Release.yml

name: CD

on:
  workflow_dispatch:
  push:
    tags:
      - "*"

env:
  BUILD_DIR: build-release
  BUILD_TYPE: Release
  RELEASE_TARBALL: Release.tar.gz
  RELEASE_ARTIFACT: C2LinuxImplant-Linux-Release

permissions:
  contents: read

jobs:
  build-package:
    name: Build Linux release
    runs-on: ubuntu-22.04

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.x"

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libsmbclient-dev

      - name: Install Conan
        run: |
          python -m pip install --upgrade pip
          python -m pip install "conan>=2,<3"
          conan profile detect --force

      - name: Cache Conan packages
        uses: actions/cache@v4
        with:
          path: ~/.conan2
          key: conan-${{ runner.os }}-${{ hashFiles('conanfile.txt') }}
          restore-keys: |
            conan-${{ runner.os }}-

      - name: Configure release
        run: |
          cmake \
            -S . \
            -B "$BUILD_DIR" \
            -DCMAKE_BUILD_TYPE="$BUILD_TYPE" \
            -DC2CORE_BUILD_TESTS=OFF \
            -DC2CORE_BUILD_FUNCTIONAL_TESTS=OFF \
            -DCMAKE_PROJECT_TOP_LEVEL_INCLUDES="$GITHUB_WORKSPACE/conan_provider.cmake"

      - name: Build
        run: cmake --build "$BUILD_DIR" --config "$BUILD_TYPE" --parallel "$(nproc)"

      - name: Validate release configuration
        run: |
          set -euo pipefail

          grep -qx "C2CORE_BUILD_TESTS:BOOL=OFF" "$BUILD_DIR/CMakeCache.txt"
          grep -qx "C2CORE_BUILD_FUNCTIONAL_TESTS:BOOL=OFF" "$BUILD_DIR/CMakeCache.txt"

      - name: Validate deliverables
        run: |
          set -euo pipefail

          expected_beacons=(
            BeaconDns
            BeaconGithub
            BeaconHttp
            BeaconSmb
            BeaconTcp
          )

          expected_modules=(
            libAssemblyExec.so
            libCat.so
            libChangeDirectory.so
            libChisel.so
            libCimExec.so
            libCoff.so
            libDcomExec.so
            libDotnetExec.so
            libDownload.so
            libEnumerateRdpSessions.so
            libEnumerateShares.so
            libEvasion.so
            libGetEnv.so
            libInject.so
            libIpConfig.so
            libKerberosUseTicket.so
            libKeyLogger.so
            libKillProcess.so
            libListDirectory.so
            libListProcesses.so
            libMakeToken.so
            libMiniDump.so
            libMkDir.so
            libNetstat.so
            libPowershell.so
            libPrintWorkingDirectory.so
            libPsExec.so
            libPwSh.so
            libRegistry.so
            libRemove.so
            libRev2self.so
            libRun.so
            libScreenShot.so
            libScript.so
            libShell.so
            libSpawnAs.so
            libSshExec.so
            libStealToken.so
            libTaskScheduler.so
            libTree.so
            libUpload.so
            libWhoami.so
            libWinRM.so
            libWmiExec.so
          )

          for file in "${expected_beacons[@]}"; do
            test -s "Release/Beacons/$file" || {
              echo "Missing or empty beacon deliverable: $file" >&2
              exit 1
            }
          done

          for file in "${expected_modules[@]}"; do
            test -s "Release/Modules/$file" || {
              echo "Missing or empty module deliverable: $file" >&2
              exit 1
            }
          done

      - name: Stage release archive
        run: |
          set -euo pipefail
          stage="artifacts/Release"

          rm -rf artifacts "$RELEASE_TARBALL"
          mkdir -p "$stage/LinuxBeacons" "$stage/LinuxModules"

          find Release/Beacons -maxdepth 1 -type f ! -name ".gitignore" -exec cp -t "$stage/LinuxBeacons" {} +
          find Release/Modules -maxdepth 1 -type f ! -name ".gitignore" -exec cp -t "$stage/LinuxModules" {} +

          tar -C artifacts -czf "$RELEASE_TARBALL" Release

      - name: Upload CI artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.RELEASE_ARTIFACT }}
          path: ${{ env.RELEASE_TARBALL }}
          if-no-files-found: error

  release:
    name: Publish GitHub release
    runs-on: ubuntu-22.04
    needs: build-package
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: write

    steps:
      - name: Download release archive
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.RELEASE_ARTIFACT }}

      - name: Upload release
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: ${{ env.RELEASE_TARBALL }}
          asset_name: ${{ env.RELEASE_TARBALL }}
          tag: ${{ github.ref }}
          overwrite: true
          body: "Linux beacons and modules"