release.yml

name: Release still-ui

# A version tag builds the Linux amd64 and arm64 archives with
# scripts/still-release.sh (the same script a maintainer runs by hand; it builds
# still-ui's patched Xray from source and refuses any sum but the pinned one),
# writes an SPDX SBOM per archive and SHA256SUMS, attests build provenance and
# the SBOMs, and publishes everything on the GitHub release of that tag. The
# scripts that run as root (install.sh, update.sh, x-ui.sh, migrate.sh) are
# release files too: listed in SHA256SUMS and attested, so the panel updater
# and the still-ui menu install from a release, never from a branch.
# workflow_dispatch only builds and uploads the files as a workflow artifact.
on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:

permissions: {}

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # No write token and no cache: everything this job downloads (npm packages,
  # toolchains, geo files) runs or lands here, so it gets read access only.
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 75
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: The tag must be the version in internal/config/version
        if: github.ref_type == 'tag'
        env:
          TAG: ${{ github.ref_name }}
        run: |
          version=$(tr -d '[:space:]' < internal/config/version)
          if [ "$TAG" != "v${version}" ]; then
            echo "::error::Tag ${TAG} does not match internal/config/version (${version}); expected v${version}."
            exit 1
          fi

      - name: Build the archives (scripts/still-release.sh)
        run: scripts/still-release.sh dist amd64 arm64

      - name: SBOMs and SHA256SUMS (scripts/still-sbom.sh)
        run: scripts/still-sbom.sh dist

      - name: Summary
        run: |
          {
            echo '### still-ui release files'
            echo
            echo '```'
            cat dist/SHA256SUMS
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: still-ui-release
          path: |
            dist/still-ui-linux-*.tar.gz
            dist/still-ui-linux-*.tar.gz.sha256
            dist/still-ui-linux-*.tar.gz.spdx.json
            dist/still-probe-linux-*.tar.gz
            dist/still-probe-linux-*.tar.gz.sha256
            dist/install.sh
            dist/update.sh
            dist/x-ui.sh
            dist/migrate.sh
            dist/SHA256SUMS
          if-no-files-found: error
          retention-days: 14

  # Checks out and runs no repository code: it only attests the files the build
  # job produced and attaches them to the release.
  publish:
    needs: build
    if: github.event_name == 'push' && github.ref_type == 'tag'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write
      id-token: write
      attestations: write
    env:
      GH_TOKEN: ${{ github.token }}
      REPO: ${{ github.repository }}
      TAG: ${{ github.ref_name }}
    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: still-ui-release
          path: dist

      - name: Check the files against SHA256SUMS
        working-directory: dist
        run: |
          sha256sum -c SHA256SUMS
          for f in still-ui-linux-*.tar.gz still-probe-linux-*.tar.gz; do sha256sum -c "$f.sha256"; done

      - name: Attest build provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: |
            dist/still-ui-linux-amd64.tar.gz
            dist/still-ui-linux-arm64.tar.gz
            dist/still-probe-linux-amd64.tar.gz
            dist/still-probe-linux-arm64.tar.gz
            dist/install.sh
            dist/update.sh
            dist/x-ui.sh
            dist/migrate.sh
            dist/SHA256SUMS

      # actions/attest is what actions/attest-sbom wraps since v4 (the wrapper is
      # deprecated); sbom-path makes an SPDX SBOM attestation for the subject.
      - name: Attest the amd64 SBOM
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: dist/still-ui-linux-amd64.tar.gz
          sbom-path: dist/still-ui-linux-amd64.tar.gz.spdx.json

      - name: Attest the arm64 SBOM
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: dist/still-ui-linux-arm64.tar.gz
          sbom-path: dist/still-ui-linux-arm64.tar.gz.spdx.json

      # An existing release (for example a draft with hand-written notes) gets
      # the files; otherwise the release is created with every file at once, so
      # it is never public with only some of them.
      - name: Create or update the GitHub release
        run: |
          set -euo pipefail
          files=(dist/still-ui-linux-*.tar.gz dist/still-ui-linux-*.tar.gz.sha256 dist/still-ui-linux-*.tar.gz.spdx.json dist/still-probe-linux-*.tar.gz dist/still-probe-linux-*.tar.gz.sha256 dist/install.sh dist/update.sh dist/x-ui.sh dist/migrate.sh dist/SHA256SUMS)
          if gh release view "$TAG" -R "$REPO" >/dev/null 2>&1; then
            gh release upload "$TAG" -R "$REPO" --clobber "${files[@]}"
          else
            notes=$(mktemp)
            cat > "$notes" <<EOF
          still-ui ${TAG#v}. Built by GitHub Actions from ${GITHUB_SHA}: run ${GITHUB_SERVER_URL}/${REPO}/actions/runs/${GITHUB_RUN_ID}.

          Verify a downloaded archive: \`gh attestation verify still-ui-linux-amd64.tar.gz -R ${REPO}\` and \`sha256sum -c SHA256SUMS --ignore-missing\`. See "Verify a release" in the README.
          EOF
            gh release create "$TAG" -R "$REPO" --verify-tag --title "still-ui ${TAG#v}" --notes-file "$notes" "${files[@]}"
          fi