release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  # A manual run builds and checks the release on a branch. Every publish step is
  # gated on a tag, so nothing is published (ADR 0065 dry run).
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  # The test suite and the native-host compile run on the host, as they always
  # have. The container only builds, so the checks do not depend on its userland.
  test:
    runs-on: ubuntu-24.04
    timeout-minutes: 35
    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7.0.1
        with:
          persist-credentials: false

      - name: Install build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            python3 \
            libwebkit2gtk-4.1-dev \
            libgtk-3-dev \
            libsoup-3.0-dev \
            libjavascriptcoregtk-4.1-dev \
            curl \
            file \
            binutils \
            xdg-utils

      - name: Compile native host
        run: gcc -O2 native_host.c -o /tmp/native_host_check $(pkg-config --cflags --libs webkit2gtk-4.1)

      - name: Run test suite
        run: ./run_all_tests.sh

  build:
    needs: test
    strategy:
      fail-fast: false
      matrix:
        include:
          # x86_64 builds in an ubuntu:22.04 container on a supported 24.04 runner,
          # so the AppImage keeps the glibc 2.35 floor (ADR 0065). aarch64 uses
          # ubuntu-24.04-arm: ubuntu-22.04-arm deprecates 2026-09-17 (ADR 0024).
          # Each AppImage bundles its host interpreter, so the artifact arch
          # follows the runner arch.
          - arch: x86_64
            runner: ubuntu-24.04
          - arch: aarch64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    container: ubuntu:22.04
    # The container's /bin/sh is dash; the steps below use bash features.
    defaults:
      run:
        shell: bash
    timeout-minutes: 35
    permissions:
      contents: read

    steps:
      # The container ships none of these, and has no sudo. The build needs the
      # WebKit headers, as it did on the host.
      - name: Install container tools
        run: |
          apt-get update
          apt-get install -y --no-install-recommends \
            ca-certificates git python3 curl file binutils xdg-utils \
            build-essential pkg-config libwebkit2gtk-4.1-dev libgtk-3-dev \
            libsoup-3.0-dev libjavascriptcoregtk-4.1-dev
          # The checkout belongs to the runner user; git refuses it as root without this.
          git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7.0.1
        with:
          persist-credentials: false

      - name: Validate release tag
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          [[ "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$ ]] || {
            echo "invalid release tag: $GITHUB_REF_NAME" >&2
            exit 1
          }
          expected_version="$(python3 -c 'import updates; print(updates.VERSION)')"
          test "$GITHUB_REF_NAME" = "v$expected_version" || {
            echo "tag $GITHUB_REF_NAME does not match updates.py version $expected_version" >&2
            exit 1
          }

      - name: Build AppImage
        env:
          OPENBOX_APPDIR: ${{ runner.temp }}/OpenBox.AppDir
          OPENBOX_ARCH: ${{ matrix.arch }}
        run: ./build_appimage.sh "$PWD/OpenBox-${{ matrix.arch }}.AppImage"

      # The AppImage must not need a glibc newer than the 2.35 floor (ADR 0065).
      # Extract it and read the GLIBC_ symbol versions of every ELF file in it.
      - name: Check the glibc floor
        run: |
          set -euo pipefail
          ldd --version | head -1
          rm -rf squashfs-root
          "./OpenBox-${{ matrix.arch }}.AppImage" --appimage-extract >/dev/null
          highest=""
          while IFS= read -r file; do
            if file -b "$file" | grep -q '^ELF'; then
              versions="$(objdump -T "$file" 2>/dev/null | grep -oE 'GLIBC_[0-9.]+' || true)"
              if [ -n "$versions" ]; then
                highest="$(printf '%s\n%s\n' "$highest" "$versions" | sort -uV | tail -1)"
              fi
            fi
          done < <(find squashfs-root -type f)
          echo "highest GLIBC symbol version in the AppImage: $highest"
          test -n "$highest"
          test "$(printf '%s\n%s\n' "$highest" GLIBC_2.35 | sort -V | tail -1)" = GLIBC_2.35

      - name: Write SHA-256 checksum
        run: sha256sum "OpenBox-${{ matrix.arch }}.AppImage" | tee "OpenBox-${{ matrix.arch }}.AppImage.sha256"

      - name: Generate SBOM
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          # x86_64 keeps the legacy unprefixed SBOM name (OpenBox-<ver>-sbom.json)
          # matching all prior releases; aarch64 gets an arch-suffixed name so the
          # two SBOMs in a multi-arch release are distinct (ADR 0024).
          if [ "${{ matrix.arch }}" = "x86_64" ]; then
            sbom_name="OpenBox-$VERSION-sbom.json"
          else
            sbom_name="OpenBox-$VERSION-${{ matrix.arch }}-sbom.json"
          fi
          python3 scripts/gen_sbom.py \
            --version "$VERSION" \
            --appdir "${RUNNER_TEMP}/OpenBox.AppDir" \
            --out "$sbom_name"

