continue
            [[ "$artifact" == *checksums* ]] && continue

            SBOM="${artifact}.sbom.json"
            if [ ! -f "$SBOM" ]; then
              echo "::error::Missing SBOM for artifact: $(basename "$artifact") (expected: $SBOM)"
              exit 1
            fi

            echo "Signing SBOM for: $(basename "$artifact")"
            cosign attest-blob \
              --yes \
              --predicate "$SBOM" \
              --type https://spdx.dev/Document \
              --bundle "${artifact}.sbom.sigstore.json" \
              "$artifact" > /dev/null
            echo "✅ Created $(basename "$artifact").sbom.sigstore.json"
            ((SIGNED_COUNT++)) || true
          done

          echo "Generated SBOM bundles: ${SIGNED_COUNT}"
          if [ "$SIGNED_COUNT" -eq 0 ]; then
            echo "::error::No Windows SBOM bundles were generated - this indicates a build problem"
            exit 1
          fi
          ls "${CALLER_DIST}"/*.sbom.sigstore.json

      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
          aws-region: us-west-2

      - name: Calculate S3 directory
        id: s3-directory
        shell: bash
        run: |
          ORG="${{ github.event.repository.owner.login }}"
          REPO="${{ github.event.repository.name }}"
          STORAGE_NAME="${{ inputs.release_storage_name }}"
          TAG="${{ inputs.tag }}"
          if [ -z "$STORAGE_NAME" ]; then
            STORAGE_NAME="$REPO"
          fi
          echo "S3_DIRECTORY=releases/$ORG/$STORAGE_NAME/$TAG" >> "$GITHUB_OUTPUT"

      - name: Upload Windows artifacts to S3
        working-directory: _workflows
        shell: pwsh
        env:
          S3_BUCKET: ${{ env.S3_BUCKET }}
          S3_DIRECTORY: ${{ steps.s3-directory.outputs.S3_DIRECTORY }}
        run: |
          ./scripts/upload-release-artifacts.ps1 `
            -Bucket $env:S3_BUCKET `
            -Directory $env:S3_DIRECTORY `
            -BaseDir "../_caller/dist" `
            -IncludeSbomDocuments

      - name: Set up Go for workflows tools
        uses: actions/setup-go@v6
        with:
          go-version-file: "_workflows/go.mod"
          cache: false

      - name: Generate Windows manifest
        id: generate-windows-manifest
        working-directory: _workflows
        shell: bash
        env:
          CDN_BASE_URL: ${{ env.CDN_BASE_URL }}
          S3_DIRECTORY: ${{ steps.s3-directory.outputs.S3_DIRECTORY }}
        run: |
          # Use Go tool for type-safe manifest generation
          MANIFEST=$(go run ./cmd/generate-windows-manifest \
            -dist-dir "../_caller/dist" \
            -cdn-base-url "$CDN_BASE_URL" \
            -s3-directory "$S3_DIRECTORY")

          echo "Windows manifest: $MANIFEST"
          {
            echo "windows_manifest<<MANIFEST_EOF"
            echo "$MANIFEST"
            echo "MANIFEST_EOF"
          } >> "$GITHUB_OUTPUT"

  goreleaser-docker:
    if: inputs.docker == true || inputs.lambda == true
    needs: determine-workflows-ref
    permissions:
      id-token: write
      contents: read
    outputs:
      images_manifest: ${{ steps.extract-images.outputs.images_manifest }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout caller repo
        uses: actions/checkout@v5
        with:
          path: _caller
          repository: ${{ github.event.repository.full_name }}
          ref: refs/tags/${{ inputs.tag }}
          fetch-depth: 0
          persist-credentials: false

      - name: Verify caller checkout matches release tag
        working-directory: _caller
        shell: bash
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          tag_commit="$(git rev-list -n 1 "refs/tags/$RELEASE_TAG")"
          head_commit="$(git rev-parse HEAD)"
          if [ "$head_commit" != "$tag_commit" ]; then
            echo "::error::Checked out $head_commit but refs/tags/$RELEASE_TAG resolves to $tag_commit"
            exit 1
          fi
          echo "Verified $RELEASE_TAG at $head_commit"

      - name: Checkout connector workflows
        if: inputs.docker == true || inputs.lambda == true
        uses: actions/checkout@v5
        with:
          path: _workflows
          repository: ConductorOne/github-workflows
          ref: ${{ needs.determine-workflows-ref.outputs.ref }}
          persist-credentials: false

