release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

jobs:
  validate-and-test:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: ./.github/actions/setup-node
      - uses: ./.github/actions/setup-php
        with:
          php-version: "8.4"
      - name: Validate stable tag and versions
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          version="${RELEASE_TAG#v}"
          [[ "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
          # shellcheck disable=SC2016
          app_version="$(php -r '$xml=simplexml_load_file("appinfo/info.xml"); echo (string)$xml->version;')"
          package_version="$(node -p "require('./package.json').version")"
          lock_version="$(node -p "require('./package-lock.json').version")"
          test "${version}" = "${app_version}"
          test "${version}" = "${package_version}"
          test "${version}" = "${lock_version}"
          node scripts/release-notes.mjs "${version}" >/dev/null
      - run: npm run lint
      - run: npm test
      - run: npm run build
      - run: npm run build:docs
      - run: composer lint
      - run: composer test
      - run: composer analyse
      - run: npm audit --audit-level=high
      - run: composer audit --no-interaction

  compatibility:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        nextcloud: ["31", "32", "33", "34"]
        database: [sqlite, mariadb, postgres]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-node
      - run: npm run build
      - name: Enable and migrate the app
        env:
          NEXTCLOUD_VERSIONS: ${{ matrix.nextcloud }}
          DATABASES: ${{ matrix.database }}
        run: ./scripts/compatibility-matrix.sh

  package:
    needs: [validate-and-test, compatibility]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: ./.github/actions/setup-node
      - uses: ./.github/actions/setup-php
        with:
          php-version: "8.4"
      - name: Build the release twice and verify reproducibility
        run: |
          SOURCE_DATE_EPOCH="$(git log -1 --format=%ct)"
          export SOURCE_DATE_EPOCH
          make appstore
          cp build/artifacts/appstore/proofing_gallery.tar.gz /tmp/proofing_gallery-first.tar.gz
          make appstore
          cmp /tmp/proofing_gallery-first.tar.gz build/artifacts/appstore/proofing_gallery.tar.gz
      - run: make verify-package
      - name: Prepare release inputs
        run: |
          cd build/artifacts/appstore
          mv proofing_gallery.tar.gz proofing_gallery-unsigned.tar.gz
          node ../../../scripts/release-notes.mjs "${GITHUB_REF_NAME#v}" > RELEASE_NOTES.md
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-inputs
          path: |
            build/artifacts/appstore/proofing_gallery-unsigned.tar.gz
            build/artifacts/appstore/RELEASE_NOTES.md
          if-no-files-found: error

  recovery:
    needs: package
    runs-on: ubuntu-latest
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        database: [sqlite, mariadb, postgres]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-inputs
          path: release-inputs
      - name: Reproduce the 0.9.0 failure and recover with the candidate
        env:
          UPGRADE_DATABASE: ${{ matrix.database }}
          UPGRADE_NEXTCLOUD_VERSION: 34.0.3
          UPGRADE_CURRENT_ARCHIVE: ${{ github.workspace }}/release-inputs/proofing_gallery-unsigned.tar.gz
          UPGRADE_FROM_REF: v0.8.2
          UPGRADE_INTERMEDIATE_ARCHIVE_URL: https://github.com/soerennb/nextcloud-proofing_gallery/releases/download/v0.9.0/proofing_gallery.tar.gz
          UPGRADE_INTERMEDIATE_CHECKSUMS_URL: https://github.com/soerennb/nextcloud-proofing_gallery/releases/download/v0.9.0/SHA256SUMS
          UPGRADE_INTERMEDIATE_VERSION: 0.9.0
        run: make test-upgrade

