release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: 1.27.2
          cache: true
          cache-dependency-path: go.sum
      - name: Run the complete release gate
        run: |
          make check
          make container-image-check

  build:
    needs: verify
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    strategy:
      matrix:
        include:
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64
          - goos: darwin
            goarch: arm64
          - goos: windows
            goarch: amd64
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: 1.27.2
          cache: true
          cache-dependency-path: go.sum
      - name: Build reproducible release assets
        shell: bash
        env:
          TARGET_OS: ${{ matrix.goos }}
          TARGET_ARCH: ${{ matrix.goarch }}
        run: |
          set -euo pipefail
          export LC_ALL=C TZ=UTC
          epoch="$(git show -s --format=%ct HEAD)"
          commit="$(git rev-parse HEAD)"
          build_date="$(date -u -d "@${epoch}" +%Y-%m-%dT%H:%M:%SZ)"
          package="moto_${GITHUB_REF_NAME}_${TARGET_OS}_${TARGET_ARCH}"
          binary="moto"
          if [[ "${TARGET_OS}" == "windows" ]]; then binary="moto.exe"; fi
          package_dir="stage/${package}"
          mkdir -p dist "${package_dir}/config" "${package_dir}/packaging"
          CGO_ENABLED=0 GOOS="${TARGET_OS}" GOARCH="${TARGET_ARCH}" \
            go build -trimpath -buildvcs=false \
            -ldflags "-s -w -buildid= -X main.version=${GITHUB_REF_NAME} -X main.commit=${commit} -X main.buildDate=${build_date}" \
            -o "${package_dir}/${binary}" .
          install -m 0644 README.md LICENSE THIRD_PARTY_NOTICES "${package_dir}/"
          install -m 0644 config/setting.json "${package_dir}/config/"
          install -m 0644 packaging/moto.service "${package_dir}/packaging/"
          tar --sort=name --mtime="@${epoch}" --owner=0 --group=0 --numeric-owner \
            -C stage -cf - "${package}" | gzip -n > "dist/${package}.tar.gz"

          tool_dir="$(mktemp -d)"
          raw_sbom="${tool_dir}/${package}.raw.cdx.json"
          sbom="dist/${package}.sbom.cdx.json"
          GOBIN="${tool_dir}" go install \
            github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@v1.9.0
          CGO_ENABLED=0 GOOS="${TARGET_OS}" GOARCH="${TARGET_ARCH}" \
            "${tool_dir}/cyclonedx-gomod" mod -json -licenses -noserial \
            -output "${raw_sbom}" .
          python3 - "${raw_sbom}" "${sbom}" "${build_date}" \
            "${GITHUB_REF_NAME}" "${TARGET_OS}" "${TARGET_ARCH}" <<'PY'
          import json
          import pathlib
          import sys

          raw_path = pathlib.Path(sys.argv[1])
          output_path = pathlib.Path(sys.argv[2])
          timestamp, release, target_os, target_arch = sys.argv[3:]
          document = json.loads(raw_path.read_text(encoding="utf-8"))
          document["metadata"]["timestamp"] = timestamp
          component = document["metadata"]["component"]
          if component.get("version") != release:
              raise SystemExit(
                  f"SBOM version {component.get('version')!r} does not match release {release!r}"
              )
          purl = component.get("purl", "")
          required = (f"goos={target_os}", f"goarch={target_arch}")
          if any(value not in purl for value in required):
              raise SystemExit(f"SBOM platform does not match {target_os}/{target_arch}: {purl}")
          output_path.write_text(
              json.dumps(document, ensure_ascii=False, indent=2) + "\n",
              encoding="utf-8",
          )
          raw_path.unlink()
          PY
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: moto-${{ matrix.goos }}-${{ matrix.goarch }}
          path: dist/*
          if-no-files-found: error

  publish:
    needs: [verify, build]
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: moto-*
          path: dist
          merge-multiple: true
      - name: Verify release assets
        shell: bash
        run: |
          set -euo pipefail
          targets=(darwin_arm64 linux_amd64 linux_arm64 windows_amd64)
          for target in "${targets[@]}"; do
            package="moto_${GITHUB_REF_NAME}_${target}"
            archive="dist/${package}.tar.gz"
            binary="moto"
            if [[ "${target}" == windows_* ]]; then binary="moto.exe"; fi
            test -s "${archive}"
            test -s "dist/moto_${GITHUB_REF_NAME}_${target}.sbom.cdx.json"

            top_levels="$(tar -tzf "${archive}" | cut -d/ -f1 | LC_ALL=C sort -u)"
            test "${top_levels}" = "${package}"
            actual="$(tar -tzf "${archive}" | sed '/\/$/d' | LC_ALL=C sort)"
            expected="$(printf '%s\n' \
              "${package}/${binary}" \
              "${package}/LICENSE" \
              "${package}/README.md" \
              "${package}/THIRD_PARTY_NOTICES" \
              "${package}/config/setting.json" \
              "${package}/packaging/moto.service" | LC_ALL=C sort)"
            test "${actual}" = "${expected}"
          done
          python3 packaging/bundle_sbom.py dist "${GITHUB_REF_NAME}"
          test "$(find dist -maxdepth 1 -type f | wc -l)" -eq 5
      - name: Generate checksums
        run: |
          set -euo pipefail
          cd dist
          export LC_ALL=C
          sha256sum -- * > SHA256SUMS
      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "${GITHUB_REF_NAME}" dist/* --verify-tag --generate-notes --title "${GITHUB_REF_NAME}"