release.yml

name: Release

env:
  PACKAGE_NAME: httptap
  CHANGELOG_FILE: CHANGELOG.md

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Exact version (e.g., 0.3.0) - leave empty to use bump"
        required: false
        type: string
      bump:
        description: "Bump type (used if version is empty)"
        required: false
        type: choice
        default: "patch"
        options:
          - patch
          - minor
          - major

permissions: {}

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  prepare:
    name: Prepare Release
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment: release
    permissions:
      contents: write # Required for git push and tag creation
      id-token: write # Required for gitsign keyless Sigstore OIDC signing
    outputs:
      tag: ${{ steps.version.outputs.tag }}
      version: ${{ steps.version.outputs.version }}
      notes: ${{ steps.notes.outputs.text }}

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          ssh-key: ${{ secrets.DEPLOY_KEY }}
          persist-credentials: true

      - name: Install gitsign (Sigstore keyless git signing)
        uses: chainguard-dev/actions/setup-gitsign@c69a264ec2a5934c3186c618f368fc1c86f16cff # v1.6.19

      - name: Configure git
        run: |
          git config user.name "github-actions"
          git config user.email "github-actions@github.com"
          git config --global gpg.x509.program gitsign
          git config --global gpg.format x509
          git config --global tag.gpgsign true
          git config --global commit.gpgsign true

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version-file: "pyproject.toml"

      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
        with:
          enable-cache: true

      - name: Update project version
        id: version
        env:
          INPUT_VERSION: ${{ inputs.version }}
          INPUT_BUMP: ${{ inputs.bump }}
        run: |
          if [ -n "$INPUT_VERSION" ]; then
            VERSION="$INPUT_VERSION"
            echo "Using explicit version: ${VERSION}"
            uv version "${VERSION}"
          else
            BUMP="$INPUT_BUMP"
            echo "Bumping version: ${BUMP}"
            uv version --bump "${BUMP}"
            VERSION=$(uv version --short)
          fi

          TAG="v${VERSION}"
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
          echo "Final version: ${VERSION}"

      - name: Refresh lockfile
        run: uv lock

      - name: Update CITATION.cff metadata
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          DATE=$(date -u +%Y-%m-%d)
          yq -i ".version = \"${VERSION}\" | .\"date-released\" = \"${DATE}\"" CITATION.cff

      - name: Ensure changelog exists
        run: touch ${CHANGELOG_FILE}

      - name: Install git-cliff
        uses: taiki-e/install-action@711e1c3275189d76dcc4d34ddea63bf96ac49090 # v2.76.0
        with:
          tool: git-cliff

      - name: Generate changelog entry
        id: notes
        env:
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          # Generate full changelog and prepend to CHANGELOG.md
          git cliff --config .release/git-cliff.toml --tag "${TAG}" --unreleased --prepend ${CHANGELOG_FILE}
          # Extract release notes for the new version.
          # We cannot use --latest here because the tag does not exist in git
          # yet (it is created in a later step); --latest would fall back to
          # the previous release and embed stale notes in the GitHub release.
          NOTES=$(git cliff --config .release/git-cliff.toml --tag "${TAG}" --unreleased --strip header)
          {
            echo "text<<EOF"
            echo "${NOTES}"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Commit release changes
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          git add pyproject.toml uv.lock CITATION.cff ${CHANGELOG_FILE}
          git commit -S -m "chore: release v${VERSION}"

      - name: Create and push signed tag
        env:
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          git tag -s "${TAG}" -m "Release ${TAG}"
          git push origin HEAD
          git push origin "${TAG}"

  build:
    name: Build Package
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: prepare
    permissions:
      id-token: write # Required for Sigstore OIDC signing via attest-build-provenance
      attestations: write # Required for generating build provenance attestations
      contents: read # Required for repository checkout

    steps:
      - name: Checkout tag
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.prepare.outputs.tag }}
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
        with:
          enable-cache: true

      - name: Sync dependencies
        run: uv sync --locked --group test

      - name: Run tests
        run: uv run pytest

      - name: Build distribution
        run: uv build

      - name: Attest build provenance (SLSA)
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-path: "dist/*"

      - name: Upload dist artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist
          path: dist/
          retention-days: 7
          compression-level: 6
          if-no-files-found: error

      - name: Prepare SBOM directory
        run: mkdir -p sbom

      - name: Generate SBOM (CycloneDX)
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
        with:
          artifact-name: ${{ env.PACKAGE_NAME }}-${{ needs.prepare.outputs.version }}.cdx.json
          format: cyclonedx-json
          output-file: sbom/${{ env.PACKAGE_NAME }}-${{ needs.prepare.outputs.version }}.cdx.json
          upload-artifact: false
          upload-release-assets: false

