release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: read

jobs:
  create-release:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: write
    outputs:
      tag: ${{ github.ref_name }}
    steps:
      - name: Create draft release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ github.ref_name }}
        run: |
          gh release create "$TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --draft \
            --title "$TAG"

  build:
    needs: create-release
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x86_64
            runner: codebuild-aws-lambda-cpp-test-trigger-x86-${{ github.run_id }}-${{ github.run_attempt }}
          - arch: aarch64
            runner: codebuild-aws-lambda-cpp-test-trigger-arm64-${{ github.run_id }}-${{ github.run_attempt }}

    steps:
      - name: Install prerequisites
        env:
          AWS_DEFAULT_REGION: eu-west-1
          CA_DOMAIN: aws-lambda
          CA_DOMAIN_OWNER: ${{ secrets.AWS_ACCOUNT_ID }}
          CA_REPO: pypi-store
        run: |
          aws codeartifact login --tool pip \
            --domain "$CA_DOMAIN" --domain-owner "$CA_DOMAIN_OWNER" \
            --repository "$CA_REPO"
          pip install cmake ninja
          cmake --version
          ninja --version

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.ref_name }}

      - name: Build in Release mode
        env:
          TAG: ${{ github.ref_name }}
        run: |
          cmake -B build -GNinja \
            -DCMAKE_BUILD_TYPE=Release \
            -DENABLE_TESTS=ON \
            -DAWS_LAMBDA_CPP_VERSION="${TAG#v}"
          cmake --build build

      - name: Run unit tests
        run: cd build && ctest --output-on-failure

      - name: Extract library
        run: |
          mkdir -p staging
          cp build/libaws-lambda-runtime.a staging/libaws-lambda-runtime-${{ matrix.arch }}.a

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: libaws-lambda-runtime-${{ matrix.arch }}
          path: staging/libaws-lambda-runtime-${{ matrix.arch }}.a

  upload:
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    # The signing role's trust policy is scoped to the `environment:release`
    # OIDC subject claim. Without this, the token carries a `ref:` subject and
    # AssumeRoleWithWebIdentity is denied. See docs/gpg-key-management.md.
    environment: release
    permissions:
      id-token: write
      contents: write

    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: artifacts
          merge-multiple: true

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          role-to-assume: ${{ secrets.AWS_GPG_SIGNING_ROLE_ARN }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Sign artifacts and generate checksums
        env:
          GPG_SECRET_ID: lambda-runtimes/cpp/gpg-signing-key
        run: |
          GNUPGHOME="$(mktemp -d)"
          chmod 700 "$GNUPGHOME"
          export GNUPGHOME
          trap 'gpgconf --kill all >/dev/null 2>&1 || true; rm -rf "$GNUPGHOME"' EXIT

          aws secretsmanager get-secret-value \
            --secret-id "$GPG_SECRET_ID" \
            --query SecretString \
            --output text \
            | gpg --batch --import

          FPR="$(gpg --with-colons --list-secret-keys \
            | awk -F: '/^fpr:/ {print $10; exit}')"
          if [ -z "$FPR" ]; then
            echo "No secret key imported from $GPG_SECRET_ID" >&2
            exit 1
          fi

          cd artifacts

          # Sign each artifact
          for file in *.a; do
            gpg --batch --yes --local-user "$FPR" \
              --armor --detach-sign "$file"
          done

          # Generate checksums file and sign it
          sha256sum ./*.a > SHA256SUMS
          gpg --batch --yes --local-user "$FPR" \
            --armor --detach-sign SHA256SUMS

          gpg --batch --verify SHA256SUMS.asc SHA256SUMS
          for file in *.a; do
            gpg --batch --verify "$file.asc" "$file"
          done

      - name: Upload assets to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ github.ref_name }}
        run: |
          gh release upload "$TAG" \
            --repo "$GITHUB_REPOSITORY" \
            artifacts/*

  smoke-test:
    needs: upload
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 15
    permissions:
      contents: write
    strategy:
      fail-fast: true
      matrix:
        include:
          - arch: x86_64
            runner: ubuntu-latest
          - arch: aarch64
            runner: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.ref_name }}

      - name: OCI + RIE smoke test against the published artifact
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ci/integ/run-oci-smoke.sh "${{ matrix.arch }}" "${{ github.ref_name }}"