      - name: Derive AWS role names
        id: role-names
        if: inputs.docker == true || inputs.lambda == true
        working-directory: _workflows
        shell: bash
        env:
          REPO_OWNER: ${{ github.event.repository.owner.login }}
          REPO_NAME: ${{ github.event.repository.name }}
        run: |
          bash ./scripts/derive-iam-role-name.sh \
            --prefix GHA-Artifacts- \
            --suffix "${REPO_OWNER}-${REPO_NAME}" \
            --output-name gha_artifacts_role_name >> "$GITHUB_OUTPUT"
          bash ./scripts/derive-iam-role-name.sh \
            --prefix GitHubActionsECRPushRole- \
            --suffix "${REPO_NAME}" \
            --output-name ecr_push_role_name >> "$GITHUB_OUTPUT"

      - name: Set up Go for caller
        if: inputs.docker == true || inputs.lambda == true
        uses: actions/setup-go@v6
        with:
          go-version-file: "_caller/go.mod"
          cache: false

      - name: Install cosign
        if: inputs.docker == true
        uses: sigstore/cosign-installer@v3

      - name: Generate configs for Docker OCI
        if: inputs.docker == true
        working-directory: _workflows
        env:
          REPO_NAME: ${{ github.event.repository.name }}
          DOCKERFILE_PATH: ../_workflows/_generated/Dockerfile
          DIST_DIR: dist/oci
          PUBLIC_ECR_PUBLISH_TAG: release-candidate-${{ github.run_id }}-${{ github.run_attempt }}
          # For provenance predicate template
          WORKFLOWS_REF: ${{ needs.determine-workflows-ref.outputs.ref }}
          RELEASE_TAG: ${{ inputs.tag }}
          # Custom Dockerfile template from caller repo (if provided)
          CUSTOM_DOCKERFILE_TEMPLATE: ${{ inputs.dockerfile_template }}
          # Extra files to include in Docker build context (comma-separated)
          DOCKER_EXTRA_FILES: ${{ inputs.docker_extra_files }}
        run: |
          mkdir -p "${GENERATED_DIR}"
          export BUILD_STARTED_ON=$(date -u +"%Y-%m-%dT%H:%M:%SZ")

          # Generate Dockerfile from custom template or default
          if [ -n "${CUSTOM_DOCKERFILE_TEMPLATE}" ]; then
            CUSTOM_PATH="../_caller/${CUSTOM_DOCKERFILE_TEMPLATE}"
            if [ ! -f "${CUSTOM_PATH}" ]; then
              echo "::error::Custom Dockerfile template not found: ${CUSTOM_DOCKERFILE_TEMPLATE}"
              exit 1
            fi
            echo "Using custom Dockerfile template: ${CUSTOM_DOCKERFILE_TEMPLATE}"
            envsubst '$REPO_NAME' < "${CUSTOM_PATH}" | tee "${GENERATED_DIR}/Dockerfile"
          else
            echo "Using default Dockerfile template"
            envsubst '$REPO_NAME' < templates/.Dockerfile-template.tmpl | tee "${GENERATED_DIR}/Dockerfile"
          fi

          # Build EXTRA_FILES_BLOCK for goreleaser template substitution
          # This will be empty string if no extra files, or the YAML block if specified
          export EXTRA_FILES_BLOCK=""
          if [ -n "${DOCKER_EXTRA_FILES}" ]; then
            echo "Adding extra files to Docker build context: ${DOCKER_EXTRA_FILES}"
            
            # Validate files exist and build the YAML block
            EXTRA_FILES_BLOCK="    extra_files:"$'\n'
            IFS=',' read -ra FILES <<< "${DOCKER_EXTRA_FILES}"
            for file in "${FILES[@]}"; do
              file=$(echo "$file" | xargs)  # trim whitespace
              if [ ! -e "../_caller/${file}" ]; then
                echo "::error::Extra file/directory not found: ${file}"
                exit 1
              fi
              EXTRA_FILES_BLOCK="${EXTRA_FILES_BLOCK}      - ${file}"$'\n'
            done
            export EXTRA_FILES_BLOCK
          fi

          # Generate goreleaser config with all substitutions
          envsubst < templates/.goreleaser-docker-oci-template.yaml.tmpl | tee "${GENERATED_DIR}/.goreleaser.docker.yaml"

          envsubst < templates/.slsa-provenance-predicate-template.json.tmpl | tee "${GENERATED_DIR}/predicate.json"

