release.yml

name: release

on:
  release:
    types: [published]

permissions:
  contents: read
  id-token: write
  attestations: write

jobs:
  publish:
    name: publish artifacts
    timeout-minutes: 60
    runs-on: ledgerhq-shared-small
    steps:
      - name: Login to Ledger Artifactory
        timeout-minutes: 10
        id: jfrog-login
        uses: LedgerHQ/actions-security/actions/jfrog-login@actions/jfrog-login-1

      - name: Checkout
        timeout-minutes: 10
        uses: actions/checkout@v4

      - name: Setup python / PDM
        timeout-minutes: 10
        uses: ./.github/actions/pdm

      - name: Install dependencies
        timeout-minutes: 10
        run: |
          pdm install --dev --check --frozen-lockfile
          pdm install --plugins
        env:
          FURY_TOKEN: ${{ secrets.PYPI_DEPLOY_TOKEN}}

      - name: Create directories
        timeout-minutes: 10
        run: mkdir -p dist build/exe

      - name: Build library artifacts
        timeout-minutes: 10
        run: pdm build

      - name: Build standalone application
        timeout-minutes: 10
        run: pdm exe

      - name: Generate library build attestations
        timeout-minutes: 10
        uses: LedgerHQ/actions-security/actions/attest@actions/attest-1
        with:
          subject-path: dist/*

      - name: Generate application build attestations
        timeout-minutes: 10
        uses: LedgerHQ/actions-security/actions/attest@actions/attest-1
        with:
          subject-path: build/exe/*

      - name: Sign library artifacts
        timeout-minutes: 10
        uses: LedgerHQ/actions-security/actions/sign-blob@actions/sign-blob-1
        with:
          path: dist

      - name: Sign application artifacts
        timeout-minutes: 10
        uses: LedgerHQ/actions-security/actions/sign-blob@actions/sign-blob-1
        with:
          path: build/exe

      - name: Upload library artifacts to Ledger Artifactory repository
        timeout-minutes: 10
        env:
          PDM_PUBLISH_REPO: https://jfrog.ledgerlabs.net/artifactory/api/pypi/vault-pypi-prod-green
          PDM_PUBLISH_USERNAME: ${{ steps.jfrog-login.outputs.oidc-user }}
          PDM_PUBLISH_PASSWORD: ${{ steps.jfrog-login.outputs.oidc-token }}
        run: pdm publish --no-build

      - name: Attach standalone application to Github release
        uses: svenstaro/upload-release-action@v2
        timeout-minutes: 10
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          tag: ${{ github.ref }}
          file: build/exe/erc7730
          asset_name: erc7730
          overwrite: true