release_github.yml

# Release workflow for celq binaries
# Credit: Inspired by https://github.com/01mf02/jaq/blob/main/.github/workflows/release.yml
# Also see: https://github.com/BurntSushi/ripgrep/blob/61733f6378b62fa2dc2e7f3eff2f2e7182069ca9/.github/workflows/release.yml


name: GitHub Release

on:
  workflow_dispatch:  # Manual trigger only
  push:
    tags:
      - "v[0-9]*"      # Trigger on version tags like v1.0.0

defaults:
  run:
    shell: bash

env:
  NAME: celq
  VERSION: ${{ github.ref_name }}

permissions:
  contents: read

jobs:
  build_mac:
    name: ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    environment: github_release
    env:
      DEVELOPER_DIR: /Applications/Xcode_16.4.app/Contents/Developer
      MACOSX_DEPLOYMENT_TARGET: "11.0"
    permissions:
      contents: write
      id-token: write
      attestations: write
      artifact-metadata: write
    strategy:
      fail-fast: false
      matrix:
        include:
          # macOS ARM64 (native)
          - { target: aarch64-apple-darwin, os: macos-15, pretty_target: macos-aarch64 }

          # macOS x86-64 (cross-compiled on Apple Silicon)
          - { target: x86_64-apple-darwin, os: macos-15, pretty_target: macos-x86_64 }

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Select pinned macOS SDK
        run: echo "SDKROOT=$(xcrun --sdk macosx15.5 --show-sdk-path)" >> "$GITHUB_ENV"

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@9376cdc5a5e25b16da71af47712785cf06b0d6d4 # 1.94.1
        with:
          targets: ${{ matrix.target }}

      - name: Install cargo-auditable
        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2
        with:
          tool: cargo-auditable@0.7.5
          fallback: none

      - name: Configure reproducible builds
        run: |
          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
          echo "TZ=UTC" >> "$GITHUB_ENV"
          echo "LC_ALL=C" >> "$GITHUB_ENV"
          RUST_SYSROOT=$(rustc --print sysroot)
          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"

      - name: Build
        run: cargo auditable build --locked --release --target ${{ matrix.target }}

      - name: Install GNU tar
        run: brew install gnu-tar

      - name: Create release archive
        id: archive
        run: |
          BIN_PATH="target/${{ matrix.target }}/release/${NAME}"
          ARCHIVE_NAME="${NAME}-${{ matrix.pretty_target }}.tar.gz"
          gtar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
            --owner=0 --group=0 --numeric-owner --mode=0755 \
            -cf "${ARCHIVE_NAME%.gz}" -C "target/${{ matrix.target }}/release" "${NAME}"
          gzip -n -9 "${ARCHIVE_NAME%.gz}"
          
          echo "BIN_PATH=${BIN_PATH}" >> "$GITHUB_OUTPUT"
          echo "ARCHIVE_NAME=${ARCHIVE_NAME}" >> "$GITHUB_OUTPUT"

      - name: Generate attestation for release binary
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: ${{ steps.archive.outputs.BIN_PATH }}

      - name: Generate attestation for release archive
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: ${{ steps.archive.outputs.ARCHIVE_NAME }}

      - name: Upload release archive
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload "${VERSION}" "${{ steps.archive.outputs.ARCHIVE_NAME }}"

  build_xwin:
    name: ${{ matrix.target }}
    runs-on: windows-2025
    environment: github_release
    permissions:
      contents: write
      id-token: write
      attestations: write
      artifact-metadata: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - { target: x86_64-pc-windows-msvc, pretty_target: windows-x86_64 }
          - { target: aarch64-pc-windows-msvc, pretty_target: windows-arm64 }
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup Xwin
        id: setup-xwin
        uses: $/.github/actions/setup-xwin
        with:
          target: ${{ matrix.target }}
          rust_components: llvm-tools
          cache_directory: ${{ github.workspace }}/.xwin-cache
          use_cache: "false"

      - name: Configure reproducible builds
        run: |
          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
          echo "TZ=UTC" >> "$GITHUB_ENV"
          echo "LC_ALL=C" >> "$GITHUB_ENV"
          RUST_SYSROOT=$(rustc --print sysroot)
          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src -C link-arg=/DEBUG:NONE" >> "$GITHUB_ENV"

