name: release-3.1-upload-artifacts

permissions:
  contents: write
  id-token: write
  attestations: write

on:
  workflow_dispatch:
    inputs:
      ref:
        description: "The ref (branch or SHA) to process"
        required: false
        type: string
  workflow_call:
    inputs:
      skip_latest:
        description: "skip_latest: Tag latest will be pushed unless skip_latest=true"
        required: true
        type: boolean
        default: false

env:
  CARGO_INCREMENTAL: 0
  CARGO_NET_GIT_FETCH_WITH_CLI: true
  CARGO_NET_RETRY: 10
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  RUSTUP_MAX_RETRIES: 10

defaults:
  run:
    shell: bash -xe {0}

jobs:
  upload-assets:
    name: ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-24.04

          - target: x86_64-unknown-linux-musl
            os: ubuntu-24.04

          - target: aarch64-unknown-linux-gnu
            os: ubuntu-24.04

          - target: aarch64-unknown-linux-musl
            os: ubuntu-24.04

          - target: x86_64-apple-darwin
            os: ubuntu-24.04

          - target: aarch64-apple-darwin
            os: ubuntu-24.04
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
        with:
          # Use the ref if provided, otherwise obtain the parent workflow branch, defaults to main.
          ref: ${{ github.event.inputs.ref || github.event.workflow_run.head_branch }}

      - id: git-info
        run: |
          VERSION="$(grep -m1 '^version = "' Cargo.toml | cut -d'"' -f2)"
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "tag=v$VERSION" >> $GITHUB_OUTPUT
          echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT

      - id: release-info
        run: |
          curl --fail -L \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            https://api.github.com/repos/obeli-sk/obelisk/releases/tags/$TAG > release.json
          RELEASE_ID=$(jq -r '.id' release.json)
          echo "release_id=$RELEASE_ID" >> $GITHUB_OUTPUT
        env:
          TAG: ${{ steps.git-info.outputs.tag }}

      - uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035
        with:
          github_access_token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Obelisk with Nix
        run: nix build '.#obeliskCross-${{ matrix.target }}'

      - name: Generate attestation for obelisk binary
        uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8
        with:
          subject-path: 'result/bin/obelisk'

      - name: Create a tar.gz archive
        run: tar czf archive.tar.gz --transform='s/^result\/bin\///' result/bin/obelisk

      - name: Generate attestation for tar.gz
        uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8
        with:
          subject-path: 'archive.tar.gz'

      - name: Upload the archive
        run: |
          curl -v --fail -X POST \
            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
            -H "Content-Type: application/octet-stream" \
            --data-binary @archive.tar.gz \
            "https://uploads.github.com/repos/obeli-sk/obelisk/releases/${{ steps.release-info.outputs.release_id }}/assets?name=obelisk-${{ matrix.target }}.tar.gz"

  call_child:
    needs: upload-assets
    uses: ./.github/workflows/release-4-push-docker-image.yml
    secrets: inherit
    with:
      skip_latest: "${{inputs.skip_latest}}"
