name: release

on:
  workflow_dispatch:
    inputs:
      release-tag:
        description: 'Release Tag'
        required: true
        type: string

permissions:
  contents: read # Needed to checkout the repository.

concurrency:
  group: "${{ github.workflow }}-${{ github.event.inputs.release-tag }}"
  # Let a running release finish, so its assets are never left partially uploaded.
  cancel-in-progress: false

jobs:
  release:
    name: release
    permissions:
      contents: write # Needed to upload release assets.
      id-token: write # Needed for attestation.
      attestations: write # Needed for attestations.
    runs-on: ubuntu-latest
    steps:
    - name: harden runner
      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: checkout
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        # Build the tagged commit, not whichever ref the workflow was dispatched on.
        ref: "refs/tags/${{ github.event.inputs.release-tag }}"
        persist-credentials: false

    - name: 'install rust toolchain'
      run: |
        cargo version

    - name: 'assemble release artifacts'
      run: ./hack/assemble.sh

    - name: 'attest release artifacts'
      uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
      with:
        subject-path: target/assemble/*

    - name: 'generate cultivator token'
      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.0.0-beta.2
      id: generate-token
      with:
        app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
        private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
        # Scope to what uploading assets and `gh release edit` need: write to
        # release contents.
        permission-contents: write
      if: ${{ github.event.inputs.release-tag != '' }}

    - name: 'upload release artifacts'
      run: ./hack/ci/upload-release-assets.sh
      env:
        GITHUB_TOKEN: "${{ steps.generate-token.outputs.token }}"
        RELEASE_TAG: "${{ github.event.inputs.release-tag }}"
      if: ${{ github.event.inputs.release-tag != '' }}

    - name: 'mark release as published'
      run: gh release edit "${RELEASE_TAG}" --draft=false --verify-tag
      env:
        GITHUB_TOKEN: "${{ steps.generate-token.outputs.token }}"
        RELEASE_TAG: "${{ github.event.inputs.release-tag }}"
      if: ${{ github.event.inputs.release-tag != '' }}