network-proxy.yml

name: Network Proxy

# Pipeline for the "LumiBoot Network Proxy", a standalone Go application in
# `apps/network-proxy/`, module `github.com/lumiboot/network-proxy`,
# entry point `./cmd/lumiboot-network`. Native binary, no CGO.
#
# Principle: tests are MANDATORY before any build (`build` and `smoke`
# depend on `test`). Cross-compilation is never considered
# proof that it works: the `smoke` job actually runs the
# native binary on each OS. Without signing, the release remains an
# UNSIGNED PRE-RELEASE, never "stable".

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Forced version (optional). Leave empty = auto-increment.'
        required: false
        type: string
  push:
    tags:
      - network-v*
  pull_request:
    paths:
      - apps/network-proxy/**
      - .github/workflows/network-proxy.yml

permissions:
  contents: read

jobs:
  test:
    name: test (go test / vet / gofmt)
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v5
      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: apps/network-proxy/go.mod
          cache-dependency-path: apps/network-proxy/go.sum
      - name: go test -race
        working-directory: apps/network-proxy
        run: go test -race ./...
      - name: go vet
        working-directory: apps/network-proxy
        run: go vet ./...
      - name: gofmt (fails if a file is misformatted)
        working-directory: apps/network-proxy
        run: |
          out="$(gofmt -l .)"
          if [ -n "$out" ]; then
            echo "Misformatted files:"
            echo "$out"
            exit 1
          fi

  prepare:
    name: version (auto-increment)
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.compute.outputs.version }}
      tag: ${{ steps.compute.outputs.tag }}
      release: ${{ steps.compute.outputs.release }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: compute
        env:
          INPUT_VERSION: ${{ inputs.version }}
          # GitHub context values reach the script through `env`, never by
          # interpolation: an unquoted `${{ github.* }}` would be shell syntax.
          EVENT_NAME: ${{ github.event_name }}
          REF: ${{ github.ref }}
        run: |
          set -euo pipefail
          RELEASE="false"
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            RELEASE="true"
            if [ -n "$INPUT_VERSION" ]; then
              VERSION="$INPUT_VERSION"
            else
              LATEST="$(git tag -l 'network-v*' | sed 's/^network-v//' | sort -V | tail -n1)"
              if [ -z "$LATEST" ]; then
                VERSION="1.0.0"
              else
                IFS='.' read -r MAJOR MINOR PATCH <<< "$LATEST"
                PATCH=$((PATCH + 1))
                VERSION="${MAJOR}.${MINOR}.${PATCH}"
              fi
            fi
          elif [[ "$REF" == refs/tags/network-v* ]]; then
            RELEASE="true"
            VERSION="${GITHUB_REF_NAME#network-v}"
          else
            VERSION="0.0.0-dev"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "tag=network-v$VERSION" >> "$GITHUB_OUTPUT"
          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
          echo "Computed version: $VERSION (release=$RELEASE)"

  build:
    name: build (${{ matrix.goos }}/${{ matrix.goarch }})
    needs: [test, prepare]
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - { goos: windows, goarch: amd64 }
          - { goos: windows, goarch: arm64 }
          - { goos: linux, goarch: amd64 }
          - { goos: linux, goarch: arm64 }
          - { goos: darwin, goarch: amd64 }
          - { goos: darwin, goarch: arm64 }
    steps:
      - uses: actions/checkout@v5
      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: apps/network-proxy/go.mod
          cache-dependency-path: apps/network-proxy/go.sum
      - name: Cross-compile (CGO disabled, reproducible)
        working-directory: apps/network-proxy
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: 0
          # The version comes from an output and is only used as a Go linker
          # value: keep it in `env`, never interpolate it into the script body.
          VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          mkdir -p dist
          BIN="lumiboot-network"
          if [ "$GOOS" = "windows" ]; then BIN="$BIN.exe"; fi
          go build -trimpath \
            -ldflags="-s -w -X 'github.com/lumiboot/network-proxy/internal/server.Version=$VERSION'" \
            -o "dist/$BIN" ./cmd/lumiboot-network
          if [ "$GOOS" = "windows" ]; then
            mv "dist/$BIN" "dist/LumiBoot-Network-$GOOS-$GOARCH.exe"
          else
            tar -czf "dist/LumiBoot-Network-$GOOS-$GOARCH.tar.gz" -C dist "$BIN"
            rm "dist/$BIN"
          fi
          ls -la dist
      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: LumiBoot-Network-${{ matrix.goos }}-${{ matrix.goarch }}
          path: apps/network-proxy/dist/LumiBoot-Network-*
          if-no-files-found: error