      - name: Verify zsync metadata
        run: test -f "OpenBox-${{ matrix.arch }}.AppImage.zsync"

      - name: Upload unsigned build outputs
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # actions/upload-artifact@v7.0.2
        with:
          name: openbox-release-assets-${{ matrix.arch }}
          if-no-files-found: error
          retention-days: 7
          path: |
            OpenBox-${{ matrix.arch }}.AppImage
            OpenBox-${{ matrix.arch }}.AppImage.zsync
            OpenBox-${{ matrix.arch }}.AppImage.sha256
            OpenBox-*-sbom.json

  attest:
    if: startsWith(github.ref, 'refs/tags/')
    needs: build
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x86_64
          - arch: aarch64
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      actions: read
      contents: read
      id-token: write
      attestations: write

    steps:
      - name: Download build output
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # actions/download-artifact@v8.0.2
        with:
          name: openbox-release-assets-${{ matrix.arch }}

      - name: Attest build provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # actions/attest-build-provenance@v4.2.2
        with:
          subject-name: OpenBox-${{ matrix.arch }}.AppImage
          subject-path: OpenBox-${{ matrix.arch }}.AppImage

  build-windows:
    runs-on: windows-latest
    timeout-minutes: 30
    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7.0.1
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # actions/setup-python@v7.0.0
        with:
          python-version: "3.12"

      - name: Validate release tag
        if: startsWith(github.ref, 'refs/tags/')
        shell: pwsh
        run: |
          $tag = "${{ github.ref_name }}"
          if ($tag -notmatch '^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$') {
            throw "invalid release tag: $tag"
          }
          $expected = (python -B -c "import updates; print(updates.VERSION)").Trim()
          if ($tag -ne "v$expected") {
            throw "tag $tag does not match updates.py version $expected"
          }

      - name: Run test suite
        run: python -B scripts/run_windows_tests.py

      # The released zip carries the WebView2 host, so users get the native
      # window without a toolchain. Building it here also means a broken
      # native_host_win.c fails the release instead of shipping silently;
      # the windows CI job proves the same build on every push.
      - name: Build the WebView2 native host
        shell: pwsh
        run: |
          scripts/build_native_host_windows.ps1
          if (-not (Test-Path -LiteralPath native_host.exe)) {
            throw "native_host.exe was not produced; refusing to package a release without the Windows host"
          }

      - name: Package the portable release
        shell: pwsh
        run: |
          # One top-level folder so scripts/install.ps1 can lift the whole tree
          # into %LOCALAPPDATA%\OpenBox\share\openbox in a single move.
          $root = Join-Path $env:RUNNER_TEMP 'OpenBox-windows/OpenBox'
          New-Item -ItemType Directory -Path $root -Force | Out-Null
          $skip = @('.git', '.github', '.venv-dev', 'build', 'node_modules', '__pycache__', '.coverage')
          Get-ChildItem -Force -LiteralPath . |
            Where-Object { $skip -notcontains $_.Name } |
            ForEach-Object { Copy-Item -Recurse -Force -LiteralPath $_.FullName -Destination $root }
          Get-ChildItem -Recurse -Force -Directory -LiteralPath $root |
            Where-Object { $_.Name -eq '__pycache__' } |
            Remove-Item -Recurse -Force
          $asset = 'OpenBox-x86_64-windows.zip'
          Compress-Archive -Path $root -DestinationPath $asset -CompressionLevel Optimal
          # The native window is the point of the Windows build: fail the
          # release if the packaged tree does not carry the host binary.
          # Entry separators differ between Compress-Archive on PowerShell 5.1
          # ("\") and 7 ("/"), so normalize before comparing.
          Add-Type -AssemblyName System.IO.Compression.FileSystem
          $zip = [System.IO.Compression.ZipFile]::OpenRead((Resolve-Path -LiteralPath $asset))
          try {
            $hasHost = @($zip.Entries | Where-Object { ($_.FullName -replace '\\', '/') -eq 'OpenBox/native_host.exe' }).Count -eq 1
          } finally {
            $zip.Dispose()
          }
          if (-not $hasHost) {
            throw "the release archive is missing OpenBox/native_host.exe"
          }
          $digest = (Get-FileHash -Algorithm SHA256 -LiteralPath $asset).Hash.ToLower()
          # -NoNewline keeps this byte-identical to sha256sum output, which is
          # what the publish job validates it with.
          "$digest  $asset" | Set-Content -LiteralPath "$asset.sha256" -Encoding ascii -NoNewline
          # The same host binary also ships as its own asset for source
          # checkouts, which otherwise need MSVC plus the WebView2 SDK to get a
          # native window. Copied after the archive so the zip is unchanged.
          $hostAsset = 'OpenBox-x86_64-windows-native-host.exe'
          Copy-Item -LiteralPath 'native_host.exe' -Destination $hostAsset -Force
          $hostDigest = (Get-FileHash -Algorithm SHA256 -LiteralPath $hostAsset).Hash.ToLower()
          "$hostDigest  $hostAsset" | Set-Content -LiteralPath "$hostAsset.sha256" -Encoding ascii -NoNewline

