# Tag cli-v* to build platform binaries and publish a signed release with
# notes from cli/Changes, a combined SHA256SUMS and an SPDX SBOM.
name: CLI Release

on:
  push:
    tags:
      - "cli-v*"

permissions:
  contents: write

concurrency:
  group: cli-release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build:
    name: Build CLI
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        include:
          - goos: linux
            goarch: amd64
            ext: ""
          - goos: linux
            goarch: arm64
            ext: ""
          - goos: darwin
            goarch: amd64
            ext: ""
          - goos: darwin
            goarch: arm64
            ext: ""
          - goos: windows
            goarch: amd64
            ext: ".exe"
          - goos: freebsd
            goarch: amd64
            ext: ""
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: cli/go.mod
          cache-dependency-path: cli/go.sum
      - name: Build
        working-directory: cli
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          EXT: ${{ matrix.ext }}
          VERSION: ${{ github.ref_name }}
          CGO_ENABLED: "0"
        run: |
          mkdir -p dist
          VERSION_CLEAN=$(printf '%s' "$VERSION" | sed 's/^cli-v//')
          go build -trimpath -ldflags "-s -w -X github.com/VictorNagibator/pg_integrity_checksums/cli/internal/cli.Version=$VERSION_CLEAN" -o "dist/pg_integrity_checksums-$VERSION-$GOOS-$GOARCH$EXT" ./cmd/pg_integrity_checksums
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: cli-${{ matrix.goos }}-${{ matrix.goarch }}
          path: cli/dist/pg_integrity_checksums-*
          if-no-files-found: error

  publish:
    name: Sign and publish CLI
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs: build
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: dist
          merge-multiple: true
      - name: Build release notes
        env:
          VERSION: ${{ github.ref_name }}
        run: |
          VERSION_CLEAN=$(printf '%s' "$VERSION" | sed 's/^cli-v//')
          python3 .github/scripts/changelog_for_version.py "$VERSION_CLEAN" cli/Changes > release-notes.md
      - name: Generate combined checksums
        working-directory: dist
        run: sha256sum pg_integrity_checksums-* > SHA256SUMS
      - name: Generate SBOM
        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
        with:
          path: cli
          format: spdx-json
          output-file: dist/sbom.spdx.json
          upload-artifact: false
          upload-release-assets: false
      - name: Install cosign
        uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
      - name: Sign checksums
        working-directory: dist
        run: |
          cosign sign-blob --yes --bundle SHA256SUMS.bundle SHA256SUMS
      - name: Release
        uses: softprops/action-gh-release@8a0cd651e5b2365bd640854a3fa5dfc70e4875f3 # v3
        with:
          tag_name: ${{ github.ref_name }}
          name: pg_integrity_checksums CLI ${{ github.ref_name }}
          body_path: release-notes.md
          files: dist/*