release.yml

# Release — verify a lockstep version tag and cut the GitHub Release.
#
# Trigger: tag `vX.Y.Z` pushed by mootx01-ee's sdk-publish workflow (or by
# scripts/lib_publish/publish-libraries.py run locally with --push).
# Verifies provenance and the locked Rust workspace, then creates the
# Release. SwiftPM consumers resolve directly from the tag.
#
# Security posture (SECURITY 8801aafe): `cargo check` runs arbitrary
# build-script / proc-macro code from the workspace and its locked
# dependencies. That code must NEVER run in a job that holds a
# contents:write token or a persisted checkout credential — a compromised
# build-time dependency could otherwise tamper with the repo or release.
# So the pipeline is split: a read-only `verify` job (contents:read,
# persist-credentials:false) runs the build checks, and only the minimal
# `release` job — which runs NO build code — is granted contents:write,
# and even it disables checkout credential persistence (gh authenticates
# via GH_TOKEN, not the git credential).

name: release

on:
  push:
    tags:
      - "v*"

# Default the whole workflow to read-only; the release job opts up narrowly.
permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # No write-scoped git credential is left in the local git config
          # while attacker-reachable Cargo build code runs below.
          persist-credentials: false
          # Full history so origin/main exists for the ancestry gate below.
          fetch-depth: 0

      # The publisher pushes branch + tag in one command, so a legitimate
      # release tag always points at a commit reachable from main. A v* tag
      # pushed on an unreviewed side commit fails here before anything builds.
      - name: Check tag commit is on main
        run: git merge-base --is-ancestor HEAD origin/main

      - name: Check generated provenance
        run: |
          test -f SOURCE.md
          test -f LICENSE
          test -f NOTICE
          grep -q "Generated by scripts/lib_publish/bootstrap-public-venues.py" SOURCE.md
          grep -q "Version: \`${GITHUB_REF_NAME#v}\`" SOURCE.md

      - name: Check Cargo workspace build
        run: |
          cargo metadata --locked --manifest-path Cargo.toml --no-deps --format-version 1 > /dev/null
          cargo check --workspace --locked

  release:
    runs-on: ubuntu-latest
    needs: verify
    # contents:write is scoped to THIS job only — after verify passes, and
    # in a job that runs no build-script / proc-macro code.
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          # gh authenticates via GH_TOKEN below, not the persisted git
          # credential, so there is no reason to leave one on disk.
          persist-credentials: false

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          notes="$(sed -n '/^# Source/,$p' SOURCE.md)"
          gh release create "$GITHUB_REF_NAME" \
            --verify-tag \
            --title "$GITHUB_REF_NAME" \
            --notes "$notes"