release.yml

name: Release
on:
  push:
    tags:
      - v*
  workflow_dispatch:
    inputs: {}
env:
  CIBW_BUILD: "c39-* cp310-* cp311-* cp312-*"
jobs:
  Build-Linux:
    strategy:
      matrix:
        include:
          - runner: ubuntu-latest
            cibw_arch: arm64
            go_arch: arm64
          - runner: ubuntu-latest
            cibw_arch: x86_64
            go_arch: amd64
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
      - name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3
        with:
          platforms: arm64
      - name: Set up Go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
        with:
          go-version: "1.21.5"
          cache: true
          cache-dependency-path: "gotfparse/go.sum"
      - name: Build wheels
        uses: pypa/cibuildwheel@fff9ec32ed25a9c576750c91e06b410ed0c15db7
        env:
          CIBW_ENVIRONMENT: PATH=$(pwd)/go/bin:$PATH
          CIBW_BEFORE_ALL: sh ci-setup-golang.sh
          CIBW_SKIP: "*musllinux*"
          CIBW_ARCHS: ${{ matrix.cibw_arch }}
      - name: Upload Artifacts
        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392
        with:
          name: wheels-linux-${{ matrix.cibw_arch }}
          path: ./wheelhouse/*.whl
  Build-MacOS:
    strategy:
      matrix:
        include:
          - cibw_arch: "x86_64"
            go_arch: "amd64"
          - cibw_arch: "arm64"
            go_arch: "arm64"
    runs-on: macos-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
      - name: Set up Go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
        with:
          go-version: "1.21.5"
          cache: true
          cache-dependency-path: "gotfparse/go.sum"
      - name: Build wheels
        uses: pypa/cibuildwheel@fff9ec32ed25a9c576750c91e06b410ed0c15db7
        env:
          CGO_ENABLED: 1
          CIBW_ARCHS: ${{ matrix.cibw_arch }}
          GOARCH: ${{ matrix.go_arch }}
      - name: Upload Artifacts
        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392
        with:
          name: wheels-macos-${{ matrix.cibw_arch }}
          path: ./wheelhouse/*.whl

  Gather:
    needs: [Build-Linux, Build-MacOS]
    runs-on: ubuntu-latest
    outputs:
      hash: ${{ steps.hash.outputs.hash }}      
    steps:
      - name: Fetch Wheels
        uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110
        with:
          pattern: "wheels-*"
          path: dist
          merge-multiple: true
      - name: Display downloaded artifacts
        run: ls -lh dist
      - name: Generate Hashes
        id: hash
        run: cd dist && echo "hash=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT

  Provenance:
    needs: [Gather]
    permissions:
      actions: read
      id-token: write
      contents: write
    # Can't pin with hash due to how this workflow works.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
    with:
      base64-subjects: ${{ needs.Gather.outputs.hash }}

  Release:
    runs-on: ubuntu-latest    
    needs: [Provenance]
    permissions:
      contents: write
    steps:
      - name: Display downloaded artifacts
        run: ls -lh dist

      - name: Display provenance artifacts
        run: |
          ls -lh *intoto*

  Upload:
    needs: [Release]
    runs-on: ubuntu-latest
#    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      id-token: write
    steps:
      - name: Display downloaded artifacts
        run: ls -lh dist

      - name: Display provenance artifacts
        run: |
          ls -lh -- *intoto*

#      - uses: pypa/gh-action-pypi-publish@2f6f737ca5f74c637829c0f5c3acd0e29ea5e8bf
#        with:
#          password: ${{ secrets.PYPI_TOKEN }}