  publish:
    needs: [package, recovery]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment: release
    permissions:
      contents: write
      id-token: write
      attestations: write
      artifact-metadata: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: ./.github/actions/setup-node
      - uses: ./.github/actions/setup-php
        with:
          php-version: "8.4"
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-inputs
          path: release-inputs
      - name: Materialize protected signing credentials
        env:
          APP_PRIVATE_KEY_CONTENT: ${{ secrets.APP_PRIVATE_KEY }}
          APP_PUBLIC_CRT_CONTENT: ${{ secrets.APP_PUBLIC_CRT }}
          APPSTORE_TOKEN_VALUE: ${{ secrets.APPSTORE_TOKEN }}
        run: |
          test -n "${APP_PRIVATE_KEY_CONTENT}"
          test -n "${APP_PUBLIC_CRT_CONTENT}"
          test -n "${APPSTORE_TOKEN_VALUE}"
          umask 077
          signing_dir="${RUNNER_TEMP}/proofing-gallery-signing"
          mkdir -p "${signing_dir}"
          printf '%s\n' "${APP_PRIVATE_KEY_CONTENT}" > "${signing_dir}/proofing_gallery.key"
          printf '%s\n' "${APP_PUBLIC_CRT_CONTENT}" > "${signing_dir}/proofing_gallery.crt"
          echo "APP_PRIVATE_KEY_FILE=${signing_dir}/proofing_gallery.key" >> "${GITHUB_ENV}"
          echo "APP_PUBLIC_CRT_FILE=${signing_dir}/proofing_gallery.crt" >> "${GITHUB_ENV}"
      - name: Build and verify the signed release twice
        run: |
          SOURCE_DATE_EPOCH="$(git log -1 --format=%ct)"
          export SOURCE_DATE_EPOCH
          make appstore-signed
          cp build/artifacts/appstore/proofing_gallery.tar.gz "${RUNNER_TEMP}/proofing_gallery-first-signed.tar.gz"
          make verify-signed-package
          cmp "${RUNNER_TEMP}/proofing_gallery-first-signed.tar.gz" build/artifacts/appstore/proofing_gallery.tar.gz
      - name: Prepare signed release assets
        run: |
          cd build/artifacts/appstore
          cp ../../../release-inputs/RELEASE_NOTES.md RELEASE_NOTES.md
          sha256sum proofing_gallery.tar.gz > SHA256SUMS
      - name: Generate SPDX SBOM
        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
        with:
          file: build/artifacts/appstore/proofing_gallery.tar.gz
          format: spdx-json
          output-file: build/artifacts/appstore/proofing_gallery.spdx.json
          upload-artifact: false
      - name: Attest release package
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
        with:
          subject-path: build/artifacts/appstore/proofing_gallery.tar.gz
      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          asset_dir="build/artifacts/appstore"
          if gh release view "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
            existing_dir="${RUNNER_TEMP}/proofing-gallery-existing-release"
            rm -rf "${existing_dir}"
            mkdir -p "${existing_dir}"
            gh release download "${GITHUB_REF_NAME}" \
              --repo "${GITHUB_REPOSITORY}" \
              --dir "${existing_dir}" \
              --pattern proofing_gallery.tar.gz \
              --pattern proofing_gallery.spdx.json \
              --pattern SHA256SUMS
            cmp "${asset_dir}/proofing_gallery.tar.gz" "${existing_dir}/proofing_gallery.tar.gz"
            cmp "${asset_dir}/SHA256SUMS" "${existing_dir}/SHA256SUMS"
            test -s "${existing_dir}/proofing_gallery.spdx.json"
          else
            gh release create "${GITHUB_REF_NAME}" \
              "${asset_dir}/proofing_gallery.tar.gz" \
              "${asset_dir}/proofing_gallery.spdx.json" \
              "${asset_dir}/SHA256SUMS" \
              --repo "${GITHUB_REPOSITORY}" \
              --verify-tag \
              --title "Proofing Gallery ${GITHUB_REF_NAME#v}" \
              --notes-file "${asset_dir}/RELEASE_NOTES.md"
          fi
      - name: Publish stable release to the Nextcloud App Store
        uses: R0Wi/nextcloud-appstore-push-action@ad2020a77eb694e8fe145d2ebd6bc21c246240fd # v1.0.5
        with:
          app_name: proofing_gallery
          appstore_token: ${{ secrets.APPSTORE_TOKEN }}
          download_url: https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/proofing_gallery.tar.gz
          app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
          nightly: false
      - name: Remove signing credentials
        if: always()
        run: |
          rm -f "${APP_PRIVATE_KEY_FILE:-/nonexistent}" "${APP_PUBLIC_CRT_FILE:-/nonexistent}"
          rm -f "${GITHUB_WORKSPACE}/proofing_gallery.key"
          rm -rf "${RUNNER_TEMP}/proofing-gallery-signing"

  verify-published:
    name: Verify published release assets
    needs: publish
    if: needs.publish.result == 'success'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Download published assets
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          mkdir -p "${RUNNER_TEMP}/release-assets"
          gh release download "${GITHUB_REF_NAME}" \
            --repo "${GITHUB_REPOSITORY}" \
            --dir "${RUNNER_TEMP}/release-assets" \
            --pattern proofing_gallery.tar.gz \
            --pattern proofing_gallery.spdx.json \
            --pattern SHA256SUMS

      - name: Verify checksum, version, SBOM, and attestation
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          cd "${RUNNER_TEMP}/release-assets"
          sha256sum -c SHA256SUMS
          version="${GITHUB_REF_NAME#v}"
          tar_version="$(tar -xOzf proofing_gallery.tar.gz proofing_gallery/appinfo/info.xml | sed -n 's:.*<version>\(.*\)</version>.*:\1:p')"
          test "${tar_version}" = "${version}"
          jq -e '.spdxVersion and (.packages | length > 0)' proofing_gallery.spdx.json >/dev/null
          digest="$(sha256sum proofing_gallery.tar.gz | awk '{print $1}')"
          attestation_json="$(gh api "repos/${GITHUB_REPOSITORY}/attestations/sha256:${digest}")"
          printf '%s' "${attestation_json}" | jq -e '.attestations | length >= 1' >/dev/null
          statement="$(
            printf '%s' "${attestation_json}" \
              | jq -er '.attestations[0].bundle.dsseEnvelope.payload' \
              | base64 --decode
          )"
          printf '%s' "${statement}" \
            | jq -e --arg digest "${digest}" --arg ref "refs/tags/${GITHUB_REF_NAME}" '
                any(.subject[]?; .name == "proofing_gallery.tar.gz" and .digest.sha256 == $digest) and
                .predicate.buildDefinition.externalParameters.workflow.ref == $ref
              ' >/dev/null