WuKongIM/.github/workflows/go-ossf-slsa3-publish.yml

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# This workflow lets you compile your Go project using a SLSA3 compliant builder. 
# This workflow will generate a so-called "provenance" file describing the steps 
# that were performed to generate the final binary.
# The project is an initiative of the OpenSSF (openssf.org) and is developed at 
# https://github.com/slsa-framework/slsa-github-generator.
# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier.
# For more information about SLSA and how it improves the supply-chain, visit slsa.dev.

name: SLSA Go releaser
on:
  workflow_dispatch:
  release:
    types: [created]

permissions: read-all

jobs:
  # Extract changelog content for the release version
  changelog:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      release-notes: ${{ steps.extract.outputs.notes }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Extract changelog for version
        id: extract
        run: |
          # Get the version from the tag (e.g., v2.2.1-20250624)
          VERSION="${GITHUB_REF_NAME}"
          echo "Extracting changelog for version: $VERSION"

          # Create a script to extract the changelog section
          cat > extract_changelog.sh << 'SCRIPT'
          #!/bin/bash
          VERSION="$1"
          CHANGELOG_FILE="CHANGELOG.md"

          # Find the line number where this version starts
          START_LINE=$(grep -n "^## \[$VERSION\]" "$CHANGELOG_FILE" | cut -d: -f1)

          if [ -z "$START_LINE" ]; then
            echo "Warning: Version $VERSION not found in CHANGELOG.md"
            echo "## Release $VERSION" > release_notes.md
            echo "" >> release_notes.md
            echo "See [CHANGELOG.md](https://github.com/$GITHUB_REPOSITORY/blob/$VERSION/CHANGELOG.md) for details." >> release_notes.md
            exit 0
          fi

          # Find the line number where the next version starts (or end of file)
          NEXT_VERSION_LINE=$(tail -n +$((START_LINE + 1)) "$CHANGELOG_FILE" | grep -n "^## \[" | head -1 | cut -d: -f1)

          if [ -z "$NEXT_VERSION_LINE" ]; then
            # No next version found, extract to end of file
            sed -n "${START_LINE},\$p" "$CHANGELOG_FILE" > release_notes.md
          else
            # Calculate the actual line number
            END_LINE=$((START_LINE + NEXT_VERSION_LINE - 1))
            # Extract the section, excluding the next version header
            sed -n "${START_LINE},$((END_LINE - 1))p" "$CHANGELOG_FILE" > release_notes.md
          fi

          # Remove the version header line
          sed -i '1d' release_notes.md

          # Remove trailing --- separators
          sed -i '/^---$/d' release_notes.md

          # Remove trailing empty lines using awk (more portable)
          awk 'NF {p=1} p' release_notes.md > release_notes.tmp && mv release_notes.tmp release_notes.md
          SCRIPT

          chmod +x extract_changelog.sh
          ./extract_changelog.sh "$VERSION"

          # Check if extraction was successful
          if [ -f release_notes.md ]; then
            echo "Successfully extracted changelog"
            cat release_notes.md

            # Save to output using heredoc to handle multiline content
            {
              echo 'notes<<EOF'
              cat release_notes.md
              echo EOF
            } >> "$GITHUB_OUTPUT"
          else
            echo "Failed to extract changelog"
            echo "notes=## Release $VERSION" >> "$GITHUB_OUTPUT"
          fi

      - name: Update release with changelog
        if: github.event_name == 'release'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Update the release body with the extracted changelog
          gh release edit "$GITHUB_REF_NAME" \
            --notes-file release_notes.md \
            --repo "$GITHUB_REPOSITORY"

  # Generate ldflags dynamically.
  # Optional: only needed for ldflags.
  args:
    needs: changelog
    runs-on: ubuntu-latest
    outputs:
      commit-date: ${{ steps.ldflags.outputs.commit-date }}
      commit: ${{ steps.ldflags.outputs.commit }}
      version: ${{ steps.ldflags.outputs.version }}
      tree-state: ${{ steps.ldflags.outputs.tree-state }}
    steps:
      - id: checkout
        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # tag=v2.3.4
        with:
          fetch-depth: 0
      - id: ldflags
        run: |
          echo "commit-date=$(git log --date=iso8601-strict -1 --pretty=%ct)" >> "$GITHUB_OUTPUT"
          echo "commit=$GITHUB_SHA" >> "$GITHUB_OUTPUT"
          echo "version=$(git describe --tags --always --dirty | cut -c2-)" >> "$GITHUB_OUTPUT"
          echo "tree-state=$(if git diff --quiet; then echo "clean"; else echo "dirty"; fi)" >> "$GITHUB_OUTPUT"
  # Trusted builder.
  build:
    permissions:
      id-token: write # To sign the provenance.
      contents: write # To upload assets to release.
      actions: read # To read the workflow path.
    needs: args
    strategy:
      matrix:
        os:
          - linux
          - darwin
        arch:
          - amd64
          - arm64
    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v2.0.0
    with:
      go-version: ">=1.22.0"
      # Optional: only needed if using ldflags.
      evaluated-envs: "COMMIT_DATE:${{needs.args.outputs.commit-date}}, COMMIT:${{needs.args.outputs.commit}}, VERSION:${{needs.args.outputs.version}}, TREE_STATE:${{needs.args.outputs.tree-state}}"
      config-file: slsa/goreleaser-${{matrix.os}}-${{matrix.arch}}.yml

  verification:
    needs:
      - build
    runs-on: ubuntu-latest
    permissions: read-all
    steps:
      - name: Install the verifier
        uses: slsa-framework/slsa-verifier/actions/installer@v2.6.0

      - name: Download assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ATT_FILE_NAME: "${{ needs.build.outputs.go-binary-name }}.intoto.jsonl"
          ARTIFACT: ${{ needs.build.outputs.go-binary-name }}
        run: |
          set -euo pipefail
          gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p $ARTIFACT
          gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "$ATT_FILE_NAME"
      - name: Verify assets
        env:
          ARTIFACT: ${{ needs.build.outputs.go-binary-name }}
          ATT_FILE_NAME: "${{ needs.build.outputs.go-binary-name }}.intoto.jsonl"
        run: |
          set -euo pipefail
              
          echo "Verifying $ARTIFACT using $ATT_FILE_NAME"
          slsa-verifier verify-artifact --provenance-path "$ATT_FILE_NAME" \
                                        --source-uri "github.com/$GITHUB_REPOSITORY" \
                                        --source-tag "$GITHUB_REF_NAME" \
                                        "$ARTIFACT"