  smoke:
    # Answer to "do not treat cross-compilation as proof that it works":
    # each binary is built NATIVELY on its OS and then
    # actually EXECUTED with `--version` and `--help`. Fails if the binary does
    # not start.
    name: smoke (${{ matrix.os }})
    needs: test
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-24.04, ext: '' }
          - { os: windows-latest, ext: '.exe' }
          - { os: macos-15-intel, ext: '' }
          - { os: macos-15, ext: '' }
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5
      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: apps/network-proxy/go.mod
          cache-dependency-path: apps/network-proxy/go.sum
      - name: Native build
        working-directory: apps/network-proxy
        env:
          CGO_ENABLED: 0
        run: go build -trimpath -o "smoke-bin${{ matrix.ext }}" ./cmd/lumiboot-network
      - name: Actually start the binary (--version and --help)
        working-directory: apps/network-proxy
        shell: bash
        run: |
          ./smoke-bin${{ matrix.ext }} --version
          ./smoke-bin${{ matrix.ext }} --help

  package-macos:
    # V1: UNIVERSAL macOS binary covering Intel and Apple Silicon, packaged as
    # a `.tar.gz` archive, no DMG. Built with `lipo -create` from the two
    # darwin binaries produced by `build`. The web app must NEVER advertise a
    # file that is not produced: `macos` points to this universal build.
    name: package universal macOS (lipo)
    needs: build
    runs-on: macos-15
    steps:
      - name: Download darwin/amd64
        uses: actions/download-artifact@v7
        with:
          name: LumiBoot-Network-darwin-amd64
          path: darwin-amd64
      - name: Download darwin/arm64
        uses: actions/download-artifact@v7
        with:
          name: LumiBoot-Network-darwin-arm64
          path: darwin-arm64
      - name: Build the universal binary (lipo) + tar.gz
        run: |
          set -euo pipefail
          mkdir -p work/amd64 work/arm64 dist
          tar -xzf darwin-amd64/LumiBoot-Network-darwin-amd64.tar.gz -C work/amd64
          tar -xzf darwin-arm64/LumiBoot-Network-darwin-arm64.tar.gz -C work/arm64
          lipo -create work/amd64/lumiboot-network work/arm64/lumiboot-network -output dist/lumiboot-network
          lipo -info dist/lumiboot-network
          tar -czf dist/LumiBoot-Network-macos-universal.tar.gz -C dist lumiboot-network
          rm dist/lumiboot-network
          ls -la dist
      - name: Upload universal artifact
        uses: actions/upload-artifact@v7
        with:
          name: LumiBoot-Network-macos-universal
          path: dist/LumiBoot-Network-macos-universal.tar.gz
          if-no-files-found: error

  release:
    # Automatic publication: CI creates a GitHub Release IN THIS REPO containing
    # a SINGLE ZIP with all binaries, `manifest.json` and `SHA256SUMS`. It runs
    # on every `network-v*` tag and on every `workflow_dispatch`, whose optional
    # forced version defaults to an auto-increment from the last `network-v*`
    # tag, or 1.0.0 if there is none.
    # The ZIP is the official distribution channel: its assets are NEVER
    # committed to Git. `apps/web/public/downloads/` only tracks
    # `manifest.json` and `SHA256SUMS`; for local development, download the
    # release ZIP and extract it there, because the manifest points to
    # `/downloads/...`.
    # `actions/checkout` is REQUIRED: without it, `gh release create` fails
    # with "fatal: not a git repository".
    name: release (full zip)
    needs: [prepare, build, package-macos, smoke]
    if: needs.prepare.outputs.release == 'true'
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - name: Checkout (required by gh release)
        uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - name: Download all artifacts
        uses: actions/download-artifact@v7
        with:
          merge-multiple: true
          path: dist
      # After `merge-multiple`, `dist/` also holds the per-architecture darwin
      # archives that `package-macos` composed into the universal macOS build.
      # They are NOT published, so a `sha256sum LumiBoot-Network-*` glob would
      # add two entries that `sha256sum -c SHA256SUMS` can never resolve for a
      # user. `manifest.json` is the single source of truth for what is
      # published: it is written FIRST, then `SHA256SUMS` is derived from it,
      # file by file, in manifest order, so the output is deterministic.
      - name: Generate manifest.json
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          python3 - <<'PY'
          import hashlib
          import json
          import os
          from datetime import datetime, timezone