      - name: Build with Xwin
        env:
          TARGET: ${{ matrix.target }}
          XWIN_CRT_VERSION: ${{ steps.setup-xwin.outputs.xwin_crt_version }}
          XWIN_SDK_VERSION: ${{ steps.setup-xwin.outputs.xwin_sdk_version }}
          XWIN_VERSION: ${{ steps.setup-xwin.outputs.xwin_version }}
        run: >-
          cargo auditable xwin build --locked --release --target "${TARGET}"
          --xwin-version "${XWIN_VERSION}"
          --xwin-sdk-version "${XWIN_SDK_VERSION}"
          --xwin-crt-version "${XWIN_CRT_VERSION}"

      - name: Create release archive
        id: archive
        env:
          PRETTY_TARGET: ${{ matrix.pretty_target }}
          TARGET: ${{ matrix.target }}
        run: |
          BIN_PATH="target/${TARGET}/release/${NAME}.exe"
          ARCHIVE_NAME="${NAME}-${PRETTY_TARGET}.zip"
          7z a -mtm=off -mtc=off -mta=off "${ARCHIVE_NAME}" "./${BIN_PATH}"
          7z rn "${ARCHIVE_NAME}" "target/${TARGET}/release/${NAME}.exe" "${NAME}.exe"

          echo "BIN_PATH=${BIN_PATH}" >> "$GITHUB_OUTPUT"
          echo "ARCHIVE_NAME=${ARCHIVE_NAME}" >> "$GITHUB_OUTPUT"

      - name: Generate attestation for release binary
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: ${{ steps.archive.outputs.BIN_PATH }}

      - name: Generate attestation for release archive
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: ${{ steps.archive.outputs.ARCHIVE_NAME }}

      - name: Upload release archive
        env:
          ARCHIVE_NAME: ${{ steps.archive.outputs.ARCHIVE_NAME }}
          GH_TOKEN: ${{ github.token }}
        run: gh release upload "${VERSION}" "${ARCHIVE_NAME}"

  build:
    name: ${{ matrix.target }}${{ matrix.zigtargetsuffix }}
    runs-on: ubuntu-24.04
    environment: github_release
    permissions:
      contents: write
      id-token: write
      attestations: write
      artifact-metadata: write
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux x86-64 (zigbuild - glibc 2.28)
          - { target: x86_64-unknown-linux-gnu, zigtargetsuffix: .2.28, pretty_target: linux-x86_64-gnu }
          
          # Linux ARM64 (zigbuild - glibc 2.28)
          - { target: aarch64-unknown-linux-gnu, zigtargetsuffix: .2.28, pretty_target: linux-aarch64-gnu }

          # Linux RISC-V 64 (zigbuild - glibc 2.31)
          - { target: riscv64gc-unknown-linux-gnu, zigtargetsuffix: .2.31, pretty_target: linux-riscv64-gnu }

          # Linux RISC-V 64 (zigbuild - musl static binary)
          - { target: riscv64gc-unknown-linux-musl, zigtargetsuffix: "", pretty_target: linux-riscv64-musl }

          # Linux PowerPC 64 LE (zigbuild - glibc 2.28)
          - { target: powerpc64le-unknown-linux-gnu, zigtargetsuffix: .2.28, pretty_target: linux-ppc64le-gnu }

          # Linux PowerPC 64 LE (zigbuild - musl static binary)
          - { target: powerpc64le-unknown-linux-musl, zigtargetsuffix: "", pretty_target: linux-ppc64le-musl }

          # Linux x86-64 (zigbuild - musl static binary)
          - { target: x86_64-unknown-linux-musl, zigtargetsuffix: "", pretty_target: linux-x86_64-musl }

          # Linux ARM64 (zigbuild - musl static binary)
          - { target: aarch64-unknown-linux-musl, zigtargetsuffix: "", pretty_target: linux-aarch64-musl }

