mpak-release.yml

name: mpak Release

on:
  workflow_dispatch:
    inputs:
      source_ref:
        description: Git ref to build the mpak bundle from
        required: true
        default: main
      release_tag:
        description: Existing GitHub release tag to upload assets to
        required: true

permissions:
  contents: write
  id-token: write
  attestations: write
  artifact-metadata: write

jobs:
  publish:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          path: tooling

      - name: Check out source ref
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          ref: ${{ inputs.source_ref }}
          path: source

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version: "22"
          cache: "npm"
          cache-dependency-path: source/package-lock.json

      - name: Verify release exists
        working-directory: tooling
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: gh release view "${{ inputs.release_tag }}"

      - name: Install root dependencies
        working-directory: source
        run: npm ci --ignore-scripts

      - name: Audit root dependencies
        working-directory: source
        run: npm audit --audit-level=moderate

      - name: Build root distribution
        working-directory: source
        run: npm run build

      - name: Prepare isolated mpak package
        working-directory: tooling
        env:
          MPAK_SOURCE_DIR: ../source
        run: node scripts/prepare-mpak-package.mjs

      - name: Build universal mpak bundle
        id: build_bundle
        uses: NimbleBrainInc/mcpb-pack@bcc565454580b378121fef0f5086d2979f07ddbd
        with:
          directory: tooling/artifacts/mpak-package
          upload: false
          announce: false
          platform-os: any
          platform-arch: any

      - name: Finalize mpak bundle metadata
        working-directory: tooling
        run: >-
          node scripts/finalize-mpak-bundle.mjs
          "artifacts/mpak-package/${{ steps.build_bundle.outputs.bundle-path }}"
          "artifacts/mpak-package"

      - name: Install Cosign
        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22

      - name: Sign mpak bundle with Sigstore keyless
        id: sign_bundle
        working-directory: tooling/artifacts/mpak-package
        run: |
          set -euo pipefail

          BUNDLE_FILENAME="${{ steps.build_bundle.outputs.bundle-path }}"
          SIGNATURE_BUNDLE="${BUNDLE_FILENAME}.sigstore.json"

          cosign sign-blob \
            --yes \
            --bundle "$SIGNATURE_BUNDLE" \
            "$BUNDLE_FILENAME"

          echo "signature_bundle=$SIGNATURE_BUNDLE" >> "$GITHUB_OUTPUT"

      - name: Generate build provenance attestation
        id: attest_bundle
        uses: actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb
        with:
          subject-path: tooling/artifacts/mpak-package/${{ steps.build_bundle.outputs.bundle-path }}

      - name: Stage provenance bundle asset
        id: stage_attestation
        working-directory: tooling
        run: |
          set -euo pipefail

          ATTESTATION_ASSET="artifacts/mpak-package/${{ steps.build_bundle.outputs.bundle-path }}.provenance.sigstore.json"
          cp "${{ steps.attest_bundle.outputs.bundle-path }}" "$ATTESTATION_ASSET"

          echo "attestation_asset=$ATTESTATION_ASSET" >> "$GITHUB_OUTPUT"

      - name: Upload mpak assets to the tagged release
        working-directory: tooling
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          gh release upload "${{ inputs.release_tag }}" \
            "artifacts/mpak-package/${{ steps.build_bundle.outputs.bundle-path }}" \
            artifacts/mpak-package/server.json \
            "artifacts/mpak-package/${{ steps.sign_bundle.outputs.signature_bundle }}" \
            "${{ steps.stage_attestation.outputs.attestation_asset }}" \
            --clobber

      - name: Announce universal mpak bundle
        working-directory: tooling/artifacts/mpak-package
        env:
          GITHUB_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.release_tag }}
          BUNDLE_FILENAME: ${{ steps.build_bundle.outputs.bundle-path }}
        run: |
          set -euo pipefail

          if [ ! -f "$BUNDLE_FILENAME" ]; then
            echo "::error::Bundle not found: $BUNDLE_FILENAME"
            exit 1
          fi

          OIDC_TOKEN=$(curl -fsS \
            -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=https://mpak.dev" \
            | jq -r '.value')

          if [ "$OIDC_TOKEN" = "null" ] || [ -z "$OIDC_TOKEN" ]; then
            echo "::error::Failed to get OIDC token. Ensure permissions.id-token=write is set."
            exit 1
          fi

          NAME=$(jq -r '.name' manifest.json)
          VERSION=$(jq -r '.version' manifest.json)
          PRERELEASE=$(gh release view "$RELEASE_TAG" --json isPrerelease --jq '.isPrerelease')

          if stat -f%z "$BUNDLE_FILENAME" >/dev/null 2>&1; then
            SIZE=$(stat -f%z "$BUNDLE_FILENAME")
          else
            SIZE=$(stat -c%s "$BUNDLE_FILENAME")
          fi

          if command -v shasum >/dev/null 2>&1; then
            SHA256=$(shasum -a 256 "$BUNDLE_FILENAME" | awk '{print $1}')
          else
            SHA256=$(sha256sum "$BUNDLE_FILENAME" | awk '{print $1}')
          fi

          PAYLOAD=$(jq -n \
            --arg name "$NAME" \
            --arg version "$VERSION" \
            --slurpfile manifest manifest.json \
            --arg release_tag "$RELEASE_TAG" \
            --argjson prerelease "$PRERELEASE" \
            --arg filename "$BUNDLE_FILENAME" \
            --arg os "any" \
            --arg arch "any" \
            --arg sha256 "$SHA256" \
            --argjson size "$SIZE" \
            '{
              name: $name,
              version: $version,
              manifest: $manifest[0],
              release_tag: $release_tag,
              prerelease: $prerelease,
              artifact: {
                filename: $filename,
                os: $os,
                arch: $arch,
                sha256: $sha256,
                size: $size
              }
            }')

          echo "Announcing $NAME v$VERSION for release $RELEASE_TAG"

          MAX_ATTEMPTS=4
          ATTEMPT=1

          while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do
            RESPONSE=$(curl -sS -w "\n%{http_code}" \
              -X POST "https://registry.mpak.dev/v1/bundles/announce" \
              -H "Content-Type: application/json" \
              -H "Authorization: Bearer $OIDC_TOKEN" \
              -d "$PAYLOAD")

            HTTP_CODE=$(printf '%s\n' "$RESPONSE" | tail -n 1)
            BODY=$(printf '%s\n' "$RESPONSE" | sed '$d')

            if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
              echo "Bundle announced successfully"
              echo "$BODY" | jq .
              exit 0
            fi

            if [ "$HTTP_CODE" -eq 409 ]; then
              echo "Bundle already registered"
              echo "$BODY" | jq . 2>/dev/null || echo "$BODY"
              exit 0
            fi

            if printf '%s' "$BODY" | grep -Eq 'not found in release'; then
              if [ $ATTEMPT -lt $MAX_ATTEMPTS ]; then
                WAIT_SECONDS=$((ATTEMPT * 5))
                echo "Release assets not visible yet, retrying in ${WAIT_SECONDS}s..."
                sleep "$WAIT_SECONDS"
                ATTEMPT=$((ATTEMPT + 1))
                continue
              fi
            fi

            echo "::error::Failed to announce bundle (HTTP $HTTP_CODE)"
            echo "$BODY" | jq . 2>/dev/null || echo "$BODY"
            exit 1
          done