release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"
      - "v*.*.*-*"

permissions:
  contents: write
  id-token: write

jobs:
  validate:
    name: Validate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Install & Test
        run: |
          pip install -e ".[dev]"
          python -m pytest tests/ -v --tb=short

  cross-compile:
    name: Cross-Compile (${{ matrix.arch }})
    runs-on: ubuntu-latest
    needs: validate
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: aarch64
            pkg: gcc-aarch64-linux-gnu
            cc: aarch64-linux-gnu-gcc
          - arch: arm
            pkg: gcc-arm-linux-gnueabihf
            cc: arm-linux-gnueabihf-gcc
          - arch: riscv64
            pkg: gcc-riscv64-linux-gnu
            cc: riscv64-linux-gnu-gcc
    steps:
      - uses: actions/checkout@v4
      - name: Install cross-compiler
        run: |
          sudo apt-get update
          sudo apt-get install -y cmake ninja-build ${{ matrix.pkg }}
      - name: Extract version
        id: version
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
      - name: Cross-compile core
        run: |
          cmake -B build -G Ninja \
            -DCMAKE_C_COMPILER=${{ matrix.cc }} \
            -DCMAKE_SYSTEM_NAME=Linux \
            -DEOS_BUILD_TESTS=OFF
          cmake --build build || true
          mkdir -p staging
          find build -name "*.a" -exec cp {} staging/ \; 2>/dev/null || true
          tar czf ebuild-${{ steps.version.outputs.version }}-${{ matrix.arch }}.tar.gz -C staging .
      - uses: actions/upload-artifact@v4
        with:
          name: ebuild-${{ matrix.arch }}
          path: "*.tar.gz"

  pypi:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    needs: validate
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Build & publish
        run: |
          pip install build twine
          python -m build
          twine check dist/*
      - name: Upload to PyPI
        if: startsWith(github.ref, 'refs/tags/v')
        continue-on-error: true
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
        run: twine upload dist/*

  release:
    name: Create Release
    runs-on: ubuntu-latest
    needs: [validate, cross-compile, pypi]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Extract version
        id: version
        run: |
          TAG=${GITHUB_REF#refs/tags/}
          echo "tag=$TAG" >> $GITHUB_OUTPUT
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Build dist
        run: |
          pip install build
          python -m build
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: ebuild-*
          merge-multiple: true
      - name: Generate checksums
        run: sha256sum *.tar.gz dist/*.whl dist/*.tar.gz > SHA256SUMS.txt 2>/dev/null || true
      - name: Generate SBOM (CycloneDX v1.5)
        run: |
          TIMESTAMP=$(date -u +%Y-%m-%dT%H:%M:%SZ)
          UUID=$(cat /proc/sys/kernel/random/uuid 2>/dev/null || echo "00000000-0000-0000-0000-$(date +%s)")
          cat > sbom.cdx.json << EOF
          {
            "bomFormat": "CycloneDX",
            "specVersion": "1.5",
            "serialNumber": "urn:uuid:${UUID}",
            "version": 1,
            "metadata": {
              "timestamp": "${TIMESTAMP}",
              "component": {
                "type": "application",
                "name": "ebuild",
                "version": "${{ steps.version.outputs.tag }}",
                "supplier": { "name": "embeddedos-org" },
                "licenses": [{ "license": { "id": "MIT" } }]
              }
            },
            "components": []
          }
          EOF
      - name: Install cosign
        uses: sigstore/cosign-installer@v3
      - name: Sign artifacts
        run: |
          for f in *.tar.gz dist/*.whl; do
            [ -f "$f" ] && cosign sign-blob --yes --bundle "${f}.sig.bundle" "$f" 2>/dev/null || true
          done
      - name: Check release does not already exist
        run: |
          if gh release view "${{ steps.version.outputs.tag }}" &>/dev/null; then
            echo "::error::Release already exists."
            exit 1
          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.version.outputs.tag }}
          name: "ebuild ${{ steps.version.outputs.tag }}"
          generate_release_notes: true
          body: |
            ### Release Integrity
            - `SHA256SUMS.txt` — checksums
            - `sbom.cdx.json` — CycloneDX SBOM (v1.5)
            - `*.sig.bundle` — Sigstore cosign signatures
          files: |
            *.tar.gz
            dist/*
            SHA256SUMS.txt
            sbom.cdx.json
          prerelease: ${{ contains(steps.version.outputs.tag, 'rc') || contains(steps.version.outputs.tag, 'beta') }}