      - name: Generate configs for Lambda
        if: inputs.lambda == true
        working-directory: _workflows
        env:
          REPO_NAME: ${{ github.event.repository.name }}
          DOCKERFILE_LAMBDA_PATH: ../_workflows/_generated/Dockerfile.lambda
          DIST_DIR: dist/lambda
        run: |
          mkdir -p "${GENERATED_DIR}"
          envsubst '$REPO_NAME' < templates/.Dockerfile-lambda-template.tmpl | tee "${GENERATED_DIR}/Dockerfile.lambda"
          envsubst < templates/.goreleaser-docker-lambda-template.yaml.tmpl | tee "${GENERATED_DIR}/.goreleaser.lambda.yaml"

      - name: Set up QEMU
        if: inputs.docker == true || inputs.lambda == true
        uses: docker/setup-qemu-action@v3
        with:
          platforms: linux/arm64

      - name: Set up Docker Buildx
        if: inputs.docker == true || inputs.lambda == true
        uses: docker/setup-buildx-action@v3

      - name: Configure Public ECR AWS credentials via OIDC
        if: inputs.docker == true
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
          aws-region: us-east-1

      - name: Login to Public ECR
        if: inputs.docker == true
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public

      - name: Run GoReleaser for Docker OCI
        if: inputs.docker == true
        uses: goreleaser/goreleaser-action@v6
        with:
          workdir: _caller
          version: "~> v2.13"
          args: release --clean --config ../_workflows/_generated/.goreleaser.docker.yaml
        env:
          GITHUB_TOKEN: ${{ secrets.RELENG_GITHUB_TOKEN }}
          COSIGN_EXPERIMENTAL: "1"

      - name: Set up Go for Public ECR helper
        if: inputs.docker == true
        uses: actions/setup-go@v6
        with:
          go-version-file: "_workflows/go.mod"
          cache: false

      - name: Preflight and publish Public ECR release tags
        if: inputs.docker == true
        working-directory: _workflows
        shell: bash
        env:
          REPO_NAME: ${{ github.event.repository.name }}
          RELEASE_TAG: ${{ inputs.tag }}
          CANDIDATE_TAG: release-candidate-${{ github.run_id }}-${{ github.run_attempt }}
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"
          go run ./cmd/publish-public-ecr-release-tags \
            -repository-name "$REPO_NAME" \
            -version-tag "$VERSION" \
            -candidate-tag "$CANDIDATE_TAG" \
            -digest-file "../_caller/dist/oci/${REPO_NAME}_${VERSION}_digests.txt"

      - name: Configure Lambda ECR AWS credentials via OIDC
        if: inputs.lambda == true
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: "arn:aws:iam::168442440833:role/${{ steps.role-names.outputs.ecr_push_role_name }}"
          aws-region: us-west-2

      - name: Login to Lambda ECR
        if: inputs.lambda == true
        uses: aws-actions/amazon-ecr-login@v2

      - name: Set up Go for caller Lambda release
        if: inputs.docker == true && inputs.lambda == true
        uses: actions/setup-go@v6
        with:
          go-version-file: "_caller/go.mod"
          cache: false

      - name: Run GoReleaser for Lambda
        if: inputs.lambda == true
        uses: goreleaser/goreleaser-action@v6
        with:
          workdir: _caller
          version: "~> v2.13"
          args: release --clean --config ../_workflows/_generated/.goreleaser.lambda.yaml
        env:
          GITHUB_TOKEN: ${{ secrets.RELENG_GITHUB_TOKEN }}

      - name: Set up Go for workflows
        if: inputs.docker == true || inputs.lambda == true
        uses: actions/setup-go@v6
        with:
          go-version-file: "_workflows/go.mod"
          cache: false

      - name: Extract image digests from GoReleaser assets
        id: extract-images
        if: inputs.docker == true || inputs.lambda == true
        working-directory: _workflows
        env:
          CALLER_DIST_OCI: ../_caller/dist/oci
          CALLER_DIST_LAMBDA: ../_caller/dist/lambda
        run: |
          IMAGES_JSON=$(go run ./cmd/extract-images \
            -include-public=${{ inputs.docker }} \
            -include-lambda=${{ inputs.lambda }} \
            -asset-dir "${CALLER_DIST_OCI}" \
            -lambda-asset-dir "${CALLER_DIST_LAMBDA}" \
            -repo-name "${{ github.event.repository.name }}" \
            -tag "${{ inputs.tag }}")

          # Debug output
          echo "$IMAGES_JSON"

          # Write to GITHUB_OUTPUT for job output
          {
            echo "images_manifest<<EOF"
            echo "$IMAGES_JSON"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Generate SLSA provenance for images
        if: inputs.docker == true
        working-directory: _workflows
        env:
          RELEASE_TAG: ${{ inputs.tag }}
          CALLER_DIST_OCI: ../_caller/dist/oci
        shell: bash
        run: |
          set -euo pipefail