      - name: Upload unsigned build outputs
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # actions/upload-artifact@v7.0.2
        with:
          name: openbox-release-assets-windows
          if-no-files-found: error
          retention-days: 7
          path: |
            OpenBox-x86_64-windows.zip
            OpenBox-x86_64-windows.zip.sha256
            OpenBox-x86_64-windows-native-host.exe
            OpenBox-x86_64-windows-native-host.exe.sha256

  attest-windows:
    if: startsWith(github.ref, 'refs/tags/')
    needs: build-windows
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      actions: read
      contents: read
      id-token: write
      attestations: write

    steps:
      - name: Download build output
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # actions/download-artifact@v8.0.2
        with:
          name: openbox-release-assets-windows

      - name: Attest build provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # actions/attest-build-provenance@v4.2.2
        with:
          subject-name: OpenBox-x86_64-windows.zip
          subject-path: OpenBox-x86_64-windows.zip

      - name: Attest the native host provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # actions/attest-build-provenance@v4.2.2
        with:
          subject-name: OpenBox-x86_64-windows-native-host.exe
          subject-path: OpenBox-x86_64-windows-native-host.exe

  publish:
    if: startsWith(github.ref, 'refs/tags/')
    needs: [build, attest, build-windows, attest-windows]
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    # AppImage, Windows and Flatpak publish jobs share one GitHub Release. Keep
    # the uploads serialized while allowing their build matrices to run in
    # parallel.
    concurrency:
      group: release-publish-${{ github.ref_name }}
      cancel-in-progress: false
    environment: release
    permissions:
      actions: read
      contents: write

    steps:
      - name: Checkout exact tagged commit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout@v7.0.1
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: Download build outputs
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # actions/download-artifact@v8.0.2
        with:
          pattern: openbox-release-assets-*
          merge-multiple: true

      - name: Validate annotated tag points at the build commit
        run: |
          test "$(git cat-file -t "$GITHUB_REF_NAME")" = tag
          test "$(git rev-parse "$GITHUB_REF_NAME^{}")" = "$GITHUB_SHA"

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # actions/setup-python@v7.0.0
        with:
          python-version: "3.12"

      - name: Install signing dependency
        run: python3 -m pip install --disable-pip-version-check cryptography==50.0.0

      - name: Sign and verify release artifacts
        env:
          OPENBOX_SIGNING_KEY: ${{ secrets.OPENBOX_SIGNING_KEY }}
        run: |
          set -euo pipefail
          test -n "${OPENBOX_SIGNING_KEY:-}" || {
            echo "OPENBOX_SIGNING_KEY is required; refusing to publish an unsigned release" >&2
            exit 1
          }
          umask 077
          key_file="$(mktemp)"
          public_key_file="$(mktemp)"
          trap 'rm -f -- "$key_file" "$public_key_file"' EXIT
          printf '%s' "$OPENBOX_SIGNING_KEY" > "$key_file"
          unset OPENBOX_SIGNING_KEY
          for arch in x86_64 aarch64; do
            appimage="OpenBox-$arch.AppImage"
            [ -f "$appimage" ] || {
              echo "missing build artifact: $appimage" >&2
              exit 1
            }
            python3 scripts/sign_release.py \
              --key "$key_file" \
              --public-key-out "$public_key_file" \
              --out "$appimage.sig" \
              "$appimage"
            cmp -s "$public_key_file" openbox-release.pub || {
              echo "OPENBOX_SIGNING_KEY does not match the committed release public key" >&2
              exit 1
            }
            sha256sum --check --strict "$appimage.sha256"
            python3 scripts/verify_release.py \
              --key openbox-release.pub \
              "$appimage" \
              "$appimage.sig"
          done
          # The Windows portable zip follows the same ladder: sign, confirm the
          # signing key is the committed release key, then verify.
          windows_asset="OpenBox-x86_64-windows.zip"
          [ -f "$windows_asset" ] || {
            echo "missing build artifact: $windows_asset" >&2
            exit 1
          }
          python3 scripts/sign_release.py \
            --key "$key_file" \
            --public-key-out "$public_key_file" \
            --out "$windows_asset.sig" \
            "$windows_asset"
          cmp -s "$public_key_file" openbox-release.pub || {
            echo "OPENBOX_SIGNING_KEY does not match the committed release public key" >&2
            exit 1
          }
          sha256sum --check --strict "$windows_asset.sha256"
          python3 scripts/verify_release.py \
            --key openbox-release.pub \
            "$windows_asset" \
            "$windows_asset.sig"
          # The standalone WebView2 host is the same binary the zip carries, so
          # it follows the same ladder rather than shipping unsigned.
          host_asset="OpenBox-x86_64-windows-native-host.exe"
          [ -f "$host_asset" ] || {
            echo "missing build artifact: $host_asset" >&2
            exit 1
          }
          python3 scripts/sign_release.py \
            --key "$key_file" \
            --public-key-out "$public_key_file" \
            --out "$host_asset.sig" \
            "$host_asset"
          cmp -s "$public_key_file" openbox-release.pub || {
            echo "OPENBOX_SIGNING_KEY does not match the committed release public key" >&2
            exit 1
          }
          sha256sum --check --strict "$host_asset.sha256"
          python3 scripts/verify_release.py \
            --key openbox-release.pub \
            "$host_asset" \
            "$host_asset.sig"
          cp scripts/install.sh install.sh
          cp scripts/install.ps1 install.ps1

