krata/.github/workflows/release-binaries.yml

name: release-binaries
permissions:
  contents: write
  packages: write
  id-token: write
on:
  release:
    types:
    - published
env:
  CARGO_INCREMENTAL: 0
  CARGO_NET_GIT_FETCH_WITH_CLI: true
  CARGO_NET_RETRY: 10
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  RUSTUP_MAX_RETRIES: 10
jobs:
  server:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        arch:
        - x86_64
        - aarch64
    env:
      TARGET_ARCH: "${{ matrix.arch }}"
    name: release-binaries server ${{ matrix.arch }}
    steps:
    - uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
      with:
        egress-policy: audit
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      with:
        submodules: recursive
    - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
      with:
        targets: "${{ matrix.arch }}-unknown-linux-gnu,${{ matrix.arch }}-unknown-linux-musl"
    - run: ./hack/ci/install-linux-deps.sh
    - run: ./hack/dist/bundle.sh
    - run: "./hack/ci/assemble-release-assets.sh bundle-systemd ${{ github.event.release.tag_name }} ${{ matrix.arch }} target/dist/bundle-systemd-${{ matrix.arch }}.tgz"
    - run: ./hack/dist/deb.sh
    - run: "./hack/ci/assemble-release-assets.sh debian ${{ github.event.release.tag_name }} ${{ matrix.arch }} target/dist/*.deb"
    - run: ./hack/dist/apk.sh
    - run: "./hack/ci/assemble-release-assets.sh alpine ${{ github.event.release.tag_name }} ${{ matrix.arch }} target/dist/*_${{ matrix.arch }}.apk"
    - run: ./hack/os/build.sh
    - run: "./hack/ci/assemble-release-assets.sh os ${{ github.event.release.tag_name }} ${{ matrix.arch }} target/os/krata-${{ matrix.arch }}.qcow2"
    - run: "./hack/ci/upload-release-assets.sh ${{ github.event.release.tag_name }}"
      env:
        GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
  client:
    strategy:
      fail-fast: false
      matrix:
        platform:
        - { os: linux, arch: x86_64, on: ubuntu-latest, deps: linux }
        - { os: linux, arch: aarch64, on: ubuntu-latest, deps: linux }
        - { os: darwin, arch: x86_64, on: macos-14, deps: darwin }
        - { os: darwin, arch: aarch64, on: macos-14, deps: darwin }
        - { os: freebsd, arch: x86_64, on: ubuntu-latest, deps: linux }
        - { os: windows, arch: x86_64, on: windows-latest, deps: windows }
    env:
      TARGET_OS: "${{ matrix.platform.os }}"
      TARGET_ARCH: "${{ matrix.platform.arch }}"
    runs-on: "${{ matrix.platform.on }}"
    name: release-binaries client ${{ matrix.platform.os }}-${{ matrix.platform.arch }}
    defaults:
      run:
        shell: bash
    timeout-minutes: 60
    steps:
    - uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
      with:
        egress-policy: audit
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      with:
        submodules: recursive
    - uses: dtolnay/rust-toolchain@d388a4836fcdbde0e50e395dc79a2670ccdef13f # stable
      if: ${{ matrix.platform.os != 'darwin' }}
    - uses: dtolnay/rust-toolchain@stable
      with:
        targets: "${{ matrix.platform.arch }}-apple-darwin"
      if: ${{ matrix.platform.os == 'darwin' }}
    - uses: homebrew/actions/setup-homebrew@4b34604e75af8f8b23b454f0b5ffb7c5d8ce0056 # master
      if: ${{ matrix.platform.os == 'darwin' }}
    - run: ./hack/ci/install-${{ matrix.platform.deps }}-deps.sh
    - run: ./hack/build/cargo.sh build --release --bin kratactl
    - run: "./hack/ci/assemble-release-assets.sh kratactl ${{ github.event.release.tag_name }} ${{ matrix.platform.os }}-${{ matrix.platform.arch }} target/*/release/kratactl"
      if: ${{ matrix.platform.os != 'windows' }}
    - run: "./hack/ci/assemble-release-assets.sh kratactl ${{ github.event.release.tag_name }} ${{ matrix.platform.os }}-${{ matrix.platform.arch }} target/*/release/kratactl.exe"
      if: ${{ matrix.platform.os == 'windows' }}
    - run: "./hack/ci/upload-release-assets.sh ${{ github.event.release.tag_name }}"
      env:
        GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
  oci:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        component:
        - kratactl
        - kratad
        - kratanet
        - krata-guest-init
    name: "release-binaries oci ${{ matrix.component }}"
    steps:
    - uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
      with:
        egress-policy: audit
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      with:
        submodules: recursive
    - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
    - uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3.4.0
    - uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
      with:
        registry: ghcr.io
        username: "${{ github.actor }}"
        password: "${{ secrets.GITHUB_TOKEN }}"
    - id: version
      run: |
        echo "KRATA_VERSION=$(./hack/dist/version.sh)" >> "${GITHUB_OUTPUT}"
    - uses: docker/build-push-action@1a162644f9a7e87d8f4b053101d1d9a712edc18c # v6.3.0
      id: push
      with:
        file: ./images/Dockerfile.${{ matrix.component }}
        platforms: linux/amd64,linux/aarch64
        tags: "ghcr.io/edera-dev/${{ matrix.component }}:${{ steps.version.outputs.KRATA_VERSION }}"
        push: true
    - env:
        DIGEST: "${{ steps.push.outputs.digest }}"
        TAGS: "ghcr.io/edera-dev/${{ matrix.component }}:${{ steps.version.outputs.KRATA_VERSION }}"
        COSIGN_EXPERIMENTAL: "true"
      run: cosign sign --yes "${TAGS}@${DIGEST}"