releaser.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      release:
        description: 'Release version'
        required: true

permissions:  # added using https://github.com/step-security/secure-repo
  contents: read

jobs:
  release:
    runs-on: macos-latest
    permissions:
      packages: read
      contents: write
      actions: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          egress-policy: audit

      -
        name: Cancel previous workflows
        uses: styfle/cancel-workflow-action@01ce38bf961b4e243a6342cbade0dbc8ba3f0432 # 0.12.0
        with:
          access_token: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Checkout
        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
      -
        name: Unshallow
        run: git fetch --prune --unshallow
      -
        name: Set up Go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: '1.22'
          check-latest: true
      -
        name: Cache Go modules
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-
      -
        name: Download cyclonedx-gomod
        uses: Zenithar/gh-gomod-generate-sbom@2cdc82f8e362b12fdec116b716ce0130baec8be2 # v1.0.3
        with:
          version: v1.2.0
          github-token: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Install Cosign
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
      -
        name: Import Code-Signing Certificates
        uses: Apple-Actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2
        with:
          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
          p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
      -
        name: Install gon via HomeBrew for code signing and app notarization
        run: |
          brew tap mitchellh/gon
          brew install mitchellh/gon/gon
          brew install coreutils
      -
        name: Run GoReleaser
        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
        with:
          version: latest
          args: release --clean --skip-publish
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Prepare Github release packages
        run: |
          #!/bin/bash
          shopt -s expand_aliases
          mkdir .dist
          cp dist/harp-* .dist/
      -
        name: Sign and notarize MacOS CLIs
        env:
          AC_USERNAME: "${{ secrets.AC_USERNAME }}"
          AC_PASSWORD: "${{ secrets.AC_PASSWORD }}"
        run: |
          echo '{
            "source": [
              "./dist/harp-darwin-amd64",
              "./dist/harp-darwin-arm64"
            ],
            "bundle_id":"io.harpsec.cli",
            "apple_id": {},
            "sign": { "application_identity": "AA99310C5F2AE5E79F93A92993930904F95B59FC" },
            "zip": {
              "output_path": "./dist/harp-darwin.zip"
            }
          }' | jq '' > gon.json
          gon -log-level=debug -log-json ./gon.json
          rm -f .dist/harp-darwin-amd64 .dist/harp-darwin-arm64
      -
        name: Prepare archives
        run: |
          #!/bin/bash
          shopt -s expand_aliases
          cd .dist/
          unzip ../dist/harp-darwin.zip
          FILES="*"
          for f in $FILES;
          do
            case $f in
            *.sbom.json)
                continue
                ;;
            harp-*)
                fn=$(basename -s ".exe" $f)
                tar czf ${fn}.tar.gz $f ${fn}.sbom.json
                rm -f $f ${fn}.sbom.json
                ;;
            esac
          done
      -
        name: Sign
        shell: bash
        run: |
          #!/bin/bash
          shopt -s expand_aliases
          cd .dist
          sha256sum * > checksums.txt
          FILES="*"
          for f in $FILES;
          do
            case $f in
            provenance.json|checksums.txt)
                cosign sign-blob --key <(echo -n "${COSIGN_KEY}") "$f" > "$f.sig"
                ;;
            *.tar.gz)
                sha256sum "$f" | cut -d " " -f 1 > "$f.sha256"
                cosign sign-blob --key <(echo -n "${COSIGN_KEY}") "$f" > "$f.sig"
                ;;
            esac
          done
        env:
          COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
      -
        name: Verify
        shell: bash
        run: |
          #!/bin/bash
          shopt -s expand_aliases
          curl -sLO https://raw.githubusercontent.com/zntrio/harp/v${{ github.event.inputs.release }}/build/artifact/cosign.pub
          cd .dist
          FILES="*"
          for f in $FILES;
          do
            if [[ -f "$f.sig" ]];
            then
              cosign verify-blob --key ../cosign.pub --signature "$f.sig" $f
            fi
          done
      -
        name: Upload to release
        uses: AButler/upload-release-assets@3d6774fae0ed91407dc5ae29d576b166536d1777 # v3.0
        with:
          files: '.dist/*'
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          release-tag: v${{ github.event.inputs.release }}