release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  validate-tag:
    name: Validate release tag
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read

    steps:
      - name: Checkout release tag
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Require a commit on protected main
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          git merge-base --is-ancestor HEAD origin/main
          test "$(gh api "repos/$GITHUB_REPOSITORY/branches/main" --jq '.protected')" = true

      - name: Match tag to backend and dashboard versions
        run: |
          version="${GITHUB_REF_NAME#v}"
          cargo_version="$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n 1)"
          dashboard_version="$(
            python3 -c 'import json; print(json.load(open("dashboard/package.json", encoding="utf-8"))["version"])'
          )"
          dashboard_lock_version="$(
            python3 -c 'import json; print(json.load(open("dashboard/package-lock.json", encoding="utf-8"))["packages"][""]["version"])'
          )"
          [[ "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]
          [[ "$cargo_version" == "$version" ]]
          [[ "$dashboard_version" == "$version" ]]
          [[ "$dashboard_lock_version" == "$version" ]]
          grep -F "ghcr.io/tiammomo/modelport:${version}" deploy/release/compose.yml
          grep -F "ghcr.io/tiammomo/modelport-dashboard:${version}" deploy/release/compose.yml
          grep -F "ghcr.io/tiammomo/modelport-ops-agent:${version}" deploy/release/compose.yml

  verification:
    name: Verify release candidate
    needs: validate-tag
    uses: ./.github/workflows/ci.yml
    permissions:
      contents: read
      attestations: read

  binary:
    name: Build and attest binary
    needs: verification
    runs-on: ubuntu-latest
    timeout-minutes: 40
    permissions:
      contents: read
      id-token: write
      attestations: write

    steps:
      - name: Checkout release tag
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.0.2
        with:
          persist-credentials: false

      - name: Build release archive
        env:
          MODELPORT_BUILD_REVISION: ${{ github.sha }}
          MODELPORT_BUILD_SOURCE_STATE: clean
        run: |
          cargo build --release --locked
          version="${GITHUB_REF_NAME#v}"
          archive="model-port-v${version}-linux-amd64"
          mkdir -p "target/release-package/${archive}" dist
          cp target/release/model-port "target/release-package/${archive}/"
          cp README.md LICENSE CHANGELOG.md Cargo.lock "target/release-package/${archive}/"
          tar -C target/release-package -czf "dist/${archive}.tar.gz" "$archive"

      - name: Generate SPDX SBOM
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
        with:
          syft-version: v1.51.1
          path: target/release-package/model-port-${{ github.ref_name }}-linux-amd64
          format: spdx-json
          output-file: dist/model-port-${{ github.ref_name }}-linux-amd64.spdx.json
          upload-artifact: false
          upload-release-assets: false

      - name: Verify SBOM includes locked Rust dependencies
        run: |
          python3 - "dist/model-port-${GITHUB_REF_NAME}-linux-amd64.spdx.json" <<'PYCODE'
          import json
          import sys
          with open(sys.argv[1], encoding="utf-8") as handle:
              sbom = json.load(handle)
          assert any(
              ref.get("referenceType") == "purl"
              and ref.get("referenceLocator", "").startswith("pkg:cargo/")
              for package in sbom.get("packages", [])
              for ref in package.get("externalRefs", [])
          ), "binary SBOM is missing the locked Rust dependency inventory"
          PYCODE

      - name: Generate checksums
        run: |
          cd dist
          sha256sum -- *.tar.gz *.spdx.json > SHA256SUMS

      - name: Attest binary provenance
        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
        with:
          subject-path: dist/model-port-${{ github.ref_name }}-linux-amd64.tar.gz

      - name: Attest binary SBOM
        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
        with:
          subject-path: dist/model-port-${{ github.ref_name }}-linux-amd64.tar.gz
          sbom-path: dist/model-port-${{ github.ref_name }}-linux-amd64.spdx.json

      - name: Upload release assets
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: release-assets
          path: dist
          if-no-files-found: error
          retention-days: 14

  containers:
    name: Publish ${{ matrix.title }}
    needs: binary
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write

    strategy:
      fail-fast: false
      matrix:
        include:
          - title: backend image
            image: modelport
            dockerfile: Dockerfile
          - title: dashboard image
            image: modelport-dashboard
            dockerfile: dashboard/Dockerfile
          - title: operations agent image
            image: modelport-ops-agent
            dockerfile: crates/ops-agent/Dockerfile

    steps:
      - name: Checkout release tag
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.0.2
        with:
          persist-credentials: false

      - name: Resolve image name
        id: image
        run: |
          owner="${GITHUB_REPOSITORY_OWNER,,}"
          {
            echo "name=ghcr.io/${owner}/${{ matrix.image }}"
            echo "version=${GITHUB_REF_NAME#v}"
            echo "build_date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          } >> "$GITHUB_OUTPUT"

