ci.yml

name: CI

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

env:
  IMAGE: ghcr.io/${{ github.repository }}

jobs:
  build:
    name: Build (${{ matrix.name }})
    runs-on: ${{ matrix.runs_on }}
    defaults:
      run:
        shell: nix develop --command bash -eo pipefail {0}
    permissions:
      id-token: write
      contents: read
      attestations: write
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux-amd64
            runs_on: ubuntu-24.04
            platform: linux-amd64
          - name: linux-arm64
            runs_on: ubuntu-24.04-arm
            platform: linux-arm64
          - name: macos-arm64
            runs_on: macos-26
            platform: darwin-arm64

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            accept-flake-config = true

      - name: Cachix
        uses: cachix/cachix-action@v16
        with:
          name: pdf-sign
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Build (flake)
        run: |
          nix build .#pdf-sign --out-link result

      - name: Test (flake checks)
        run: |
          nix flake check -L

      - name: Collect artifact
        run: |
          mkdir -p dist
          cp -L result/bin/pdf-sign "dist/pdf-sign-${{ runner.os }}-$(uname -m)"

      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: dist/*

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: pdf-sign-${{ matrix.name }}
          path: dist/*

      # --- OCI image build and push (all platforms) ---

      - name: Build streaming image
        run: |
          nix build .#image --out-link image

      - name: Login to GHCR
        if: github.event.pull_request.head.repo.fork != true
        run: |
          skopeo login ghcr.io \
            --username "${{ github.actor }}" \
            --password "${{ secrets.GITHUB_TOKEN }}" \
            --compat-auth-file "$HOME/.docker/config.json"

      - name: Push image to GHCR
        id: push-image
        if: github.event.pull_request.head.repo.fork != true
        run: |
          printf '{"default":[{"type":"reject"}],"transports":{"docker-archive":{"":[{"type":"insecureAcceptAnything"}]},"docker":{"ghcr.io/%s":[{"type":"insecureAcceptAnything"}]}}}\n' \
            "${{ github.repository }}" > "$RUNNER_TEMP/skopeo-policy.json"
          ./image | gzip --fast | skopeo \
            --policy "$RUNNER_TEMP/skopeo-policy.json" \
            copy \
            --digestfile "$RUNNER_TEMP/image-digest" \
            docker-archive:/dev/stdin \
            "docker://$IMAGE:sha-${GITHUB_SHA::7}-${{ matrix.platform }}"
          echo "digest=$(cat "$RUNNER_TEMP/image-digest")" >> "$GITHUB_OUTPUT"

      - name: Attest image
        if: github.event.pull_request.head.repo.fork != true
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: ${{ env.IMAGE }}
          subject-digest: ${{ steps.push-image.outputs.digest }}
          push-to-registry: true

  docker:
    name: Docker Manifest
    if: github.event.pull_request.head.repo.fork != true
    needs: build
    runs-on: ubuntu-24.04
    defaults:
      run:
        shell: nix develop --command bash -eo pipefail {0}
    permissions:
      id-token: write
      contents: read
      packages: write
      attestations: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          extra_nix_config: |
            accept-flake-config = true

      - name: Cachix
        uses: cachix/cachix-action@v16
        with:
          name: pdf-sign
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Login to GHCR
        run: |
          skopeo login ghcr.io \
            --username "${{ github.actor }}" \
            --password "${{ secrets.GITHUB_TOKEN }}" \
            --compat-auth-file "$HOME/.docker/config.json"

      - name: Compute tags
        id: tags
        run: |
          SHA_SHORT="${GITHUB_SHA::7}"
          TAGS="$IMAGE:sha-$SHA_SHORT"

          if [[ "$GITHUB_REF" == refs/heads/main ]]; then
            TAGS="$TAGS,$IMAGE:latest"
          fi

          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
            VERSION="${GITHUB_REF#refs/tags/}"
            TAGS="$TAGS,$IMAGE:$VERSION"
            TAGS="$TAGS,$IMAGE:${VERSION#v}"

            MINOR="${VERSION%.*}"
            TAGS="$TAGS,$IMAGE:${MINOR#v}"

            TAGS="$TAGS,$IMAGE:latest"
          fi

          echo "tags=$TAGS" >> "$GITHUB_OUTPUT"

      - name: Create multi-platform manifest
        run: |
          SHA_SHORT="${GITHUB_SHA::7}"
          IFS=',' read -ra TAG_ARRAY <<< "${{ steps.tags.outputs.tags }}"

          FIRST_TAG="${TAG_ARRAY[0]}"
          EXTRA_TAGS=()
          for tag in "${TAG_ARRAY[@]:1}"; do
            EXTRA_TAGS+=(--tags "${tag##*:}")
          done

          manifest-tool push from-args \
            --platforms linux/amd64,linux/arm64,darwin/arm64 \
            --template "$IMAGE:sha-$SHA_SHORT-OS-ARCH" \
            --target "$FIRST_TAG" \
            "${EXTRA_TAGS[@]}"

      - name: Get manifest digest
        id: digest
        run: |
          SHA_SHORT="${GITHUB_SHA::7}"
          DIGEST=$(skopeo inspect "docker://$IMAGE:sha-$SHA_SHORT" | jq -r '.Digest')
          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"

      - name: Attest manifest
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: ${{ env.IMAGE }}
          subject-digest: ${{ steps.digest.outputs.digest }}
          push-to-registry: true

      - name: Verify attestations
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          sleep 5
          IFS=',' read -ra TAG_ARRAY <<< "${{ steps.tags.outputs.tags }}"
          for tag in "${TAG_ARRAY[@]}"; do
            echo "Verifying $tag..."
            gh attestation verify "oci://$tag" --repo "${{ github.repository }}"
          done