      - name: Build, sign, and verify the emulator definition pack
        env:
          GH_TOKEN: ${{ github.token }}
          OPENBOX_SIGNING_KEY: ${{ secrets.OPENBOX_SIGNING_KEY }}
        run: |
          set -euo pipefail
          test -n "${OPENBOX_SIGNING_KEY:-}" || {
            echo "OPENBOX_SIGNING_KEY is required; the definition pack must be signed" >&2
            exit 1
          }
          umask 077
          key_file="$(mktemp)"
          pack_dir="$(mktemp -d)"
          trap 'rm -f -- "$key_file"; rm -rf -- "$pack_dir"' EXIT
          printf '%s' "$OPENBOX_SIGNING_KEY" > "$key_file"
          unset OPENBOX_SIGNING_KEY
          version="${GITHUB_REF_NAME#v}"
          python3 scripts/build_defs_pack.py --version "$version" \
            --notes "Emulator definitions for OpenBox $version" --out "$pack_dir"
          python3 scripts/sign_release.py --key "$key_file" \
            --out "$pack_dir/community-defs.tar.gz.sig" "$pack_dir/community-defs.tar.gz"
          python3 scripts/verify_release.py --key openbox-release.pub \
            "$pack_dir/community-defs.tar.gz" "$pack_dir/community-defs.tar.gz.sig"
          # The update channel reads the rolling emulator-defs release (PACK_BASE), not the version release.
          gh release view emulator-defs >/dev/null 2>&1 || gh release create emulator-defs \
            --title "Emulator definitions" \
            --notes "Signed emulator definitions. OpenBox checks this release for updates." \
            --latest=false
          gh release upload emulator-defs \
            "$pack_dir/community-defs.tar.gz" \
            "$pack_dir/community-defs.tar.gz.sig" \
            "$pack_dir/index.json" --clobber

      - name: Compute release name
        id: relname
        run: echo "name=OpenBox ${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Create release and upload signed assets
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # softprops/action-gh-release@v3.0.3
        with:
          tag_name: ${{ github.ref_name }}
          target_commitish: ${{ github.sha }}
          name: ${{ steps.relname.outputs.name }}
          body_path: docs/RELEASE_NOTES.md
          generate_release_notes: false
          prerelease: ${{ contains(github.ref_name, '-') }}
          fail_on_unmatched_files: true
          overwrite_files: false
          files: |
            OpenBox-x86_64.AppImage
            OpenBox-x86_64.AppImage.zsync
            OpenBox-x86_64.AppImage.sha256
            OpenBox-x86_64.AppImage.sig
            OpenBox-aarch64.AppImage
            OpenBox-aarch64.AppImage.zsync
            OpenBox-aarch64.AppImage.sha256
            OpenBox-aarch64.AppImage.sig
            OpenBox-x86_64-windows.zip
            OpenBox-x86_64-windows.zip.sha256
            OpenBox-x86_64-windows.zip.sig
            OpenBox-x86_64-windows-native-host.exe
            OpenBox-x86_64-windows-native-host.exe.sha256
            OpenBox-x86_64-windows-native-host.exe.sig
            openbox-release.pub
            install.sh
            install.ps1
            OpenBox-*-sbom.json