          # FreeBSD x86-64 (zigbuild)
          - { target: x86_64-unknown-freebsd, zigtargetsuffix: "", pretty_target: freebsd-x86_64 }

          # FreeBSD ARM64 (zigbuild)
          - { target: aarch64-unknown-freebsd, zigtargetsuffix: "", pretty_target: freebsd-aarch64 }

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup Zigbuild
        uses: $/.github/actions/setup-zigbuild
        with:
          target: ${{ matrix.target }}
          rust_components: rust-src
          install_target: ${{ matrix.target != 'aarch64-unknown-freebsd' }}
          use_cache: "false"

      - name: Configure reproducible builds
        run: |
          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
          echo "TZ=UTC" >> "$GITHUB_ENV"
          echo "LC_ALL=C" >> "$GITHUB_ENV"
          RUST_SYSROOT=$(rustc --print sysroot)
          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"

      - name: Build with Zig
        if: matrix.target != 'aarch64-unknown-freebsd'
        run: cargo auditable zigbuild --locked --release --target ${{ matrix.target }}${{ matrix.zigtargetsuffix }}
      
      - name: Build with Zig (FreeBSD aarch64 special case)
        if: matrix.target == 'aarch64-unknown-freebsd'
        run: |
          RUSTC_BOOTSTRAP=1 RUSTFLAGS="${RUSTFLAGS} -Z unstable-options -C panic=immediate-abort" cargo auditable zigbuild \
          --target aarch64-unknown-freebsd \
          --release \
          -Z build-std=std,panic_abort

      - name: Create release archive
        id: archive
        run: |
          BIN_PATH="target/${{ matrix.target }}/release/${NAME}"
          BIN_NAME="${NAME}"
          
          # Archive name uses pretty target name
          ARCHIVE_NAME="${NAME}-${{ matrix.pretty_target }}.tar.gz"
          tar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
            --owner=0 --group=0 --numeric-owner --mode=0755 \
            -cf "${ARCHIVE_NAME%.gz}" -C "target/${{ matrix.target }}/release" "${BIN_NAME}"
          gzip -n -9 "${ARCHIVE_NAME%.gz}"
          
          echo "BIN_PATH=${BIN_PATH}" >> $GITHUB_OUTPUT
          echo "ARCHIVE_NAME=${ARCHIVE_NAME}" >> $GITHUB_OUTPUT

      - name: Generate attestation for release binary
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: ${{ steps.archive.outputs.BIN_PATH }}

      - name: Generate attestation for release archive
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: ${{ steps.archive.outputs.ARCHIVE_NAME }}

      - name: Upload release archive
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload ${VERSION} ${{ steps.archive.outputs.ARCHIVE_NAME }}

  create-zstd-archives:
    name: Zstandard (${{ matrix.pretty_target }})
    needs: [build, build_mac]
    runs-on: ubuntu-24.04
    environment: github_release
    permissions:
      contents: write
      id-token: write
      attestations: write
      artifact-metadata: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - { pretty_target: macos-aarch64 }
          - { pretty_target: linux-x86_64-gnu }
          - { pretty_target: linux-aarch64-gnu }
          - { pretty_target: linux-x86_64-musl }
          - { pretty_target: linux-aarch64-musl }
    steps:
      - name: Install pinned zstd
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          cache: false
          experimental: true
          minimum_release_age: 2d
          mise_toml: |
            [tools]
            "conda:zstd" = "1.5.7"
          version: 2026.9.9

      - name: Download gzip release archive
        env:
          GH_TOKEN: ${{ github.token }}
          SOURCE_ARCHIVE: ${{ env.NAME }}-${{ matrix.pretty_target }}.tar.gz
        run: |
          mkdir -p "${RUNNER_TEMP}/release-assets"
          gh release download "${VERSION}" \
            --repo "${GITHUB_REPOSITORY}" \
            --pattern "${SOURCE_ARCHIVE}" \
            --dir "${RUNNER_TEMP}/release-assets"

