release-packaging.yaml

# SPDX-FileCopyrightText: 2026 yonasBSD
#
# SPDX-License-Identifier: MIT

name: Release Packaging

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  id-token: write   # required for cosign + SLSA provenance
  attestations: write

jobs:
  release:
    name: Linux Release
    runs-on: ubuntu-latest

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: block
          allowed-endpoints: >
            api.deps.dev:443
            api.github.com:443
            api.osv.dev:443
            api.scorecard.dev:443
            azure.archive.ubuntu.com:80
            changelogs.ubuntu.com:443
            esm.ubuntu.com:443
            fulcio.sigstore.dev:443
            get.anchore.io:443
            github.com:443
            gobinaries.com:443
            index.crates.io:443
            objects.githubusercontent.com:443
            oss-fuzz-build-logs.storage.googleapis.com:443
            packages.microsoft.com:443
            raw.githubusercontent.com:443
            rekor.sigstore.dev:443
            release-assets.githubusercontent.com:443
            security.ubuntu.com:80
            static.crates.io:443
            static.rust-lang.org:443
            tuf-repo-cdn.sigstore.dev:443
            uploads.github.com:443
            www.bestpractices.dev:443
            _http._tcp.azure.archive.ubuntu.com:443
            _https._tcp.esm.ubuntu.com:443
            _https._tcp.motd.ubuntu.com:443
            _https._tcp.packages.microsoft.com:443

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      # Setup Environment & Tools
      - name: Install Toolchain & Utilities
        run: |
          sudo apt-get update && sudo apt-get install -y b3sum jq
          curl -sfL https://gobinaries.com/goreleaser/nfpm | sh

      - name: Install Sigstore Tools
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Install Syft
        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0

      - name: Set Project Metadata
        run: |
          # Extract crate name dynamically to handle any repo name
          CRATE_NAME=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].name')
          echo "PROJECT_BIN=$CRATE_NAME" >> $GITHUB_ENV
          echo "PROJECT_NAME_UNDERSCORE=${CRATE_NAME//-/_}" >> $GITHUB_ENV

      # Build & Package
      - name: Build Reproducible Binary
        uses: yonasBSD/toolkit@7757e45441401d468ec049000c61571426a47de4 # v1.0.0
        with:
          run: |
            # Set source date for reproducible builds
            export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)
            export CARGO_INCREMENTAL=0
            cargo auditable build --release

      - name: Prepare Packaging Environment
        run: |
          # Ensure packaging/scripts exists even if the repo doesn't use them
          mkdir -p packaging/scripts
          # Create empty shell scripts if they don't exist so NFPM doesn't throw a 'file not found' error
          for s in preinstall.sh postinstall.sh preremove.sh postremove.sh; do
            if [ ! -f "packaging/scripts/$s" ]; then
              echo "#!/bin/sh" > "packaging/scripts/$s"
              chmod +x "packaging/scripts/$s"
            fi
          done

      # Get project details
      - name: Set Project Metadata
        run: |
          # Extract metadata directly from Cargo.toml
          METADATA=$(cargo metadata --no-deps --format-version 1)

          CRATE_NAME=$(echo $METADATA | jq -r '.packages[0].name')
          DESC=$(echo $METADATA | jq -r '.packages[0].description')
          LICE=$(echo $METADATA | jq -r '.packages[0].license')
          # Grabs the first author from the list
          MAINT=$(echo $METADATA | jq -r '.packages[0].authors[0]')

          echo "PROJECT_BIN=$CRATE_NAME" >> $GITHUB_ENV
          echo "PROJECT_NAME_UNDERSCORE=${CRATE_NAME//-/_}" >> $GITHUB_ENV
          echo "PROJECT_DESC=$DESC" >> $GITHUB_ENV
          echo "PROJECT_LICENSE=$LICE" >> $GITHUB_ENV
          echo "PROJECT_MAINTAINER=$MAINT" >> $GITHUB_ENV

      # Generate all packages
      - name: Generate Packages (NFPM)
        env:
          VERSION: ${{ github.ref_name }}
          MAINTAINER: ${{ env.PROJECT_MAINTAINER }}
          DESCRIPTION: ${{ env.PROJECT_DESC }}
          LICENSE: ${{ env.PROJECT_LICENSE }}
          VENDOR: "yonasBSD"
          HOMEPAGE: "${{ github.event.repository.html_url }}"
        run: |
          # Clean 'v' from tag (v1.0.0 -> 1.0.0)
          export VERSION=${VERSION#v}

          for pkg in deb apk archlinux rpm ipk; do
            nfpm package --config packaging/nfpm/nfpm.yaml --packager $pkg
          done

      # Security, Checksums, and Signatures
      - name: Generate SBOMs, Checksums, and Signatures
        run: |
          # Generate BLAKE3 checksums for all artifacts
          b3sum *.deb *.apk *.ipk *.rpm *.zst > checksums-blake3.txt

          # Loop through artifacts to generate SBOMs and Cosign signatures
          for f in *.deb *.apk *.ipk *.rpm *.zst; do
            syft "$f" -o spdx-json="sbom-$f.spdx.json"
            cosign sign-blob --yes --output-signature "$f.sig" "$f"
          done

      # Attestations (GitHub Native Security)
      - name: Attest SBOMs
        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
        with:
          sbom-path: 'sbom-*.spdx.json'

      - name: Generate SLSA Level 3 Provenance
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
        with:
          subject-path: |
            *.deb
            *.apk
            *.ipk
            *.rpm
            *.zst

      # Publication
      - name: Create GitHub Release
        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
        with:
          files: |
            *.deb
            *.apk
            *.ipk
            *.rpm
            *.zst
            *.sig
            sbom-*.spdx.json
            checksums-blake3.txt