      - name: Set up Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.0.0

      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Log in to GHCR
        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.0.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate image metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.0.0
        with:
          images: ${{ steps.image.outputs.name }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha
            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}

      - name: Build and push image
        id: push
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.0.0
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          # v0.1.x release images are Tier 1 Linux x86_64 artifacts. Linux
          # arm64 remains source-build experimental until it has equivalent
          # install, upgrade, backup, restore, and rollback coverage.
          platforms: linux/amd64
          push: true
          sbom: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            MODELPORT_VERSION=${{ steps.image.outputs.version }}
            MODELPORT_SOURCE_REVISION=${{ github.sha }}
            MODELPORT_SOURCE_STATE=clean
            MODELPORT_BUILD_DATE=${{ steps.image.outputs.build_date }}

      - name: Attest container provenance
        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
        with:
          subject-name: ${{ steps.image.outputs.name }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true

      - name: Sign immutable container digest
        env:
          IMAGE: ${{ steps.image.outputs.name }}
          DIGEST: ${{ steps.push.outputs.digest }}
        run: cosign sign --yes "${IMAGE}@${DIGEST}"

      - name: Prepare container release evidence
        run: mkdir -p dist

      - name: Generate container SPDX SBOM
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
        env:
          SYFT_SELECT_CATALOGERS: +rust-cargo-lock-cataloger,+javascript-lock-cataloger
        with:
          syft-version: v1.51.1
          image: ${{ steps.image.outputs.name }}@${{ steps.push.outputs.digest }}
          format: spdx-json
          output-file: dist/${{ matrix.image }}-${{ github.ref_name }}-linux-amd64.spdx.json
          upload-artifact: false
          upload-release-assets: false

      - name: Verify SBOM includes locked application dependencies
        env:
          RELEASE_IMAGE: ${{ matrix.image }}
        run: |
          python3 - "dist/${RELEASE_IMAGE}-${GITHUB_REF_NAME}-linux-amd64.spdx.json" <<'PYCODE'
          import json
          import os
          import sys
          with open(sys.argv[1], encoding="utf-8") as handle:
              sbom = json.load(handle)
          ecosystem = "npm" if os.environ["RELEASE_IMAGE"] == "modelport-dashboard" else "cargo"
          assert any(
              ref.get("referenceType") == "purl"
              and ref.get("referenceLocator", "").startswith(f"pkg:{ecosystem}/")
              for package in sbom.get("packages", [])
              for ref in package.get("externalRefs", [])
          ), f"container SBOM is missing the locked {ecosystem} dependency inventory"
          PYCODE

      - name: Attest container SBOM
        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
        with:
          subject-name: ${{ steps.image.outputs.name }}
          subject-digest: ${{ steps.push.outputs.digest }}
          sbom-path: dist/${{ matrix.image }}-${{ github.ref_name }}-linux-amd64.spdx.json
          push-to-registry: true

      - name: Record immutable image digest
        env:
          IMAGE: ${{ steps.image.outputs.name }}
          DIGEST: ${{ steps.push.outputs.digest }}
        run: |
          mkdir -p dist
          printf '%s@%s\n' "$IMAGE" "$DIGEST" \
            > "dist/${{ matrix.image }}-${GITHUB_REF_NAME}.digest"

      - name: Upload container release evidence
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: container-release-${{ matrix.image }}
          path: dist
          if-no-files-found: error
          retention-days: 14

  publish:
    name: Publish GitHub Release
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: [binary, containers]
    permissions:
      contents: write

    steps:
      - name: Download release assets
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: release-assets
          path: dist

      - name: Download container release evidence
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          pattern: container-release-*
          path: dist
          merge-multiple: true

      - name: Complete release checksums
        run: |
          cd dist
          sha256sum -- *.tar.gz *.spdx.json *.digest > SHA256SUMS

      - name: Create immutable release candidate
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          release_flags=()
          release_title="ModelPort $GITHUB_REF_NAME"
          if [[ "${GITHUB_REF_NAME#v}" == 0.* ]]; then
            release_flags+=(--prerelease)
            release_title="$release_title Small-Team Beta"
          fi
          gh release create "$GITHUB_REF_NAME" dist/* \
            --repo "$GITHUB_REPOSITORY" \
            --verify-tag \
            --generate-notes \
            --title "$release_title" \
            --draft \
            "${release_flags[@]}"
          # All assets must be present before immutable publication locks them.
          expected="$(find dist -maxdepth 1 -type f | wc -l)"
          actual="$(gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --json assets --jq '.assets | length')"
          test "$actual" -eq "$expected"
          gh release edit "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --draft=false