          VERSION="${RELEASE_TAG#v}"  # Remove 'v' prefix

          # Read digests from the digest file
          DIGEST_FILE="${CALLER_DIST_OCI}/${{ github.event.repository.name }}_${VERSION}_digests.txt"
          if [ ! -f "$DIGEST_FILE" ]; then
            echo "::warning::Digest file not found: $DIGEST_FILE"
            exit 0
          fi

          # Attest each multi-arch index image (tagged with just version, not version-arch)
          while IFS= read -r line || [ -n "$line" ]; do
            [ -z "$line" ] && continue
            DIGEST=$(echo "$line" | awk '{print $1}')
            REF=$(echo "$line" | awk '{print $2}')

            # Only attest multi-arch index images (tagged with just version)
            if [[ "$REF" != *":${VERSION}" ]]; then
              continue
            fi

            # Build the digest-pinned reference
            if [[ "$DIGEST" != sha256:* ]]; then
              DIGEST="sha256:${DIGEST}"
            fi
            IMAGE_BASE="${REF%:*}"
            URI="${IMAGE_BASE}@${DIGEST}"

            echo "Attesting image: $URI"
            cosign attest \
              --yes \
              --type https://slsa.dev/provenance/v1 \
              --predicate "${GENERATED_DIR}/predicate.json" \
              "$URI"
            echo "✅ Attested $URI"
          done < "$DIGEST_FILE"

  publish-release-manifest:
    # Release manifest publication: manifest + checksums + S3 upload.
    # Require binaries to succeed; windows and docker may be skipped based on inputs.
    # Each optional job must succeed if it ran — a failure means incomplete release artifacts.
    # see: https://docs.github.com/en/actions/using-jobs/using-conditions-to-control-job-execution
    if: ${{ !cancelled() && needs.goreleaser-binaries.result == 'success' && (needs.goreleaser-windows.result == 'success' || needs.goreleaser-windows.result == 'skipped') && (needs.goreleaser-docker.result == 'success' || needs.goreleaser-docker.result == 'skipped') }}
    needs: [determine-workflows-ref, goreleaser-binaries, goreleaser-windows, goreleaser-docker]
    outputs:
      merged_manifest: ${{ steps.export-manifest.outputs.merged_manifest }}
      manifest_url: ${{ steps.upload-manifest.outputs.manifest_url }}
    permissions:
      id-token: write
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Checkout connector workflows
        uses: actions/checkout@v5
        with:
          path: _workflows
          repository: ConductorOne/github-workflows
          ref: ${{ needs.determine-workflows-ref.outputs.ref }}
          persist-credentials: false

      - name: Derive AWS role names
        id: role-names
        working-directory: _workflows
        shell: bash
        env:
          REPO_OWNER: ${{ github.event.repository.owner.login }}
          REPO_NAME: ${{ github.event.repository.name }}
        run: |
          bash ./scripts/derive-iam-role-name.sh \
            --prefix GHA-Artifacts- \
            --suffix "${REPO_OWNER}-${REPO_NAME}" \
            --output-name gha_artifacts_role_name >> "$GITHUB_OUTPUT"

      - name: Set up Go for workflows
        uses: actions/setup-go@v6
        with:
          go-version-file: "_workflows/go.mod"
          cache: false

      - name: Merge binaries, Windows, and images manifests
        working-directory: _workflows
        env:
          BINARIES_MANIFEST: ${{ needs.goreleaser-binaries.outputs.binaries_manifest }}
          WINDOWS_MANIFEST: ${{ needs.goreleaser-windows.outputs.windows_manifest }}
          IMAGES_MANIFEST: ${{ needs.goreleaser-docker.outputs.images_manifest }}
          OUTPUT_DIR: _output
        run: |
          mkdir -p "${OUTPUT_DIR}"
          go run ./cmd/merge-manifests \
            -binaries-manifest "$BINARIES_MANIFEST" \
            -windows-manifest "$WINDOWS_MANIFEST" \
            -images-manifest "$IMAGES_MANIFEST" \
            | tee "${OUTPUT_DIR}/manifest.json"

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
          aws-region: us-west-2

      - name: Create unified checksums file
        working-directory: _workflows/_output
        env:
          BINARIES_CHECKSUMS: ${{ needs.goreleaser-binaries.outputs.binaries_checksums }}
          WINDOWS_MANIFEST: ${{ needs.goreleaser-windows.outputs.windows_manifest }}
          REPO_NAME: ${{ github.event.repository.name }}
          VERSION: ${{ inputs.tag }}
        shell: bash
        run: |
          set -euo pipefail

