release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (e.g., v1.0.0)'
        required: true
        type: string

permissions: read-all

jobs:
  release:
    name: Create Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: read
      id-token: write       # Required for Sigstore keyless signing
      attestations: write   # Required for actions/attest-build-provenance (SLSA L2)
    
    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

      # Enforce the signed-tag policy from docs/RELEASING.md.
      # Tags from v0.3.0 forward MUST be cryptographically signed (gitsign or GPG).
      # Older tags (v0.2.x) predate the policy and are exempted by the version check.
      # We check the tag object for a signature block (PGP or x509). Full
      # cryptographic verification is the maintainer's responsibility before
      # pushing — the workflow's role is to enforce the policy, not to act as
      # the trust anchor.
      - name: Verify release tag is signed
        if: github.event_name == 'push'
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          MAJOR_MINOR=$(echo "$TAG" | sed -E 's/^v([0-9]+\.[0-9]+).*/\1/')
          require=$(awk -v v="$MAJOR_MINOR" 'BEGIN{ split(v,p,"."); print (p[1]>0 || p[2]>=3) ? "yes" : "no" }')
          if [ "$require" = "no" ]; then
            echo "Tag $TAG predates the signed-tag policy (floor: v0.3.0). Skipping signature check."
            exit 0
          fi
          if git cat-file -p "$TAG" | grep -qE '^-----BEGIN (PGP SIGNATURE|SIGNED MESSAGE|SSH SIGNATURE)-----'; then
            echo "Tag $TAG has a signature block. Policy satisfied."
          else
            echo "::error::Tag $TAG is not signed. See docs/RELEASING.md § Signed tags for one-time gitsign/GPG setup."
            exit 1
          fi

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      # Match CI gates: lint, typecheck, tests + coverage, Firestore rules, validate-env + build
      - name: Run linter
        run: npm run lint

      - name: Run type check
        run: npm run type-check

      - name: Run tests with coverage
        run: npm run test:coverage
        env:
          CI: true

      - name: Setup Java (Firestore emulator)
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          distribution: 'temurin'
          java-version: '21'

      - name: Run Firestore rules tests
        run: npm run test:rules
        env:
          CI: true

      - name: Validate environment variables
        run: npm run validate-env
        env:
          NEXT_PUBLIC_FIREBASE_API_KEY: "release-build"
          NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN: "release.firebaseapp.com"
          NEXT_PUBLIC_FIREBASE_PROJECT_ID: "release-build"
          NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET: "release.appspot.com"
          NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID: "000000000000"
          NEXT_PUBLIC_FIREBASE_APP_ID: "1:000000000000:web:release"
          NEXT_PUBLIC_FIREBASE_DATABASE_URL: "https://release.firebaseio.com"
          UNSUBSCRIBE_SECRET: "release-unsubscribe-secret-32-bytes-only"

      - name: Build application
        run: npm run build
        env:
          NEXT_PUBLIC_FIREBASE_API_KEY: "release-build"
          NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN: "release.firebaseapp.com"
          NEXT_PUBLIC_FIREBASE_PROJECT_ID: "release-build"
          NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET: "release.appspot.com"
          NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID: "000000000000"
          NEXT_PUBLIC_FIREBASE_APP_ID: "1:000000000000:web:release"
          NEXT_PUBLIC_FIREBASE_DATABASE_URL: "https://release.firebaseio.com"
          UNSUBSCRIBE_SECRET: "release-unsubscribe-secret-32-bytes-only"

      - name: Generate CycloneDX SBOM
        run: npx @cyclonedx/cyclonedx-npm --output-file sbom.json --output-format json

      - name: Generate SPDX SBOM
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
        with:
          path: .
          format: spdx-json
          output-file: sbom.spdx.json
          upload-artifact: false
          upload-release-assets: false

