release.yml

name: "Release"

on:
  push:
    tags:
      - "*"

permissions:
  contents: read

env:
  COMPOSER_FLAGS: "--ansi --no-interaction --no-progress --no-suggest --prefer-dist"

jobs:
  build:
    permissions:
      contents: write # for actions/create-release to create a release
      id-token: write # for actions/attest-build-provenance to create a attestation certificate
      attestations: write # for actions/attest-build-provenance to upload the attestation
    name: Upload Release Asset
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: shivammathur/setup-php@0f7f1d08e3e32076e51cae65eb0b0c871405b16e # 2.34.1
        with:
          coverage: "none"
          extensions: "intl"
          ini-values: "memory_limit=-1"
          php-version: "8.1"

      - name: "Install dependencies from composer.lock using composer binary provided by system"
        run: "composer install ${{ env.COMPOSER_FLAGS }}"

      - name: "Run install again using composer binary from source"
        run: "bin/composer install ${{ env.COMPOSER_FLAGS }}"

      - name: "Validate composer.json"
        run: "bin/composer validate"

      - name: Build phar file
        run: "php -d phar.readonly=0 bin/compile"

      - name: Generate build provenance attestation
        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
        with:
          subject-path: '${{ github.workspace }}/composer.phar'

      - name: Configure GPG key and sign phar
        run: |
          mkdir -p ~/.gnupg/
          chmod 0700 ~/.gnupg/
          echo "$GPG_SIGNING_KEY" > ~/.gnupg/private.key
          gpg --import ~/.gnupg/private.key
          gpg -u contact@packagist.com --detach-sign --output composer.phar.asc composer.phar
        env:
          GPG_SIGNING_KEY: |
            ${{ secrets.GPG_KEY_161DFBE342889F01DDAC4E61CBB3D576F2A0946F }}

      - name: Create release
        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
        with:
          body: TODO
          name: ${{ github.ref_name }}
          tag_name: ${{ github.ref_name }}
          draft: true
          files: |
            composer.phar
            composer.phar.asc
          fail_on_unmatched_files: true

      # This step requires a secret token with `pull` access to composer/docker. The default
      # secrets.GITHUB_TOKEN is scoped to this repository only which is not sufficient.
      - name: "Open issue @ Docker repository"
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          github-token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
          script: |
            // create new issue on Docker repository
            github.rest.issues.create({
              owner: "${{ github.repository_owner }}",
              repo: "docker",
              title: `New Composer tag: ${{ github.ref_name }}`,
              body: `https://github.com/${{ github.repository }}/releases/tag/${{ github.ref_name }}`,
            });