release.yml

# Pinned actions (bump tag and SHA together when upgrading):
#   actions/checkout@v7.0.1                   3d3c42e5aac5ba805825da76410c181273ba90b1
#   actions/setup-go@v7.0.0                   b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
#   actions/setup-node@v7.0.0                 820762786026740c76f36085b0efc47a31fe5020
#   goreleaser/goreleaser-action@v7.2.3       f06c13b6b1a9625abc9e6e439d9c05a8f2190e94
#   docker/setup-qemu-action@v4.3.0           1f40c72289eff860ee54a304f1438e3cff362e0a
#   docker/setup-buildx-action@v4.3.0         37fe631027851001ddb9b187196cc803df7f5f0e
#   docker/login-action@v4.6.0                dbcb813823bdd20940b903addbd779551569679f
#   docker/metadata-action@v6.2.0             dc802804100637a589fabce1cb79ff13a1411302
#   docker/build-push-action@v7.3.0           53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
#   sigstore/cosign-installer@v4.1.2           6f9f17788090df1f26f669e9d70d6ae9567deba6
#   anchore/sbom-action/download-syft@v0.24.2  3ad7283483fc7af8ff2b4ea19663c2d5ca935e26
#
# Immutable releases: all assets (binaries, checksums, CycloneDX SBOM,
# cosign checksum bundle) are published in one GoReleaser step. Do not
# gh release upload after publish (assets become read-only).
# Secure use: least-privilege GITHUB_TOKEN, pin actions to full commit SHAs,
# no pull_request_target, untrusted input via env (not inline shell).
# https://docs.github.com/en/actions/reference/security/secure-use

name: Release

on:
  push:
    branches:
      - master
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to build (e.g. v0.1.0). Leave empty to use latest tag or VERSION."
        required: false
        default: ""

permissions: {}

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: quad4-software/transcriptasm

jobs:
  goreleaser:
    name: Binaries
    if: github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22"

      - name: Build browser extensions
        run: make extensions

      - name: Install Cosign
        if: github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Install Syft
        if: github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'
        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          distribution: goreleaser
          version: "v2.18.0"
          args: >-
            release --clean
            ${{ github.ref_type != 'tag' && '--snapshot --skip=publish --skip=sign' || '' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          COSIGN_YES: "true"

  docker:
    name: Container
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Version
        id: meta
        env:
          EVENT_NAME: ${{ github.event_name }}
          INPUT_TAG: ${{ inputs.tag }}
          REF_TYPE: ${{ github.ref_type }}
          REF_NAME: ${{ github.ref_name }}
          GITHUB_SHA_FULL: ${{ github.sha }}
        run: |
          if [ "$EVENT_NAME" = "workflow_dispatch" ] && [ -n "$INPUT_TAG" ]; then
            RAW="$INPUT_TAG"
            VER="${RAW#v}"
          elif [ "$REF_TYPE" = "tag" ]; then
            RAW="$REF_NAME"
            VER="${RAW#v}"
          elif [ "$REF_NAME" = "master" ]; then
            SHORT="${GITHUB_SHA_FULL:0:12}"
            RAW="master"
            VER="0.0.0-master.${SHORT}"
          else
            RAW="$(git describe --tags --abbrev=0 2>/dev/null || echo v0.1.0)"
            VER="${RAW#v}"
          fi
          echo "version=${VER}" >> "$GITHUB_OUTPUT"
          echo "tag=${RAW}" >> "$GITHUB_OUTPUT"
          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
          echo "revision=${GITHUB_SHA_FULL}" >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0

      - name: Set up Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Log in to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker metadata
        id: docker_meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}},value=${{ steps.meta.outputs.tag }},enable=${{ github.ref_type == 'tag' }}
            type=semver,pattern={{major}}.{{minor}},value=${{ steps.meta.outputs.tag }},enable=${{ github.ref_type == 'tag' }}
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' || (github.ref_type == 'tag' && !contains(github.ref_name, '-')) }}
            type=raw,value=master,enable=${{ github.ref == 'refs/heads/master' }}
            type=sha,prefix=sha-,format=short

      - name: Build and push
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          provenance: mode=max
          sbom: true
          tags: ${{ steps.docker_meta.outputs.tags }}
          labels: ${{ steps.docker_meta.outputs.labels }}
          build-args: |
            VERSION=${{ steps.meta.outputs.version }}
            REVISION=${{ steps.meta.outputs.revision }}
            CREATED=${{ steps.meta.outputs.created }}
          cache-from: type=gha
          cache-to: type=gha,mode=max