on:
  push:
    tags: '[0-9]+.[0-9]+.[0-9]+'


permissions: read-all

env:
  RELEASE_NAME: "${{ github.event.repository.name }}-${{ github.ref_name }}"

jobs:
  # This step builds our artifacts, uploads them to the workflow run, and
  # outputs their digest.
  build:
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
      release-name: ${{ steps.export-name.outputs.release-name }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Build artifacts
        run: |
          git archive --prefix=$RELEASE_NAME/ -o $RELEASE_NAME.zip HEAD
          git archive --prefix=$RELEASE_NAME/ -o $RELEASE_NAME.tar.gz HEAD

      - name: Generate hashes
        shell: bash
        id: hash
        run: |
          # sha256sum generates sha256 hash for all artifacts.
          # base64 -w0 encodes to base64 and outputs on a single line.
          sha256sum $RELEASE_NAME.zip $RELEASE_NAME.tar.gz > $RELEASE_NAME-SHA-256.txt
          echo "hashes=$(base64 -w0 $RELEASE_NAME-SHA-256.txt)" >> "$GITHUB_OUTPUT"

      - name: Export release name
        shell: bash
        id: export-name
        run: |
          echo "release-name=$RELEASE_NAME" >> "$GITHUB_OUTPUT"

      - name: Upload artifacts
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-artifacts
          path: ${{ env.RELEASE_NAME }}*
          if-no-files-found: error
          retention-days: 5

  # This step calls the generic workflow to generate provenance.
  provenance:
    needs: [build]
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: "${{ needs.build.outputs.hashes }}"
      # Upload provenance to a new release
      upload-assets: true
      provenance-name: "${{ needs.build.outputs.release-name }}.intoto.jsonl"

  # This step uploads our artifacts to the tagged GitHub release.
  release:
    needs: [build, provenance]
    permissions:
      contents: write
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    env:
      DOWNLOAD_URL: "${{ github.server_url }}/${{ github.repository }}/releases/download/${{ github.ref_name }}"
      RELEASE_NAME: "${{ needs.build.outputs.release-name }}"
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: release-artifacts
      - name: Upload assets
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          body: |
            tag: ${{ github.ref_name }}
            date: YYYY-MM-DD

            ## Source distributions:
            Platform | Files
            --- | ---
            Unix/Linux | [${{ env.RELEASE_NAME }}.tar.gz](${{ env.DOWNLOAD_URL }}/${{ env.RELEASE_NAME }}.tar.gz)
            Windows | [${{ env.RELEASE_NAME }}.zip](${{ env.DOWNLOAD_URL }}/${{ env.RELEASE_NAME }}.zip)

            ## Summary files:
            Role | Files
            --- | ---
            Cryptographic hashes | [${{ env.RELEASE_NAME }}-SHA-256.txt](${{ env.DOWNLOAD_URL }}/${{ env.RELEASE_NAME }}-SHA-256.txt)
            Digitally signed with \[INSERT SHORT KEY ID\] | [${{ env.RELEASE_NAME }}-SHA-256.txt.asc](${{ env.DOWNLOAD_URL }}/${{ env.RELEASE_NAME }}-SHA-256.txt.asc)
            SLSA provenance | [${{ env.RELEASE_NAME }}.intoto.jsonl](${{ env.DOWNLOAD_URL }}/${{ env.RELEASE_NAME }}.intoto.jsonl)
          files: |
            ${{ env.RELEASE_NAME }}.zip
            ${{ env.RELEASE_NAME }}.tar.gz
            ${{ env.RELEASE_NAME }}-SHA-256.txt