      - name: Generate SBOM (SPDX)
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
        with:
          artifact-name: ${{ env.PACKAGE_NAME }}-${{ needs.prepare.outputs.version }}.spdx.json
          format: spdx-json
          output-file: sbom/${{ env.PACKAGE_NAME }}-${{ needs.prepare.outputs.version }}.spdx.json
          upload-artifact: false
          upload-release-assets: false

      - name: Attach VEX document
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          # OpenVEX is kept in-tree under .vex/ so every commit tracks
          # the current exploitability assessment. Rename-copy the file
          # with the release version embedded so the published artifact
          # is self-identifying.
          cp .vex/httptap.openvex.json "sbom/${PACKAGE_NAME}-${VERSION}.openvex.json"

      - name: Generate man page
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          mkdir -p man
          uv run --with 'argparse-manpage>=4.7' argparse-manpage \
            --module httptap.cli \
            --function create_parser \
            --project-name httptap \
            --version "${VERSION}" \
            --author "Sergei Ozeranskii" \
            --author-email "noreply@httptap.dev" \
            --url "https://github.com/ozeranskii/httptap" \
            --manual-title "httptap" \
            --output "man/${PACKAGE_NAME}.1"
          gzip --best "man/${PACKAGE_NAME}.1"

      - name: Upload man-page artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: man
          path: man/
          retention-days: 7
          if-no-files-found: error

      - name: Upload SBOM artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: sbom
          path: sbom/
          retention-days: 7
          if-no-files-found: error

  publish-testpypi:
    name: Publish to TestPyPI
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs:
      - prepare
      - build
    environment:
      name: testpypi
      url: https://test.pypi.org/project/${{ env.PACKAGE_NAME }}/
    permissions:
      id-token: write # Required for TestPyPI OIDC trusted publishing

    steps:
      - name: Download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist/

      - name: Publish to TestPyPI
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          repository-url: https://test.pypi.org/legacy/
          attestations: true

  publish-pypi:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs:
      - prepare
      - build
      - publish-testpypi
    environment:
      name: pypi
      url: https://pypi.org/project/${{ env.PACKAGE_NAME }}/
    permissions:
      id-token: write # Required for PyPI OIDC trusted publishing

    steps:
      - name: Download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          # PEP 740 attestations are signed via Sigstore OIDC and
          # surfaced on the PyPI project page as "Verified publisher".
          attestations: true

  publish-container:
    name: Publish container image to GHCR
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs:
      - prepare
    permissions:
      contents: read
      packages: write # Push to ghcr.io/<owner>/<repo>
      id-token: write # Sigstore OIDC for keyless cosign signing
      attestations: write # GitHub build provenance attestations

    steps:
      - name: Checkout tag
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.prepare.outputs.tag }}
          persist-credentials: false

      - name: Set up QEMU for multi-arch builds
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Derive container tags and labels
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}},value=${{ needs.prepare.outputs.tag }}
            type=semver,pattern={{major}}.{{minor}},value=${{ needs.prepare.outputs.tag }}
            type=semver,pattern={{major}},value=${{ needs.prepare.outputs.tag }}
            type=raw,value=latest,enable={{is_default_branch}}
          labels: |
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ needs.prepare.outputs.version }}

      - name: Build and push image
        id: build
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: mode=max
          sbom: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Install cosign
        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1

      - name: Sign image with cosign (keyless Sigstore)
        env:
          IMAGE: ghcr.io/${{ github.repository }}
          DIGEST: ${{ steps.build.outputs.digest }}
        run: cosign sign --yes "${IMAGE}@${DIGEST}"

      - name: Attach SLSA build provenance
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-name: ghcr.io/${{ github.repository }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

  create-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: write # Required for creating GitHub releases
    needs:
      - prepare
      - build
      - publish-pypi
      - publish-container

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Download dist artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist/

      - name: Download SBOM artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: sbom
          path: sbom/

      - name: Download man-page artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: man
          path: man/

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ needs.prepare.outputs.tag }}
          NOTES: ${{ needs.prepare.outputs.notes }}
          REPO: ${{ github.repository }}
        run: |-
          gh release create "$TAG" \
            dist/* sbom/* man/* \
            --repo "$REPO" \
            --title "$TAG" \
            --notes "$NOTES"