          files = {
              "windows-x64": "LumiBoot-Network-windows-amd64.exe",
              "windows-arm64": "LumiBoot-Network-windows-arm64.exe",
              "linux-x64": "LumiBoot-Network-linux-amd64.tar.gz",
              "linux-arm64": "LumiBoot-Network-linux-arm64.tar.gz",
              "macos": "LumiBoot-Network-macos-universal.tar.gz",
          }

          def entry(platform, filename):
              path = os.path.join("dist", filename)
              digest = hashlib.sha256()
              with open(path, "rb") as handle:
                  for chunk in iter(lambda: handle.read(1 << 20), b""):
                      digest.update(chunk)
              data = {
                  "file": filename,
                  "url": f"/downloads/{filename}",
                  "size": os.path.getsize(path),
                  "sha256": digest.hexdigest(),
                  "published": True,
              }
              if platform == "macos":
                  data["signed"] = False
                  data["notarized"] = False
              return data

          manifest = {
              "version": os.environ["VERSION"],
              "wispVersion": 1,
              "generatedAt": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
              "platforms": {name: entry(name, fname) for name, fname in files.items()},
          }

          with open(os.path.join("dist", "manifest.json"), "w", encoding="utf-8") as handle:
              json.dump(manifest, handle, indent=2)
              handle.write("\n")
          PY
      - name: Generate SHA256SUMS
        run: |
          set -euo pipefail
          cd dist
          python3 - > "$RUNNER_TEMP/published-files.txt" <<'PY'
          import json

          with open("manifest.json", encoding="utf-8") as handle:
              manifest = json.load(handle)

          for entry in manifest["platforms"].values():
              print(entry["file"])
          PY
          mapfile -t files < "$RUNNER_TEMP/published-files.txt"
          sha256sum -- "${files[@]}" > SHA256SUMS
          cat SHA256SUMS
      - name: Create the full ZIP
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          cd dist
          zip -r "../LumiBoot-Network-proxy-${VERSION}.zip" .
          cd ..
          ls -la "LumiBoot-Network-proxy-${VERSION}.zip"
      - name: Create the GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ needs.prepare.outputs.version }}
          TAG: ${{ needs.prepare.outputs.tag }}
        run: |
          gh release create "$TAG" "LumiBoot-Network-proxy-${VERSION}.zip" \
            --title "LumiBoot Network Proxy ${VERSION}" \
            --generate-notes \
            --notes $'### Usage\nDownload the ZIP attached to this release and extract it locally. These binaries are NEVER committed to Git: `apps/web/public/downloads/` only tracks `manifest.json` and `SHA256SUMS`.\n\nFor local development, extract the ZIP into `apps/web/public/downloads/` so the `/downloads/...` URLs resolve.\n\nWarning: **unsigned / not notarized** binaries: Windows (SmartScreen) and macOS (Gatekeeper) will show a warning.'

  sign-windows:
    # OPTIONAL Authenticode signing: skipped when the secrets are absent.
    # Never blocks the initial publication: no `needs` points to this job.
    name: Windows signing (optional)
    needs: [build]
    if: startsWith(github.ref, 'refs/tags/network-v') && vars.ENABLE_SIGNING == 'true'
    runs-on: windows-latest
    env:
      HAS_WIN_CERT: ${{ secrets.WINDOWS_CERT_PFX_BASE64 != '' && secrets.WINDOWS_CERT_PASSWORD != '' }}
    steps:
      - name: Download the .exe files
        if: env.HAS_WIN_CERT == 'true'
        uses: actions/download-artifact@v7
        with:
          pattern: LumiBoot-Network-windows-*
          merge-multiple: true
          path: dist
      - name: Sign with signtool (Authenticode + timestamp)
        if: env.HAS_WIN_CERT == 'true'
        shell: powershell
        env:
          CERT_PFX_BASE64: ${{ secrets.WINDOWS_CERT_PFX_BASE64 }}
          CERT_PASSWORD: ${{ secrets.WINDOWS_CERT_PASSWORD }}
        run: |
          $pfx = Join-Path $env:RUNNER_TEMP "lumiboot-cert.pfx"
          [IO.File]::WriteAllBytes($pfx, [Convert]::FromBase64String($env:CERT_PFX_BASE64))
          $signtool = (Get-Command signtool -ErrorAction SilentlyContinue)?.Source
          if (-not $signtool) {
            $signtool = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin" -Recurse -Filter signtool.exe -ErrorAction SilentlyContinue |
              Sort-Object FullName -Descending | Select-Object -First 1 -ExpandProperty FullName
          }
          if (-not $signtool) { throw "signtool not found (Windows SDK missing)" }
          try {
            Get-ChildItem -LiteralPath "dist" -Filter "*.exe" | ForEach-Object {
              & $signtool sign /fd SHA256 /f $pfx /p $env:CERT_PASSWORD /tr http://timestamp.digicert.com /td SHA256 $_.FullName
              if ($LASTEXITCODE -ne 0) { throw "signtool failed for $($_.Name)" }
              & $signtool verify /pa $_.FullName
              if ($LASTEXITCODE -ne 0) { throw "verification failed for $($_.Name)" }
            }
          } finally {
            Remove-Item -LiteralPath $pfx -Force -ErrorAction SilentlyContinue
          }
      - name: Upload signed .exe files
        if: env.HAS_WIN_CERT == 'true'
        uses: actions/upload-artifact@v7
        with:
          name: LumiBoot-Network-windows-signed
          path: dist/*.exe
          if-no-files-found: error