          # Determine checksums filename (matches GoReleaser default pattern)
          VERSION_NO_V="${VERSION#v}"
          CHECKSUMS_FILE="${REPO_NAME}_${VERSION_NO_V}_checksums.txt"

          # Start with binaries checksums
          echo "Creating unified checksums file: $CHECKSUMS_FILE"
          echo "$BINARIES_CHECKSUMS" > "./${CHECKSUMS_FILE}"

          # Append Windows asset hashes from manifest
          # Format: <sha256>  <filename>
          if [ -n "$WINDOWS_MANIFEST" ] && [ "$WINDOWS_MANIFEST" != "{}" ]; then
            echo "Appending Windows hashes..."
            echo "$WINDOWS_MANIFEST" | jq -r 'to_entries[] | "\(.value.sha256)  \(.value.filename)"' >> "./${CHECKSUMS_FILE}"
          fi

          echo "Unified checksums file:"
          cat "./${CHECKSUMS_FILE}"

          # Sign the checksums file
          echo "Signing checksums file..."
          cosign sign-blob --yes "./${CHECKSUMS_FILE}" \
            --output-signature "./${CHECKSUMS_FILE}.sig" \
            --output-certificate "./${CHECKSUMS_FILE}.cert"

          # Generate provenance predicate
          PREDICATE_FILE="checksums-predicate.json"
          cat > "$PREDICATE_FILE" << EOF
          {
            "buildDefinition": {
              "buildType": "https://github.com/ConductorOne/github-workflows/.github/workflows/release.yaml",
              "externalParameters": {
                "repository": "${{ github.repository }}",
                "tag": "${VERSION}"
              }
            },
            "runDetails": {
              "builder": {
                "id": "https://github.com/ConductorOne/github-workflows/.github/workflows/release.yaml@${{ needs.determine-workflows-ref.outputs.ref }}"
              },
              "metadata": {
                "invocationId": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
              }
            }
          }
          EOF

          # Generate provenance for checksums
          cosign attest-blob \
            --yes \
            --predicate "$PREDICATE_FILE" \
            --type slsaprovenance1 \
            --bundle "./${CHECKSUMS_FILE}.provenance.sigstore.json" \
            "./${CHECKSUMS_FILE}" > /dev/null
          echo "✅ Checksums signed with provenance"

      - name: Update manifest checksums hash
        working-directory: _workflows/_output
        env:
          REPO_NAME: ${{ github.event.repository.name }}
          VERSION: ${{ inputs.tag }}
        shell: bash
        run: |
          set -euo pipefail

          # The unified checksums file may differ from the binaries-only version
          # (when Windows hashes were appended). Update the manifest to match.
          VERSION_NO_V="${VERSION#v}"
          CHECKSUMS_FILE="${REPO_NAME}_${VERSION_NO_V}_checksums.txt"

          NEW_SHA=$(sha256sum "./${CHECKSUMS_FILE}" | awk '{print $1}')
          NEW_SIZE=$(wc -c < "./${CHECKSUMS_FILE}" | tr -d ' ')

          echo "Updating manifest checksums hash: ${NEW_SHA} (${NEW_SIZE} bytes)"
          jq --arg sha "$NEW_SHA" --argjson size "$NEW_SIZE" \
            'if .assets.checksums then .assets.checksums.sha256 = $sha | .assets.checksums.sizeBytes = $size else . end' \
            manifest.json > manifest.tmp && mv manifest.tmp manifest.json

      - name: Sign final manifest.json
        working-directory: _workflows/_output
        env: { COSIGN_EXPERIMENTAL: "1" }
        shell: bash
        run: |
          set -euo pipefail
          cosign sign-blob --yes "manifest.json" \
            --output-signature "manifest.json.sig" \
            --output-certificate "manifest.json.cert" \
            --bundle "manifest.json.sigstore.json"

      - name: Export final manifest for registry API
        id: export-manifest
        working-directory: _workflows/_output
        run: |
          # Output the final merged+signed manifest as a job output
          # so record-registry-api can use the exact same manifest.
          echo "merged_manifest=$(cat manifest.json | jq -c .)" >> "$GITHUB_OUTPUT"

      - name: Upload checksums to S3
        working-directory: _workflows/_output
        env:
          BUCKET: ${{ env.S3_BUCKET }}
          DIRECTORY: ${{ needs.goreleaser-binaries.outputs.s3_directory }}
          REPO_NAME: ${{ github.event.repository.name }}
          VERSION: ${{ inputs.tag }}
        shell: bash
        run: |
          set -euo pipefail