      - name: Create reproducible zstd release archive
        id: archive
        env:
          SOURCE_ARCHIVE: ${{ env.NAME }}-${{ matrix.pretty_target }}.tar.gz
        run: |
          SOURCE_PATH="${RUNNER_TEMP}/release-assets/${SOURCE_ARCHIVE}"
          TAR_PATH="${SOURCE_PATH%.gz}"
          ZSTD_PATH="${TAR_PATH}.zst"

          gzip --decompress --keep "${SOURCE_PATH}"
          zstd -19 -T1 --no-progress "${TAR_PATH}" -o "${ZSTD_PATH}"

          echo "ZSTD_PATH=${ZSTD_PATH}" >> "$GITHUB_OUTPUT"

      - name: Generate attestation for zstd release archive
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: ${{ steps.archive.outputs.ZSTD_PATH }}

      - name: Upload zstd release archive
        env:
          GH_TOKEN: ${{ github.token }}
          ZSTD_PATH: ${{ steps.archive.outputs.ZSTD_PATH }}
        run: gh release upload "${VERSION}" "${ZSTD_PATH}" --repo "${GITHUB_REPOSITORY}"

  update-install-script:
    name: Update install script on GitHub Pages
    needs: [build, build_mac, build_xwin, create-zstd-archives]
    permissions:
      contents: write
      id-token: write
      attestations: write
      artifact-metadata: write
    uses: $/.github/workflows/release_sub_pages.yml
    secrets:
      PAGES_DEPLOY_TOKEN: ${{ secrets.PAGES_DEPLOY_TOKEN }}

  generate-checksums:
    name: Generate SHA256 checksums
    runs-on: ubuntu-latest
    needs: [build, build_mac, build_xwin, create-zstd-archives, update-install-script]
    environment: github_release
    permissions:
      contents: write
      id-token: write
      attestations: write
      artifact-metadata: write
    steps:
      - name: Download all release assets
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          VERSION="${{ github.ref_name }}"
          
          # Create temp directory for downloads
          mkdir -p /tmp/release-assets
          cd /tmp/release-assets
          
          # Download all archives and install.sh for this release
          gh release download "${VERSION}" \
            --repo ${{ github.repository }} \
            --pattern "celq-*.tar.gz" \
            --pattern "celq-*.tar.zst" \
            --pattern "celq-*.zip" \
            --pattern "install.sh"
          
          # List downloaded files
          echo "Downloaded files:"
          ls -lh

      - name: Generate checksums file
        run: |
          cd /tmp/release-assets
          
          # Generate SHA256 checksums for all downloaded files
          # Sort output alphabetically by filename
          sha256sum celq-* install.sh | sort -k2 > SHA256SUMS
          
          echo "Generated checksums:"
          cat SHA256SUMS

      - name: Generate attestation for checksums file
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: /tmp/release-assets/SHA256SUMS

      - name: Upload checksums file to release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          cd /tmp/release-assets
          gh release upload ${{ github.ref_name }} SHA256SUMS \
            --repo ${{ github.repository }} \
            --clobber

  create-minisign-release:
    name: Create Minisign release
    needs: [generate-checksums]
    runs-on: ubuntu-latest
    environment: github_release
    permissions:
      contents: read
    steps:
      - name: Create signatures release if needed
        env:
          GH_TOKEN: ${{ secrets.SIGNATURES_TOKEN }}
          SIGNATURES_REPOSITORY: get-celq/signatures
        run: |
          if gh release view "${VERSION}" --repo "${SIGNATURES_REPOSITORY}" >/dev/null 2>&1; then
            echo "Signatures release ${VERSION} already exists"
          else
            gh release create "${VERSION}" \
              --repo "${SIGNATURES_REPOSITORY}" \
              --title "celq ${VERSION} signatures" \
              --notes "Detached Minisign signatures for celq ${VERSION} release archives."
          fi