  sign-macos:
    # OPTIONAL Apple signing + notarization: skipped when the secrets are
    # absent. Never blocks the initial publication.
    name: macOS signing (optional)
    needs: [build]
    if: startsWith(github.ref, 'refs/tags/network-v') && vars.ENABLE_SIGNING == 'true'
    runs-on: macos-15
    env:
      HAS_APPLE_CERT: ${{ secrets.APPLE_CERT_P12_BASE64 != '' && secrets.APPLE_CERT_PASSWORD != '' && secrets.APPLE_TEAM_ID != '' && secrets.APPLE_ID != '' && secrets.APPLE_APP_PASSWORD != '' }}
    steps:
      - name: Download the darwin archives
        if: env.HAS_APPLE_CERT == 'true'
        uses: actions/download-artifact@v7
        with:
          pattern: LumiBoot-Network-darwin-*
          merge-multiple: true
          path: dist
      - name: Sign (codesign) and notarize (notarytool)
        if: env.HAS_APPLE_CERT == 'true'
        env:
          APPLE_CERT_P12_BASE64: ${{ secrets.APPLE_CERT_P12_BASE64 }}
          APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
        run: |
          set -euo pipefail
          KEYCHAIN="$RUNNER_TEMP/lumiboot-sign.keychain-db"
          KEYCHAIN_PW="$(openssl rand -base64 32)"
          echo "$APPLE_CERT_P12_BASE64" | base64 --decode > "$RUNNER_TEMP/lumiboot-cert.p12"
          trap 'rm -f "$RUNNER_TEMP/lumiboot-cert.p12"; security delete-keychain "$KEYCHAIN" 2>/dev/null || true' EXIT
          security create-keychain -p "$KEYCHAIN_PW" "$KEYCHAIN"
          security set-keychain-settings -lut 21600 "$KEYCHAIN"
          security unlock-keychain -p "$KEYCHAIN_PW" "$KEYCHAIN"
          security import "$RUNNER_TEMP/lumiboot-cert.p12" -k "$KEYCHAIN" -P "$APPLE_CERT_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PW" "$KEYCHAIN"
          IDENTITY=$(security find-identity -v -p codesigning "$KEYCHAIN" | head -1 | sed -E 's/.*"(.*)".*/\1/')
          if [ -z "$IDENTITY" ]; then echo "No signing identity found."; exit 1; fi
          mkdir -p signed
          for archive in dist/LumiBoot-Network-darwin-*.tar.gz; do
            workdir="$(mktemp -d)"
            tar -xzf "$archive" -C "$workdir"
            bin="$workdir/lumiboot-network"
            codesign --force --deep --options runtime --timestamp \
              --sign "$IDENTITY" "$bin"
            codesign --verify --verbose "$bin"
            ditto -c -k --keepParent "$bin" "signed/$(basename "$archive" .tar.gz)-signed.zip"
            xcrun notarytool submit "signed/$(basename "$archive" .tar.gz)-signed.zip" \
              --team-id "$APPLE_TEAM_ID" --apple-id "$APPLE_ID" \
              --password "$APPLE_APP_PASSWORD" --wait
            rm -rf "$workdir"
          done
          ls -la signed
      - name: Upload signed/notarized archives
        if: env.HAS_APPLE_CERT == 'true'
        uses: actions/upload-artifact@v7
        with:
          name: LumiBoot-Network-darwin-signed
          path: signed/*
          if-no-files-found: error