          VERSION_NO_V="${VERSION#v}"
          CHECKSUMS_FILE="${REPO_NAME}_${VERSION_NO_V}_checksums.txt"

          upload_checksum_file() {
            local file="$1"
            local content_type="$2"
            ../scripts/s3-put-object-if-none-match.sh \
              --bucket "$BUCKET" \
              --key "${DIRECTORY}/${file}" \
              --body "./${file}" \
              --content-type "$content_type"
          }

          upload_checksum_file "${CHECKSUMS_FILE}" "text/plain"
          upload_checksum_file "${CHECKSUMS_FILE}.sig" "application/octet-stream"
          upload_checksum_file "${CHECKSUMS_FILE}.cert" "application/x-pem-file"
          upload_checksum_file "${CHECKSUMS_FILE}.provenance.sigstore.json" "application/json"
          echo "✅ Checksums file and signatures uploaded"

      - name: Upload manifest.json to S3
        id: upload-manifest
        working-directory: _workflows/_output
        shell: bash
        run: |
          set -euo pipefail
          BUCKET="${{ env.S3_BUCKET }}"
          DIRECTORY="${{ needs.goreleaser-binaries.outputs.s3_directory }}"
          CDN_BASE="${{ env.CDN_BASE_URL }}"

          # manifest.json is required
          if [ ! -f "manifest.json" ]; then
            echo "::error::manifest.json not found in $(pwd)"
            exit 1
          fi
          ../scripts/s3-put-object-if-none-match.sh \
            --bucket "$BUCKET" \
            --key "$DIRECTORY/manifest.json" \
            --body "manifest.json" \
            --content-type "application/json"
          MANIFEST_URL="$CDN_BASE/$DIRECTORY/manifest.json"
          echo "manifest_url=$MANIFEST_URL" >> "$GITHUB_OUTPUT"
          echo "✅ Manifest uploaded successfully: $MANIFEST_URL"

          for required_file in manifest.json.sig manifest.json.cert manifest.json.sigstore.json; do
            if [ ! -f "$required_file" ]; then
              echo "::error::$required_file not found in $(pwd)"
              exit 1
            fi
          done
          ../scripts/s3-put-object-if-none-match.sh \
            --bucket "$BUCKET" \
            --key "$DIRECTORY/manifest.json.sig" \
            --body "manifest.json.sig" \
            --content-type "application/octet-stream"
          ../scripts/s3-put-object-if-none-match.sh \
            --bucket "$BUCKET" \
            --key "$DIRECTORY/manifest.json.cert" \
            --body "manifest.json.cert" \
            --content-type "application/octet-stream"
          ../scripts/s3-put-object-if-none-match.sh \
            --bucket "$BUCKET" \
            --key "$DIRECTORY/manifest.json.sigstore.json" \
            --body "manifest.json.sigstore.json" \
            --content-type "application/json"

  # ================================================================
  # Registry API: record release after release manifest publication.
  # This is the sole release metadata recording path.
  # ================================================================
  record-registry-api:
    # Use !cancelled() so the explicit needs.result check controls skipped-job behavior.
    if: ${{ !cancelled() && needs.goreleaser-binaries.result == 'success' && needs.publish-release-manifest.result == 'success' && needs.verify-release.result == 'success' }}
    needs: [determine-workflows-ref, goreleaser-binaries, publish-release-manifest, verify-release]
    permissions:
      id-token: write
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Checkout connector workflows
        uses: actions/checkout@v5
        with:
          path: _workflows
          repository: ConductorOne/github-workflows
          ref: ${{ needs.determine-workflows-ref.outputs.ref }}
          persist-credentials: false

      - name: Set up Go for workflows
        uses: actions/setup-go@v6
        with:
          go-version-file: "_workflows/go.mod"
          cache: false

      - name: Checkout connector repo
        uses: actions/checkout@v5
        with:
          path: _connector
          repository: ${{ github.event.repository.full_name }}
          ref: refs/tags/${{ inputs.tag }}
          fetch-depth: 0
          persist-credentials: false

      - name: Verify connector checkout matches release tag
        id: verify-connector-checkout
        working-directory: _connector
        shell: bash
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          tag_commit="$(git rev-list -n 1 "refs/tags/$RELEASE_TAG")"
          head_commit="$(git rev-parse HEAD)"
          if [ "$head_commit" != "$tag_commit" ]; then
            echo "::error::Checked out $head_commit but refs/tags/$RELEASE_TAG resolves to $tag_commit"
            exit 1
          fi
          echo "commit_sha=$head_commit" >> "$GITHUB_OUTPUT"
          echo "Verified $RELEASE_TAG at $head_commit"

