name: "Standalone: Release tarball"

# The tarballs build without a write token. The release job, which runs no
# checked-out code, publishes each one with a `.sha256` next to it and a
# signed build provenance attestation:
# `gh attestation verify <tarball> --repo bulwarkmail/webmail`.

on:
  release:
    name: Attach to release
    types: [published]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    name: Build (${{ matrix.arch }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            arch: amd64
          - os: ubuntu-24.04-arm
            arch: arm64
    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Build standalone
        run: npm run build

      - name: Package tarball
        env:
          REF_NAME: ${{ github.ref_name }}
          ARCH: ${{ matrix.arch }}
        run: |
          VERSION="${REF_NAME#v}"
          TARBALL="bulwark-standalone-${VERSION}-linux-${ARCH}.tar.gz"

          mkdir -p bulwark-standalone
          cp -r .next/standalone/. bulwark-standalone/
          cp -r .next/static bulwark-standalone/.next/static
          cp -r public bulwark-standalone/public

          tar -czf "$TARBALL" bulwark-standalone/
          echo "TARBALL=$TARBALL" >> "$GITHUB_ENV"

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: standalone-${{ matrix.arch }}
          path: ${{ env.TARBALL }}
          if-no-files-found: error
          retention-days: 7

  release:
    name: Attach to release
    needs: build
    if: github.event_name == 'release'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - name: Download tarballs
        uses: actions/download-artifact@v8
        with:
          pattern: standalone-*
          path: tarballs
          merge-multiple: true

      - name: Checksum tarballs
        working-directory: tarballs
        run: for tarball in *.tar.gz; do sha256sum "$tarball" > "$tarball.sha256"; done

      - name: Attest build provenance
        uses: actions/attest@v4
        with:
          subject-path: tarballs/*.tar.gz

      - name: Upload release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          TAG_NAME: ${{ github.event.release.tag_name }}
        run: gh release upload "$TAG_NAME" tarballs/*.tar.gz tarballs/*.tar.gz.sha256 --clobber