publish-release.yml

# The purpose of this workflow is to upload the bulwark binaries to a release.

name: "Upload Binaries to GitHub Release"

on:
  release:
    types: [published]

jobs:
  publish-linux-binary:
    if: github.repository == 'bulwark-security/bulwark'
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Install Rust
      uses: dtolnay/rust-toolchain@21dc36fb71dd22e3317045c0c31a3f4249868b17
      with:
        toolchain: stable
        components: clippy
        targets: wasm32-wasi

    - name: Install protobuf compiler
      run: /usr/bin/sudo /usr/bin/apt install -y protobuf-compiler

    - name: Build release target
      uses: clechasseur/rs-cargo@5cd564345ef5b1136392a1dc943b33a3a888b873 # v2.0.2
      with:
        command: build
        args: --release

    - name: Upload binary as an artifact
      uses: actions/upload-artifact@v4
      with:
        name: bulwark-cli.x86_64-unknown-linux-gnu
        path: target/release/bulwark-cli

    - name: Upload binary as release artifact
      uses: actions/github-script@v6
      env:
        RELEASE_ID: ${{ github.event.release.id }}
      with:
        github-token: "${{ secrets.GITHUB_TOKEN }}"
        script: |
          const fs = require('fs').promises;
          await github.rest.repos.uploadReleaseAsset({
            name: 'bulwark-cli.x86_64-unknown-linux-gnu',
            owner: context.repo.owner,
            repo: context.repo.repo,
            release_id: process.env.RELEASE_ID,
            data: await fs.readFile('./target/release/bulwark-cli')
          });

  publish-macos-x86-64-binary:
    if: github.repository == 'bulwark-security/bulwark'
    permissions:
      contents: write
    runs-on: macos-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Install Rust
      uses: dtolnay/rust-toolchain@21dc36fb71dd22e3317045c0c31a3f4249868b17
      with:
        toolchain: stable
        components: clippy
        targets: wasm32-wasi,x86_64-apple-darwin

    - name: Update Homebrew
      run: |
        brew update --preinstall

    - name: Install protobuf compiler
      run: brew install protobuf

    - name: Build release target
      uses: clechasseur/rs-cargo@5cd564345ef5b1136392a1dc943b33a3a888b873 # v2.0.2
      with:
        command: build
        args: --release --target=x86_64-apple-darwin

    - name: Upload binary as an artifact
      uses: actions/upload-artifact@v4
      with:
        name: bulwark-cli.x86_64-apple-darwin
        path: target/release/bulwark-cli

    - name: Upload binary as release artifact
      uses: actions/github-script@v6
      env:
        RELEASE_ID: ${{ github.event.release.id }}
      with:
        github-token: "${{ secrets.GITHUB_TOKEN }}"
        script: |
          const fs = require('fs').promises;
          await github.rest.repos.uploadReleaseAsset({
            name: 'bulwark-cli.x86_64-apple-darwin',
            owner: context.repo.owner,
            repo: context.repo.repo,
            release_id: process.env.RELEASE_ID,
            data: await fs.readFile('./target/release/bulwark-cli')
          });

  publish-macos-aarch64-binary:
    if: github.repository == 'bulwark-security/bulwark'
    permissions:
      contents: write
    runs-on: macos-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Install Rust
      uses: dtolnay/rust-toolchain@21dc36fb71dd22e3317045c0c31a3f4249868b17
      with:
        toolchain: stable
        components: clippy
        targets: wasm32-wasi

    - name: Update Homebrew
      run: |
        brew update --preinstall

    - name: Install protobuf compiler
      run: brew install protobuf

    - name: Build release target
      uses: clechasseur/rs-cargo@5cd564345ef5b1136392a1dc943b33a3a888b873 # v2.0.2
      with:
        command: build
        args: --release --target=aarch64-apple-darwin

    - name: Upload binary as an artifact
      uses: actions/upload-artifact@v4
      with:
        name: bulwark-cli.aarch64-apple-darwin
        path: target/release/bulwark-cli

    - name: Upload binary as release artifact
      uses: actions/github-script@v6
      env:
        RELEASE_ID: ${{ github.event.release.id }}
      with:
        github-token: "${{ secrets.GITHUB_TOKEN }}"
        script: |
          const fs = require('fs').promises;
          await github.rest.repos.uploadReleaseAsset({
            name: 'bulwark-cli.aarch64-apple-darwin',
            owner: context.repo.owner,
            repo: context.repo.repo,
            release_id: process.env.RELEASE_ID,
            data: await fs.readFile('./target/release/bulwark-cli')
          });