      - name: Read connector documentation
        id: read-docs
        run: |
          if [ -f "_connector/docs/connector.mdx" ]; then
            echo "Found docs/connector.mdx"
            echo "has_docs=true" >> "$GITHUB_OUTPUT"
          else
            echo "No docs/connector.mdx found"
            echo "has_docs=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Get GitHub OIDC token for registry API
        id: registry-oidc
        uses: actions/github-script@v7
        with:
          script: |
            const token = await core.getIDToken('connector-registry')
            core.setSecret(token)
            core.setOutput('token', token)

      - name: Fetch release metadata
        id: release-meta
        working-directory: _workflows
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          mkdir -p "$GITHUB_WORKSPACE/_release_metadata"
          RELEASE_JSON="$GITHUB_WORKSPACE/_release_metadata/github-release.json"
          CHANGELOG_FILE="$GITHUB_WORKSPACE/_release_metadata/changelog.md"
          WORKFLOW_TIME="${{ needs.goreleaser-binaries.outputs.released_at }}"
          if [ -z "$WORKFLOW_TIME" ]; then
            WORKFLOW_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          fi

          if ! gh api "repos/${{ github.repository }}/releases/tags/${{ inputs.tag }}" > "$RELEASE_JSON" 2>/dev/null; then
            echo '{}' > "$RELEASE_JSON"
          fi

          go run ./cmd/release-metadata \
            -repo-dir ../_connector \
            -tag "${{ inputs.tag }}" \
            -workflow-time "$WORKFLOW_TIME" \
            -github-release-json "$RELEASE_JSON" \
            -changelog-file "$CHANGELOG_FILE" \
            >> "$GITHUB_OUTPUT"
          # Keep the registry timestamp aligned with the signed manifest.
          echo "released_at=$WORKFLOW_TIME" >> "$GITHUB_OUTPUT"
          echo "released_at_source=binaries-manifest" >> "$GITHUB_OUTPUT"

      - name: Write merged manifest from manifest publication job
        working-directory: _workflows
        env:
          MERGED_MANIFEST: ${{ needs.publish-release-manifest.outputs.merged_manifest }}
        run: |
          mkdir -p _output
          echo "$MERGED_MANIFEST" | jq . > _output/manifest.json

      - name: Record release via registry API
        if: steps.registry-oidc.outcome == 'success'
        working-directory: _workflows
        env:
          REGISTRY_API_TOKEN: ${{ steps.registry-oidc.outputs.token }}
          RELEASED_AT: ${{ needs.goreleaser-binaries.outputs.released_at }}
        run: |
          DOCS_FLAG=""
          if [ "${{ steps.read-docs.outputs.has_docs }}" = "true" ]; then
            DOCS_FLAG="-docs ../_connector/docs/connector.mdx"
          fi

          CHANGELOG_FLAG=""
          if [ -s "${{ steps.release-meta.outputs.changelog_file }}" ]; then
            CHANGELOG_FLAG="-changelog ${{ steps.release-meta.outputs.changelog_file }}"
          fi

          CONFIG_SCHEMA_FLAG=""
          if [ -f "../_connector/config_schema.json" ]; then
            CONFIG_SCHEMA_FLAG="-config-schema ../_connector/config_schema.json"
          fi

          CAPABILITIES_FLAG=""
          if [ -f "../_connector/baton_capabilities.json" ]; then
            CAPABILITIES_FLAG="-capabilities ../_connector/baton_capabilities.json"
          fi

          RELEASED_AT_FLAG=""
          if [ -n "$RELEASED_AT" ]; then
            RELEASED_AT_FLAG="-released-at $RELEASED_AT"
          fi

          go run ./cmd/record-release \
            -manifest _output/manifest.json \
            -manifest-url "${{ needs.publish-release-manifest.outputs.manifest_url }}" \
            -org "${{ github.event.repository.owner.login }}" \
            -name "${{ github.event.repository.name }}" \
            -version "${{ inputs.tag }}" \
            -repository-url "https://github.com/${{ github.repository }}" \
            -commit-sha "${{ steps.verify-connector-checkout.outputs.commit_sha }}" \
            -workflow-run-id "${{ github.run_id }}" \
            -registry-url "https://dist.conductorone.com" \
            $DOCS_FLAG \
            $CHANGELOG_FLAG \
            $CONFIG_SCHEMA_FLAG \
            $CAPABILITIES_FLAG \
            $RELEASED_AT_FLAG

  verify-release:
    # Verify release artifacts and attestations before recording the release.
    # Registry-side verification is the trust boundary; this job prevents
    # obviously bad artifacts from being submitted.
    needs: [determine-workflows-ref, publish-release-manifest]
    if: always() && needs.publish-release-manifest.result == 'success'
    permissions:
      id-token: write # Required for cosign verification
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Checkout shared workflows
        uses: actions/checkout@v5
        with:
          repository: ConductorOne/github-workflows
          ref: ${{ needs.determine-workflows-ref.outputs.ref }}
          path: _workflows
          persist-credentials: false