  minisign-release-assets:
    name: Minisign (${{ matrix.target }})
    needs: [create-minisign-release]
    runs-on: ubuntu-latest
    environment: github_release
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - { target: aarch64-apple-darwin, archive: celq-macos-aarch64.tar.gz, archive_suffix: tar.gz }
          - { target: aarch64-apple-darwin, archive: celq-macos-aarch64.tar.zst, archive_suffix: tar.zst }
          - { target: x86_64-apple-darwin, archive: celq-macos-x86_64.tar.gz, archive_suffix: tar.gz }
          - { target: x86_64-pc-windows-msvc, archive: celq-windows-x86_64.zip, archive_suffix: zip }
          - { target: aarch64-pc-windows-msvc, archive: celq-windows-arm64.zip, archive_suffix: zip }
          - { target: x86_64-unknown-linux-musl, archive: celq-linux-x86_64-musl.tar.gz, archive_suffix: tar.gz }
          - { target: x86_64-unknown-linux-musl, archive: celq-linux-x86_64-musl.tar.zst, archive_suffix: tar.zst }
          - { target: aarch64-unknown-linux-musl, archive: celq-linux-aarch64-musl.tar.gz, archive_suffix: tar.gz }
          - { target: aarch64-unknown-linux-musl, archive: celq-linux-aarch64-musl.tar.zst, archive_suffix: tar.zst }
          - { target: x86_64-unknown-linux-gnu, archive: celq-linux-x86_64-gnu.tar.gz, archive_suffix: tar.gz }
          - { target: x86_64-unknown-linux-gnu, archive: celq-linux-x86_64-gnu.tar.zst, archive_suffix: tar.zst }
          - { target: aarch64-unknown-linux-gnu, archive: celq-linux-aarch64-gnu.tar.gz, archive_suffix: tar.gz }
          - { target: aarch64-unknown-linux-gnu, archive: celq-linux-aarch64-gnu.tar.zst, archive_suffix: tar.zst }
          - { target: riscv64gc-unknown-linux-musl, archive: celq-linux-riscv64-musl.tar.gz, archive_suffix: tar.gz }
          - { target: riscv64gc-unknown-linux-gnu, archive: celq-linux-riscv64-gnu.tar.gz, archive_suffix: tar.gz }
          - { target: powerpc64le-unknown-linux-musl, archive: celq-linux-ppc64le-musl.tar.gz, archive_suffix: tar.gz }
          - { target: powerpc64le-unknown-linux-gnu, archive: celq-linux-ppc64le-gnu.tar.gz, archive_suffix: tar.gz }
          - { target: x86_64-unknown-freebsd, archive: celq-freebsd-x86_64.tar.gz, archive_suffix: tar.gz }
          - { target: aarch64-unknown-freebsd, archive: celq-freebsd-aarch64.tar.gz, archive_suffix: tar.gz }
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Install minisign
        run: |
          sudo apt-get update
          sudo apt-get install --no-install-recommends --yes minisign

      - name: Download release archive
        env:
          ARCHIVE_NAME: ${{ matrix.archive }}
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p "${RUNNER_TEMP}/release-assets"
          gh release download "${VERSION}" \
            --repo "${GITHUB_REPOSITORY}" \
            --pattern "${ARCHIVE_NAME}" \
            --dir "${RUNNER_TEMP}/release-assets"

      - name: Sign release archive
        env:
          ARCHIVE_NAME: ${{ matrix.archive }}
          ARCHIVE_SUFFIX: ${{ matrix.archive_suffix }}
          MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
          TARGET: ${{ matrix.target }}
        run: |
          ARCHIVE_PATH="${RUNNER_TEMP}/release-assets/${ARCHIVE_NAME}"
          SIGNATURE_PATH="${RUNNER_TEMP}/release-assets/${NAME}-${TARGET}.${ARCHIVE_SUFFIX}.sig"
          .github/scripts/sign-release-archive.sh "${ARCHIVE_PATH}" "${SIGNATURE_PATH}"

