release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  cli:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: macos-latest
            target: x86_64-apple-darwin
          - os: macos-latest
            target: aarch64-apple-darwin
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
      - name: Build CLI
        run: cargo build --release -p phishkit-cli --target ${{ matrix.target }}
      - name: Package
        shell: bash
        run: |
          set -euo pipefail
          VER="${GITHUB_REF_NAME#v}"
          OUT="phishkit-${VER}-${{ matrix.target }}"
          mkdir -p dist/"$OUT"
          cp "target/${{ matrix.target }}/release/phishkit" dist/"$OUT"/
          cp "target/${{ matrix.target }}/release/phishkit_ctl" dist/"$OUT"/ 2>/dev/null || true
          cp README.md LICENSE docs/guide/authorized-use.md dist/"$OUT"/ 2>/dev/null || true
          tar -C dist -czf "dist/${OUT}.tar.gz" "$OUT"
          (cd dist && shasum -a 256 "${OUT}.tar.gz" > "${OUT}.tar.gz.sha256")
      - uses: actions/upload-artifact@v4
        with:
          name: cli-${{ matrix.target }}
          path: dist/*

  packaging:
    needs: cli
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true
      - name: Refresh packaging stubs
        shell: bash
        run: |
          set -euo pipefail
          VER="${GITHUB_REF_NAME#v}"
          REPO="${{ github.repository }}"
          # Prefer linux gnu archive for AUR/debian source pointer
          TGZ=$(ls artifacts/phishkit-${VER}-x86_64-unknown-linux-gnu.tar.gz | head -1)
          SHA=$(sha256sum "$TGZ" | awk '{print $1}')
          URL="https://github.com/${REPO}/releases/download/${GITHUB_REF_NAME}/$(basename "$TGZ")"

          # Homebrew formula (source tarball of the tag — SHA filled when published from archive URL)
          SRC_URL="https://github.com/${REPO}/archive/refs/tags/${GITHUB_REF_NAME}.tar.gz"
          cat > packaging/homebrew/phishkit.rb <<EOF
          # frozen_string_literal: true
          # Generated by release.yml for ${GITHUB_REF_NAME} — alpha
          class Phishkit < Formula
            desc "Authorized AiTM + awareness assessment CLI (alpha)"
            homepage "https://github.com/${REPO}"
            url "${SRC_URL}"
            sha256 "REPLACE_ME_AFTER_TAG_ARCHIVE_IS_PUBLIC"
            version "${VER}"
            license "GPL-3.0-only"
            depends_on "rust" => :build
            depends_on "go" => :build
            def install
              system "cargo", "install", "--locked", "--path", "apps/cli", "--root", prefix, "--bin", "phishkit"
            end
            test do
              assert_match "phishkit", shell_output("#{bin}/phishkit --help 2>&1")
            end
          end
          EOF
          # strip leading spaces from heredoc indent
          sed -i 's/^          //' packaging/homebrew/phishkit.rb

          cat > packaging/aur/PKGBUILD <<EOF
          # Maintainer: REPLACE_ME <REPLACE_ME@example.com>
          # Generated by release.yml for ${GITHUB_REF_NAME}
          pkgname=phishkit-bin
          pkgver=${VER}
          pkgrel=1
          pkgdesc="Authorized AiTM assessment CLI (prebuilt, alpha)"
          arch=('x86_64')
          url="https://github.com/${REPO}"
          license=('GPL3')
          depends=()
          source=("${URL}")
          sha256sums=('${SHA}')
          package() {
            install -Dm755 phishkit "\$pkgdir/usr/bin/phishkit"
            if [[ -f phishkit_ctl ]]; then
              install -Dm755 phishkit_ctl "\$pkgdir/usr/bin/phishkit_ctl"
            fi
          }
          EOF

          # Debian changelog bump (stub)
          {
            echo "phishkit (${VER}-1) UNRELEASED; urgency=low"
            echo
            echo "  * Alpha release ${VER}."
            echo
            echo " -- phishkit release bot <noreply@users.noreply.github.com>  $(date -R)"
            echo
            cat packaging/debian/changelog 2>/dev/null || true
          } > packaging/debian/changelog.new
          mv packaging/debian/changelog.new packaging/debian/changelog

          mkdir -p dist-packaging
          cp packaging/homebrew/phishkit.rb dist-packaging/
          cp packaging/aur/PKGBUILD dist-packaging/
          cp -r packaging/debian dist-packaging/
          echo "${URL}" > dist-packaging/linux-asset.url
          echo "${SHA}" > dist-packaging/linux-asset.sha256
      - uses: actions/upload-artifact@v4
        with:
          name: packaging
          path: dist-packaging/*

  publish:
    needs: [cli, packaging]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          path: release-assets
          merge-multiple: true
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          draft: false
          prerelease: true
          body: |
            **Alpha** (`${{ github.ref_name }}`) — primitive preview, not a beta, not production.

            We are still assembling and testing the product. Expect breaking changes.
            Build from source. There is no signed installer.

            **Authorized security assessments only.** See [authorized use](https://github.com/${{ github.repository }}/blob/main/docs/guide/authorized-use.md).

            - CLI archives + checksums attached
            - Packaging stubs: `phishkit.rb` (Homebrew), `PKGBUILD` (AUR), `debian/`
            - Walkthrough videos are **not** attached (too large for GitHub); generate locally
            - Live tap/AUR/PPA publish requires maintainer secrets (see `packaging/README.md`)
          files: |
            release-assets/**
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}