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Validate release artifacts
        working-directory: _workflows
        env:
          ORG_REPO: ${{ github.event.repository.owner.login }}/${{ github.event.repository.name }}
          VERSION: ${{ inputs.tag }}
          RELEASE_STORAGE_NAME: ${{ inputs.release_storage_name }}
        run: |
          ./scripts/validate-release-artifacts.sh "$ORG_REPO" "$VERSION" "$RELEASE_STORAGE_NAME"

  notify-release-failure:
    needs:
      [
        determine-workflows-ref,
        goreleaser-binaries,
        goreleaser-windows,
        goreleaser-docker,
        publish-release-manifest,
        record-registry-api,
        verify-release,
      ]
    if: failure()
    permissions:
      checks: read
      actions: read
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Collect failure annotations
        id: collect-ann
        continue-on-error: true # never block the Datadog notification
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          RUN_ID: ${{ github.run_id }}
        run: |
          set -euo pipefail

          # Get the latest attempt number for this workflow run
          run_json="$(gh api "repos/$REPO/actions/runs/$RUN_ID")"
          attempt="$(echo "$run_json" | jq -r '.run_attempt')"

          # List jobs for the *specific* attempt (prevents mixing earlier attempts)
          jobs_json="$(gh api "repos/$REPO/actions/runs/$RUN_ID/attempts/$attempt/jobs?per_page=100" --paginate)"

          # Filter to failed jobs in this attempt
          failed_jobs=$(echo "$jobs_json" | jq -r '.jobs[] | select(.conclusion=="failure") | @base64')

          out=""
          if [ -z "$failed_jobs" ]; then
            out="No failure annotations found for latest attempt (#${attempt})."
          else
            while IFS= read -r enc; do
              j() { echo "$enc" | base64 -d | jq -r "$1"; }
              name="$(j '.name')"
              check_run_url="$(j '.check_run_url')"

              # Resolve check run ID for this attempt and fetch its annotations
              check_id="$(gh api "$check_run_url" -H "Accept: application/vnd.github+json" | jq -r '.id')"

              anns="$(gh api "repos/$REPO/check-runs/$check_id/annotations?per_page=100" \
                      --paginate -H "Accept: application/vnd.github+json" | \
                      jq -r '.[] | select(.annotation_level=="failure") | .message' || true)"

              if [ -n "$anns" ]; then
                while IFS= read -r msg; do
                  oneline="$(printf "%s" "$msg" | tr '\n' ' ' | sed 's/  \+/ /g')"
                  out+="$name: $oneline"$'\n'
                done <<< "$anns"
              else
                out+="$name: (no failure-level annotations; step may have failed before annotating)"$'\n'
              fi
            done <<< "$failed_jobs"
          fi

          # Keep Datadog payload compact (~4k limit on text)
          out="$(printf "%s" "$out" | tail -c 3500)"

          {
            echo "annotations<<EOF"
            printf '%s\n' "$out"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Send Datadog event on failure
        uses: masci/datadog@v1
        with:
          api-key: ${{ secrets.DATADOG_API_KEY }}
          api-url: https://us3.datadoghq.com/
          events: |
            - title: "Baton Connector Release Failed"
              text: |
                %%%
                # `${{ github.event.repository.name }}`:`${{ inputs.tag }}` Release Failed
                ## Error
                [View Workflow Run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
                ```${{ steps.collect-ann.outputs.annotations }}```
                ## Details
                * **Repository:** `${{ github.event.repository.full_name }}`
                * **Release Tag:** `${{ inputs.tag }}`
                * **Workflow:** `baton-connector-release`
                * **Action Run ID:** `${{ github.run_id }}`
                %%%
              alert_type: "error"
              host: ${{ github.repository_owner }}
              tags:
                - "github_repository:${{ github.event.repository.full_name }}"
                - "github_release_tag:${{ inputs.tag }}"
                - "github_workflow:baton-connector-release"