provenance.yml

name: 📦 Publish

concurrency:
  group: publish-${{ github.ref }}
  cancel-in-progress: false

on:
  workflow_dispatch:
    inputs:
      dry-run:
        description: 'Dry run (build only)'
        type: boolean
        default: true
      cli:
        description: '@socketsecurity/cli'
        type: boolean
        default: true
      cli-sentry:
        description: '@socketsecurity/cli-with-sentry'
        type: boolean
        default: true
      socket:
        description: 'socket (+ 8 bins)'
        type: boolean
        default: true

permissions:
  contents: read

env:
  BUILD_MODE: prod

jobs:
  # Build CLI bundle once (platform-agnostic JS) and generate platform matrix.
  build-cli:
    if: ${{ inputs.socket }}
    name: Build CLI bundle
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    outputs:
      matrix: ${{ steps.matrix.outputs.matrix }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (2026-05-15)
        with:
          persist-credentials: false

      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bb4bb872b58d7c97f828caea595ff534b78c507b # main (2026-05-15)
        with:
          checkout: 'false'

      - name: Build CLI
        shell: bash
        run: |
          pnpm --filter @socketsecurity/cli run build

      - name: Generate platform matrix
        id: matrix
        run: |
          MATRIX=$(node scripts/get-platform-matrix.mts)
          echo "matrix=$MATRIX" >> $GITHUB_OUTPUT

      - name: Upload CLI bundle
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 (2026-05-15)
        with:
          name: cli-bundle
          path: packages/cli/build/cli.js
          retention-days: 1

  # Build SEA binaries for all platforms (only if publishing binaries).
  build-binaries:
    if: ${{ inputs.socket }}
    needs: [build-cli]
    name: Build ${{ matrix.releasePlatform }}-${{ matrix.arch }}${{ matrix.libc && '-musl' || '' }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.build-cli.outputs.matrix) }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (2026-05-15)
        with:
          persist-credentials: false

      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bb4bb872b58d7c97f828caea595ff534b78c507b # main (2026-05-15)
        with:
          checkout: 'false'
          registry-url: 'https://registry.npmjs.org'

      - name: Download CLI bundle
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 (2026-05-15)
        with:
          name: cli-bundle
          path: packages/cli/build

      - name: Build SEA binary
        shell: bash
        env:
          MATRIX_LIBC: ${{ matrix.libc }}
          MATRIX_PLATFORM: ${{ matrix.platform }}
          MATRIX_ARCH: ${{ matrix.arch }}
        run: |
          LIBC_FLAG=""
          if [ "$MATRIX_LIBC" = "musl" ]; then
            LIBC_FLAG="--libc=musl"
          fi
          pnpm --filter @socketsecurity/cli run build:sea -- \
            --platform="$MATRIX_PLATFORM" \
            --arch="$MATRIX_ARCH" \
            ${LIBC_FLAG}

      - name: Upload binary
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 (2026-05-15)
        with:
          name: binary-${{ matrix.releasePlatform }}-${{ matrix.arch }}${{ matrix.libc && '-musl' || '' }}
          path: packages/package-builder/build/prod/out/socketbin-cli-${{ matrix.releasePlatform }}-${{ matrix.arch }}${{ matrix.libc && '-musl' || '' }}/socket${{ matrix.platform == 'win32' && '.exe' || '' }}
          retention-days: 1

  # Publish all packages.
  publish:
    name: Publish packages
    needs: [build-cli, build-binaries]
    if: ${{ always() && (needs.build-cli.result == 'success' || needs.build-cli.result == 'skipped') && (needs.build-binaries.result == 'success' || needs.build-binaries.result == 'skipped') }}
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: read
      id-token: write # NPM trusted publishing via OIDC
    outputs:
      # Captured only when `socket` (the v<version>-tagged npm package) is
      # actually published. Empty otherwise; tag-release job no-ops on empty.
      published_sha: ${{ steps.capture_sha.outputs.published_sha }}
      published_version: ${{ steps.capture_sha.outputs.published_version }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (2026-05-15)
        with:
          persist-credentials: false

      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bb4bb872b58d7c97f828caea595ff534b78c507b # main (2026-05-15)
        with:
          checkout: 'false'
          registry-url: 'https://registry.npmjs.org'

      # Get versions for lock-stepped and independent packages.
      - name: Get versions
        id: version
        run: |
          # Socket CLI ecosystem version (lock-stepped)
          CLI_VERSION=$(node -p "require('./packages/package-builder/templates/cli-package/package.json').version")
          echo "cli_version=$CLI_VERSION" >> $GITHUB_OUTPUT
          echo "Socket CLI version: $CLI_VERSION"