      - name: Upload signature
        env:
          ARCHIVE_SUFFIX: ${{ matrix.archive_suffix }}
          GH_TOKEN: ${{ secrets.SIGNATURES_TOKEN }}
          SIGNATURES_REPOSITORY: get-celq/signatures
          TARGET: ${{ matrix.target }}
        run: |
          SIGNATURE_PATH="${RUNNER_TEMP}/release-assets/${NAME}-${TARGET}.${ARCHIVE_SUFFIX}.sig"
          gh release upload "${VERSION}" "${SIGNATURE_PATH}" \
            --repo "${SIGNATURES_REPOSITORY}" \
            --clobber

  generate-sboms:
    name: SBOM (${{ matrix.target }})
    needs: [generate-checksums]
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - { target: macos-aarch64, archive: celq-macos-aarch64.tar.gz, binary: celq }
          - { target: macos-x86_64, archive: celq-macos-x86_64.tar.gz, binary: celq }
          - { target: windows-x86_64, archive: celq-windows-x86_64.zip, binary: celq.exe }
          - { target: windows-arm64, archive: celq-windows-arm64.zip, binary: celq.exe }
          - { target: linux-x86_64-musl, archive: celq-linux-x86_64-musl.tar.gz, binary: celq }
          - { target: linux-aarch64-musl, archive: celq-linux-aarch64-musl.tar.gz, binary: celq }
          - { target: linux-x86_64-gnu, archive: celq-linux-x86_64-gnu.tar.gz, binary: celq }
          - { target: linux-aarch64-gnu, archive: celq-linux-aarch64-gnu.tar.gz, binary: celq }
          - { target: linux-riscv64-gnu, archive: celq-linux-riscv64-gnu.tar.gz, binary: celq }
          - { target: linux-riscv64-musl, archive: celq-linux-riscv64-musl.tar.gz, binary: celq }
          - { target: linux-ppc64le-gnu, archive: celq-linux-ppc64le-gnu.tar.gz, binary: celq }
          - { target: linux-ppc64le-musl, archive: celq-linux-ppc64le-musl.tar.gz, binary: celq }
          - { target: freebsd-x86_64, archive: celq-freebsd-x86_64.tar.gz, binary: celq }
          - { target: freebsd-aarch64, archive: celq-freebsd-aarch64.tar.gz, binary: celq }
    uses: $/.github/workflows/release_sub_calculate_sboms.yml
    with:
      target: ${{ matrix.target }}
      archive: ${{ matrix.archive }}
      binary: ${{ matrix.binary }}

  attest-sboms:
    name: Attest SBOM (${{ matrix.target }})
    needs: [generate-sboms]
    runs-on: ubuntu-latest
    environment: github_release
    permissions:
      contents: read
      id-token: write
      attestations: write
      artifact-metadata: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - { target: macos-aarch64, binary: celq }
          - { target: macos-x86_64, binary: celq }
          - { target: windows-x86_64, binary: celq.exe }
          - { target: windows-arm64, binary: celq.exe }
          - { target: linux-x86_64-musl, binary: celq }
          - { target: linux-aarch64-musl, binary: celq }
          - { target: linux-x86_64-gnu, binary: celq }
          - { target: linux-aarch64-gnu, binary: celq }
          - { target: linux-riscv64-gnu, binary: celq }
          - { target: linux-riscv64-musl, binary: celq }
          - { target: linux-ppc64le-gnu, binary: celq }
          - { target: linux-ppc64le-musl, binary: celq }
          - { target: freebsd-x86_64, binary: celq }
          - { target: freebsd-aarch64, binary: celq }
    steps:
      - name: Download SBOM attestation inputs
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: sbom-attestation-${{ matrix.target }}

      - name: Attest binary SPDX SBOM
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: binary/${{ matrix.binary }}
          sbom-path: ${{ needs.generate-sboms.outputs.spdx_json_path }}

      - name: Attest binary CycloneDX SBOM
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: binary/${{ matrix.binary }}
          sbom-path: ${{ needs.generate-sboms.outputs.cyclonedx_json_path }}

  update-homebrew-formula:
    name: Update Homebrew formula
    needs: [build, build_mac, build_xwin, create-zstd-archives]
    permissions:
      contents: read
    uses: $/.github/workflows/release_sub_homebrew.yml
    secrets:
      HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}

  update-scoop-manifest:
    name: Update Scoop manifest
    needs: [build, build_mac, build_xwin]
    permissions:
      contents: read
    uses: $/.github/workflows/release_sub_scoop.yml
    secrets:
      SCOOP_BUCKET_TOKEN: ${{ secrets.SCOOP_BUCKET_TOKEN }}