release.yml

name: Release
on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      dry-run:
        description: "Dry run — build and verify without pushing images or publishing"
        type: boolean
        default: true
permissions:
  contents: read
  packages: write
  id-token: write
env:
  DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry-run == true }}
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo test --all
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-musl
            arch: amd64
          - target: aarch64-unknown-linux-musl
            arch: arm64
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - name: Install zig and cargo-zigbuild
        run: pip install ziglang && curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash && cargo binstall -y cargo-zigbuild
      - uses: mozilla-actions/sccache-action@v0.0.9
      - name: Cross-compile for ${{ matrix.arch }}
        run: cargo zigbuild --release --target ${{ matrix.target }}
        env:
          SCCACHE_GHA_ENABLED: "true"
          RUSTC_WRAPPER: sccache
      - uses: actions/upload-artifact@v7
        with:
          name: initium-${{ matrix.arch }}
          path: target/${{ matrix.target }}/release/initium
  docker:
    runs-on: ubuntu-latest
    needs: [test, build]
    steps:
      - uses: actions/checkout@v6
      - uses: actions/download-artifact@v8
        with:
          name: initium-amd64
          path: bin/
      - run: mv bin/initium bin/initium-amd64 && chmod +x bin/initium-amd64
      - uses: actions/download-artifact@v8
        with:
          name: initium-arm64
          path: bin/
      - run: mv bin/initium bin/initium-arm64 && chmod +x bin/initium-arm64
      - name: Verify binaries
        run: |
          file bin/initium-amd64 bin/initium-arm64
          echo "amd64 size: $(du -h bin/initium-amd64 | cut -f1)"
          echo "arm64 size: $(du -h bin/initium-arm64 | cut -f1)"
      - uses: sigstore/cosign-installer@v3
        if: env.DRY_RUN == 'false'
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        if: env.DRY_RUN == 'false'
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract version
        id: version
        run: |
          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
            echo "VERSION=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"
          else
            echo "VERSION=dry-run-$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
          fi
      - name: Build initium image
        uses: docker/build-push-action@v7
        id: build-main
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: ${{ env.DRY_RUN == 'false' }}
          tags: |
            ghcr.io/kitstream/initium:${{ steps.version.outputs.VERSION }}
            ghcr.io/kitstream/initium:latest
          sbom: true
          provenance: true
      - name: Sign initium image
        if: env.DRY_RUN == 'false'
        run: cosign sign --yes ghcr.io/kitstream/initium@${{ steps.build-main.outputs.digest }}
      - name: SBOM attestation for initium image
        if: env.DRY_RUN == 'false'
        run: |
          cosign attest --yes --type spdx \
            --predicate <(docker buildx imagetools inspect ghcr.io/kitstream/initium@${{ steps.build-main.outputs.digest }} --format '{{json (index .SBOM "linux/amd64").SPDX}}') \
            ghcr.io/kitstream/initium@${{ steps.build-main.outputs.digest }}
      - name: Build initium-jyq image
        uses: docker/build-push-action@v7
        id: build-jyq
        with:
          context: .
          file: Dockerfile.jyq
          platforms: linux/amd64,linux/arm64
          push: ${{ env.DRY_RUN == 'false' }}
          tags: |
            ghcr.io/kitstream/initium-jyq:${{ steps.version.outputs.VERSION }}
            ghcr.io/kitstream/initium-jyq:latest
          sbom: true
          provenance: true
      - name: Sign initium-jyq image
        if: env.DRY_RUN == 'false'
        run: cosign sign --yes ghcr.io/kitstream/initium-jyq@${{ steps.build-jyq.outputs.digest }}
      - name: SBOM attestation for initium-jyq image
        if: env.DRY_RUN == 'false'
        run: |
          cosign attest --yes --type spdx \
            --predicate <(docker buildx imagetools inspect ghcr.io/kitstream/initium-jyq@${{ steps.build-jyq.outputs.digest }} --format '{{json (index .SBOM "linux/amd64").SPDX}}') \
            ghcr.io/kitstream/initium-jyq@${{ steps.build-jyq.outputs.digest }}
  publish:
    runs-on: ubuntu-latest
    needs: [docker]
    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry-run == true) }}
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - name: Ensure Cargo.lock is up to date
        run: cargo update --workspace
      - name: Publish to crates.io
        run: |
          cargo publish --allow-dirty 2>&1 || {
            if cargo search initium --limit 1 | grep -q "$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')"; then
              echo "::warning::Version already published to crates.io — skipping"
            else
              echo "::error::cargo publish failed"
              exit 1
            fi
          }
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}