          # Determine npm dist-tags based on version
          if [[ "$CLI_VERSION" =~ -pre\. ]]; then
            CLI_TAG="pre"
          else
            CLI_TAG="latest"
          fi
          echo "cli_tag=$CLI_TAG" >> $GITHUB_OUTPUT
          echo "Socket CLI dist-tag: $CLI_TAG"

      # Download and publish binary packages.
      - name: Download binaries
        if: ${{ inputs.socket }}
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 (2026-05-15)
        with:
          path: artifacts
          pattern: binary-*

      - name: Publish binary packages
        if: ${{ inputs.socket && !inputs.dry-run }}
        shell: bash
        env:
          VERSION: ${{ steps.version.outputs.cli_version }}
          TAG: ${{ steps.version.outputs.cli_tag }}
        run: |
          set -euo pipefail

          # Get platform targets from single source of truth.
          PLATFORMS_STR=$(node scripts/get-platform-targets.mts)
          read -ra PLATFORMS <<< "$PLATFORMS_STR"

          for target in "${PLATFORMS[@]}"; do
            echo "::group::Publishing @socketbin/cli-${target}"

            # Parse platform/arch/libc from target.
            IFS='-' read -ra PARTS <<< "$target"
            PLATFORM="${PARTS[0]}"
            ARCH="${PARTS[1]}"
            LIBC=""
            if [ "${PARTS[2]}" = "musl" ]; then
              LIBC="musl"
            fi

            # Setup package directory.
            PKG_DIR="packages/package-builder/build/prod/out/socketbin-cli-${target}"
            mkdir -p "$PKG_DIR"

            # Copy binary from artifact.
            # Check for 'win' (release naming, not win32).
            if [ "$PLATFORM" = "win" ]; then
              cp "artifacts/binary-${target}/socket.exe" "$PKG_DIR/"
            else
              cp "artifacts/binary-${target}/socket" "$PKG_DIR/"
            fi

            # Prepare package.
            LIBC_FLAG=""
            if [ -n "$LIBC" ]; then
              LIBC_FLAG="--libc=$LIBC"
            fi
            node scripts/prepublish-socketbin.mts \
              --platform="$PLATFORM" --arch="$ARCH" $LIBC_FLAG --prod \
              --version="$VERSION" --method=sea

            # Publish.
            cd "$PKG_DIR"
            npm publish --provenance --access public --tag "$TAG"
            cd -

            echo "::endgroup::"
          done

      # Build and publish JS packages.
      # Order: cli/cli-with-sentry first (independent), then socket (depends on @socketbin/*).
      - name: Build CLI
        shell: bash
        run: |
          INLINED_PUBLISHED_BUILD=1 pnpm run build

      - name: Publish @socketsecurity/cli
        if: ${{ inputs.cli && !inputs.dry-run }}
        env:
          VERSION: ${{ steps.version.outputs.cli_version }}
          TAG: ${{ steps.version.outputs.cli_tag }}
        run: |
          PKG_DIR="packages/package-builder/build/prod/out/cli"
          node scripts/prepare-package-for-publish.mts "$PKG_DIR" "$VERSION"
          cd "$PKG_DIR"
          npm publish --provenance --access public --no-git-checks --tag "$TAG"

      - name: Publish @socketsecurity/cli-with-sentry
        if: ${{ inputs.cli-sentry && !inputs.dry-run }}
        env:
          VERSION: ${{ steps.version.outputs.cli_version }}
          TAG: ${{ steps.version.outputs.cli_tag }}
        run: |
          PKG_DIR="packages/package-builder/build/prod/out/cli-with-sentry"
          node scripts/prepare-package-for-publish.mts "$PKG_DIR" "$VERSION"
          cd "$PKG_DIR"
          npm publish --provenance --access public --no-git-checks --tag "$TAG"

      # socket published last - depends on @socketbin/* being published first.
      - name: Publish socket
        if: ${{ inputs.socket && !inputs.dry-run }}
        env:
          VERSION: ${{ steps.version.outputs.cli_version }}
          TAG: ${{ steps.version.outputs.cli_tag }}
        run: |
          PKG_DIR="packages/package-builder/build/prod/out/socket"
          node scripts/prepare-package-for-publish.mts "$PKG_DIR" "$VERSION"
          cd "$PKG_DIR"
          npm publish --provenance --access public --no-git-checks --tag "$TAG"

