cd.yml

---
name: CD

"on":
  push:
    tags:
      - "[0-9].[0-9].[0-9]+"

jobs:
  build:
    name: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    steps:
      - name: checkout project
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: check cargo cache
        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a
        id: rust-cache
        with:
          path: |
            ~/.cargo/
            ~/.rustup/
            target/
          key: ${{ runner.os }}-${{ hashFiles('rust-toolchain.toml') }}-${{ hashFiles('Cargo.toml') }}-${{ hashFiles('Cargo.lock') }}
      - name: add musl target
        run: |
          rustup target add x86_64-unknown-linux-musl
      - name: cargo release
        run: |
          cargo build --locked --release --target x86_64-unknown-linux-gnu --target x86_64-unknown-linux-musl
      - name: assemble artifacts
        run: .github/workflows/cd.sh assemble
      - name: generate subject
        id: hash
        run: |
          set -euo pipefail
          echo "hashes=$(cat rustracer-*.txt | base64 -w0)" >> "$GITHUB_OUTPUT"
      - name: upload artifacts
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
        with:
          name: rustracer-build
          path: |
            rustracer-*.tar.gz
            rustracer-*.txt
          if-no-files-found: error
          retention-days: 1
  release:
    name: release
    runs-on: ubuntu-latest
    permissions:
      actions: read
      id-token: write
      contents: write
    needs: build
    steps:
      - name: checkout project
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
        with:
          name: rustracer-build
      - name: install cosign
        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da
      - name: cosign artifacts
        run: .github/workflows/cd.sh cosign
      - name: generate changelog latest
        uses: orhun/git-cliff-action@e364f07989916ffb9f50d7ef6c0a8c48082c2792
        id: cliff
        with:
          config: cliff.toml
          args: -vv --latest --strip header
      - name: get tag
        shell: bash
        run: |
          echo "TAG=${GITHUB_REF:10}" >> "$GITHUB_ENV"
      - name: release artifacts
        uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974
        with:
          name: rustracer ${{ env.TAG }}
          body: ${{ steps.cliff.outputs.content }}
          generate_release_notes: true
          fail_on_unmatched_files: true
          files: |
            rustracer-*.tar.gz
            rustracer-*.txt
            rustracer-*.pem
            rustracer-*.sig
  provenance:
    needs:
      - build
      - release
    permissions:
      actions: read
      id-token: write
      contents: write
    # slsa-framework/slsa-github-generator doesn't support pinning version
    # > Invalid ref: 07e64b653f10a80b6510f4568f685f8b7b9ea830. Expected ref of the form refs/tags/vX.Y.Z
    # https://github.com/slsa-framework/slsa-github-generator/issues/722
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      base64-subjects: "${{ needs.build.outputs.hashes }}"
      upload-assets: true
  cratesio:
    name: cratesio
    runs-on: ubuntu-latest
    permissions:
      contents: read
    needs:
      - release
    environment:
      name: cratesio
      url: https://crates.io/crates/rustracer
    steps:
      - name: checkout project
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: check cache
        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a
        id: cache
        with:
          path: |
            ~/.cargo/
            ~/.rustup/
            target/
          key: ${{ runner.os }}-${{ hashFiles('rust-toolchain.toml') }}-${{ hashFiles('Cargo.toml') }}-${{ hashFiles('Cargo.lock') }}
      - name: cargo publish
        run: |
          cargo publish --locked
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
  ghpages:
    name: ghpages
    runs-on: ubuntu-latest
    permissions:
      contents: write
    needs:
      - cratesio
    steps:
      - name: checkout project
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: check cache
        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a
        id: cache
        with:
          path: |
            ~/.cargo/
            ~/.rustup/
            target/
          key: ${{ runner.os }}-${{ hashFiles('rust-toolchain.toml') }}-${{ hashFiles('Cargo.toml') }}-${{ hashFiles('Cargo.lock') }}
      - name: patch and cargo rustdoc
        run: make rust_docs
      - name: publish to gh-pages
        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: target/doc/
  changelog:
    name: changelog
    needs:
      - ghpages
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: checkout project
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0
      - name: get tag
        shell: bash
        run: |
          echo "TAG=${GITHUB_REF:10}" >> "$GITHUB_ENV"
      - name: Refresh changelog
        uses: orhun/git-cliff-action@e364f07989916ffb9f50d7ef6c0a8c48082c2792
        with:
          config: cliff.toml
          args: --verbose --tag ${{ env.TAG }}
        env:
          OUTPUT: CHANGELOG.md
      - name: commit changelog
        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5
        with:
          message: "chore(CHANGELOG): add rustracer ${{ env.TAG }} changes"
          add: 'CHANGELOG.md'
          new_branch: master