release.yml

name: release

# SLSA L3 + Sigstore provenance + reproducible build for @chio/test-harness.
#
# chio-test-harness ships the daemon-boot scripts + hello-mcp reference mcp.
# The published npm tarball is built from a synthesised top-level package
# that vendors `bin/`, `hello-mcp/` (without node_modules), `policy/`,
# LICENSE and README.
#
# Secrets referenced:
#   NPM_TOKEN  — npm publish auth (skip if using npm Trusted Publishers).
#
# Placeholders:
#   owner/chio-ci-actions — swap to your GH org before pushing.

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      tag:
        required: false
        default: "v0.0.0-dev"
      dry-run:
        required: false
        default: "true"

permissions:
  contents: read
  id-token: write
  attestations: write

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    outputs:
      artifact-name: ${{ steps.hash.outputs.artifact-name }}
      hashes: ${{ steps.hash.outputs.hashes }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Build + pack + publish
        id: publish
        uses: owner/chio-ci-actions/publish-chio@v0.1.0
        with:
          artifact-type: npm
          package-name: "@chio/test-harness"
          tag: ${{ github.event.inputs.tag || github.ref_name }}
          dry-run: ${{ github.event.inputs.dry-run || 'false' }}
          # No TypeScript build; harness is plain bash + a tiny MCP.
          build-command: "bash scripts/prep-release.sh"
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Compute subjects for SLSA generator
        id: hash
        run: |
          set -euo pipefail
          name="$(basename "${{ steps.publish.outputs.artifact-path }}")"
          sha="${{ steps.publish.outputs.artifact-sha256 }}"
          echo "hashes=$(printf '%s  %s\n' "$sha" "$name" | base64 -w0)" >> "$GITHUB_OUTPUT"
          echo "artifact-name=$name" >> "$GITHUB_OUTPUT"

  provenance:
    needs: [build]
    permissions:
      id-token: write
      contents: read
      actions: read
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      base64-subjects: ${{ needs.build.outputs.hashes }}
      upload-assets: true
      provenance-name: "${{ needs.build.outputs.artifact-name }}.intoto.jsonl"