      # Capture the SHA the `socket` package was published from so the
      # downstream tag-release job can point v<version> at it. Only runs
      # when `socket` actually published (its tag is what v<version>
      # represents); cli-only or cli-sentry-only publishes don't create a
      # v<version> tag.
      - name: Capture published SHA
        id: capture_sha
        if: ${{ inputs.socket && !inputs.dry-run }}
        env:
          VERSION: ${{ steps.version.outputs.cli_version }}
        run: |
          PUBLISHED_SHA=$(git rev-parse HEAD)
          echo "published_sha=$PUBLISHED_SHA" >> "$GITHUB_OUTPUT"
          echo "published_version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Captured published SHA: $PUBLISHED_SHA for socket@$VERSION"

      - name: Summary
        # zizmor: ignore[template-injection]
        run: |
          echo "## Publish Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          if [ "${{ inputs.socket }}" = "true" ] || [ "${{ inputs.cli }}" = "true" ] || [ "${{ inputs.cli-sentry }}" = "true" ]; then
            echo "Socket CLI version: \`${{ steps.version.outputs.cli_version }}\` (tag: \`${{ steps.version.outputs.cli_tag }}\`)" >> $GITHUB_STEP_SUMMARY
          fi
          echo "" >> $GITHUB_STEP_SUMMARY
          if [ "${{ inputs.dry-run }}" = "true" ]; then
            echo "**Dry run - nothing was published**" >> $GITHUB_STEP_SUMMARY
          else
            echo "### Published packages:" >> $GITHUB_STEP_SUMMARY
            if [ "${{ inputs.socket }}" = "true" ]; then
              echo "- @socketbin/cli-* (8 platforms)" >> $GITHUB_STEP_SUMMARY
            fi
            if [ "${{ inputs.socket }}" = "true" ]; then
              echo "- socket" >> $GITHUB_STEP_SUMMARY
            fi
            if [ "${{ inputs.cli }}" = "true" ]; then
              echo "- @socketsecurity/cli" >> $GITHUB_STEP_SUMMARY
            fi
            if [ "${{ inputs.cli-sentry }}" = "true" ]; then
              echo "- @socketsecurity/cli-with-sentry" >> $GITHUB_STEP_SUMMARY
            fi
          fi

  # Create v<version> git tag at the published commit SHA after a successful
  # socket-package publish, idempotently. GitHub Release Immutability
  # ("Disallow assets and tags from being modified once a release is
  # published") freezes tags once bound to a Release, so:
  #   - existing tag at same SHA → no-op
  #   - existing tag at different SHA → hard-fail (operator recovery required)
  # See socket-registry/.claude/plans/tag-after-publish.md for the full design.
  # Inlined here (not via socket-registry workflow_call) because socket-cli's
  # publish is multi-package and needs its own SHA-capture wiring.
  tag-release:
    name: Verify and tag release
    needs: publish
    if: ${{ needs.publish.result == 'success' && needs.publish.outputs.published_sha != '' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      # Needed to push the tag.
      contents: write
    steps:
      # Uses gh api (not `git push`) so GITHUB_TOKEN only lives in this
      # step's env, never written to `.git/config`. No checkout needed —
      # tag creation goes straight against the published SHA via API.
      - name: Tag release (idempotent)
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          PUBLISHED_SHA: ${{ needs.publish.outputs.published_sha }}
          PUBLISHED_VERSION: ${{ needs.publish.outputs.published_version }}
        run: |
          TAG="v$PUBLISHED_VERSION"

          # Look up any existing tag via the API. 200 → exists; 404 → absent.
          EXISTING_JSON=$(gh api "repos/$REPO/git/ref/tags/$TAG" 2>/dev/null || echo "")
          if [ -n "$EXISTING_JSON" ]; then
            EXISTING_SHA=$(echo "$EXISTING_JSON" | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).object.sha")
            if [ "$EXISTING_SHA" = "$PUBLISHED_SHA" ]; then
              echo "Tag $TAG already exists at $PUBLISHED_SHA — no-op."
              exit 0
            fi
            echo "::error::Tag $TAG exists at $EXISTING_SHA but publish SHA is $PUBLISHED_SHA."
            echo "::error::Release immutability is enabled; this requires manual recovery:"
            echo "::error::  1. Delete any GitHub Release tied to $TAG"
            echo "::error::  2. Delete the tag via the API"
            echo "::error::  3. Re-run this workflow"
            exit 1
          fi

          gh api "repos/$REPO/git/refs" \
            -X POST \
            -f "ref=refs/tags/$TAG" \
            -f "sha=$PUBLISHED_SHA"
          echo "Created tag $TAG at $PUBLISHED_SHA"