      - name: Generate changelog
        id: changelog
        uses: mikepenz/release-changelog-builder-action@348e88fab4c37338b1e803ceb2d4a7a5db6c0833 # v6.2.2
        with:
          configuration: |
            {
              "categories": [
                {
                  "title": "## 🚀 Features",
                  "labels": ["feature", "enhancement"]
                },
                {
                  "title": "## 🐛 Bug Fixes",
                  "labels": ["bug", "fix"]
                },
                {
                  "title": "## 📚 Documentation",
                  "labels": ["documentation", "docs"]
                },
                {
                  "title": "## 🔧 Maintenance",
                  "labels": ["chore", "maintenance", "dependencies"]
                },
                {
                  "title": "## 🔒 Security",
                  "labels": ["security"]
                }
              ],
              "template": "#{{CHANGELOG}}\n\n**Full Changelog**: #{{RELEASE_DIFF}}\n",
              "pr_template": "- #{{TITLE}} (#{{NUMBER}}) by @#{{AUTHOR}}"
            }
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create GitHub Release
        id: create_release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
        with:
          tag_name: ${{ github.event.inputs.version || github.ref_name }}
          name: Release ${{ github.event.inputs.version || github.ref_name }}
          body: |
            ## What's Changed
            
            ${{ steps.changelog.outputs.changelog }}
            
            ## Installation
            
            ```bash
            git clone https://github.com/${{ github.repository }}.git
            cd cursor-boston
            git checkout ${{ github.event.inputs.version || github.ref_name }}
            npm install
            ```
            
            See the [README](https://github.com/rogerSuperBuilderAlpha/cursor-boston#readme) for full setup instructions.
          files: |
            sbom.json
            sbom.spdx.json
          draft: false
          prerelease: ${{ contains(github.ref_name, '-alpha') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-rc') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      # Generate a reproducible source archive of the tag and sign it so
      # downstream consumers (and OpenSSF Scorecard's Signed-Releases
      # check) have a cryptographically verifiable artifact to attach
      # trust to. GitHub's auto-generated source-code zip/tar is not
      # signed and Scorecard correctly flags releases that lack a
      # signature file.
      - name: Build signed source archive
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${{ github.event.inputs.version || github.ref_name }}"
          ARCHIVE="cursor-boston-${TAG}.tar.gz"
          # --prefix matches GitHub's default archive layout so consumers
          # can swap our signed archive in without changing their unpack
          # flow. Built from HEAD (= tagged commit) for byte-equivalence.
          git archive --format=tar.gz --prefix="cursor-boston-${TAG}/" \
            -o "$ARCHIVE" HEAD
          cosign sign-blob --yes \
            --bundle "${ARCHIVE}.cosign.bundle" \
            "$ARCHIVE"
          gh release upload "$TAG" \
            "$ARCHIVE" \
            "${ARCHIVE}.cosign.bundle" \
            --repo "${{ github.repository }}"

      - name: Sign release SBOMs
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${{ github.event.inputs.version || github.ref_name }}"
          # cosign v2 deprecated --output-signature / --output-certificate in
          # favor of a single --bundle file that contains both. Use the new
          # bundle format for both SBOMs.
          cosign sign-blob --yes \
            --bundle sbom.json.cosign.bundle \
            sbom.json
          cosign sign-blob --yes \
            --bundle sbom.spdx.json.cosign.bundle \
            sbom.spdx.json
          gh release upload "$TAG" \
            sbom.json.cosign.bundle \
            sbom.spdx.json.cosign.bundle \
            --repo "${{ github.repository }}"

      - name: Attest SLSA build provenance for release artifacts
        id: attest
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-path: |
            cursor-boston-${{ github.event.inputs.version || github.ref_name }}.tar.gz
            sbom.json
            sbom.spdx.json

      # Attach the SLSA provenance bundle to the GitHub release so it's
      # discoverable from the release page (and by OpenSSF Scorecard's
      # Signed-Releases check, which scans release assets for
      # provenance-shaped files).
      - name: Upload SLSA provenance bundle to release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${{ github.event.inputs.version || github.ref_name }}"
          BUNDLE="${{ steps.attest.outputs.bundle-path }}"
          if [ -n "$BUNDLE" ] && [ -f "$BUNDLE" ]; then
            cp "$BUNDLE" "cursor-boston-${TAG}.intoto.jsonl"
            gh release upload "$TAG" \
              "cursor-boston-${TAG}.intoto.jsonl" \
              --repo "${{ github.repository }}"
          else
            echo "::warning::attest-build-provenance produced no bundle file; skipping upload"
          fi

  notify:
    name: Notify Release
    runs-on: ubuntu-latest
    needs: release
    if: success()
    
    steps:
      - name: Post release summary
        run: |
          echo "🎉 Release ${{ github.event.inputs.version || github.ref_name }} published successfully!"
          echo "📦 View release: https://github.com/rogerSuperBuilderAlpha/cursor-boston/releases/tag/${{ github.event.inputs.version || github.ref_name }}"