release.yml

name: Build release candidate

# Build the shipping bytes once. Only verification-publish.yml distributes them.
on:
  workflow_call:
    inputs:
      source_sha:
        type: string
        required: true
      version:
        type: string
        required: true
      artifact_name:
        type: string
        required: true

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: develop
          fetch-depth: 0
          persist-credentials: false
      - name: Only build reviewed develop history
        env:
          SOURCE_SHA: ${{ inputs.source_sha }}
        run: |
          set -euo pipefail
          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
          git merge-base --is-ancestor "$SOURCE_SHA" origin/develop
  build:
    needs: validate
    runs-on: ubuntu-latest
    environment: release
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ inputs.source_sha }}
          persist-credentials: false

      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          cache: false

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: |
            .
            firmware/obc-fw-nrf54l
            firmware/obc-boot
          key: release

      - name: Install RISC-V GCC for the FLPR blob
        run: sudo apt-get update && sudo apt-get install -y gcc-riscv64-unknown-elf

      - name: Resolve candidate version
        env:
          VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          [[ "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$ ]]
          echo "VERSION=$VERSION" >> "$GITHUB_ENV"

      - name: Tag ↔ crate version guard
        run: |
          set -euo pipefail
          tag_core="${VERSION#v}"; tag_core="${tag_core%%-*}"; tag_core="${tag_core%%+*}"
          crate_ver=$(grep -m1 '^version = ' firmware/obc-fw-nrf54l/Cargo.toml | sed -E 's/.*"([^"]+)".*/\1/')
          if [ "$tag_core" != "$crate_ver" ]; then
            echo "::error::tag $VERSION (core $tag_core) != board crate version $crate_ver in firmware/obc-fw-nrf54l/Cargo.toml"
            echo "::error::bump the crate version to match the tag (or tag the version the crate already declares)"
            exit 1
          fi
          echo "tag core $tag_core matches the board crate version $crate_ver"

      - name: Refuse a real release that still trusts the committed TEST key
        run: |
          set -euo pipefail
          RELEASE_KEY=$(tr -d '\r\n' < firmware/obc-dfu/keys/obcu-release.pub)
          TEST_KEY=$(tr -d '\r\n' < firmware/obc-dfu/keys/test/obcu-test.pub)
          if [ "$RELEASE_KEY" = "$TEST_KEY" ]; then
            echo "::error::obcu-release.pub still holds the committed TEST key — anyone can sign an image this firmware installs."
            echo "::error::Rotate it and set OBCU_SIGNING_SEED before publishing a real release (firmware/obc-dfu/keys/README.md)."
            exit 1
          fi
          echo "obcu-release.pub is not the committed test key — OK to publish a signed release"

      - name: Build obc-fw-nrf54l (release)
        working-directory: firmware/obc-fw-nrf54l
        run: cargo build --release --locked

      - name: Build obc-boot (release)
        working-directory: firmware/obc-boot
        run: cargo build --release --locked

      - name: Wrap + sign UPDATE.BIN (objcopy → obc-mkimage wrap --sign-seed → inspect gate)
        env:
          OBCU_SIGNING_SEED: ${{ secrets.OBCU_SIGNING_SEED }}
        run: |
          set -euo pipefail
          rustup component add llvm-tools
          OBJCOPY=$(find "$(rustc --print sysroot)" -name llvm-objcopy | head -1)
          APP_ELF=firmware/obc-fw-nrf54l/target/thumbv8m.main-none-eabihf/release/obc-fw-nrf54l
          "$OBJCOPY" -O binary "$APP_ELF" app.bin
          if [ -n "${OBCU_SIGNING_SEED:-}" ]; then
            echo "signing with the OBCU_SIGNING_SEED environment secret"
            SIGN_ARGS=(--sign-seed-env OBCU_SIGNING_SEED)
          else
            echo "::error::OBCU_SIGNING_SEED is not set — refusing to publish a real release signed by the committed TEST key."
            echo "::error::Set the secret in the 'release' environment (firmware/obc-dfu/keys/README.md)."
            exit 1
          fi
          cargo run -p obc-mkimage --release --locked -- \
            wrap --bin app.bin --version "$VERSION" --out UPDATE.BIN "${SIGN_ARGS[@]}"
          echo "::group::obc-mkimage inspect UPDATE.BIN"
          cargo run -p obc-mkimage --release --locked -- \
            inspect UPDATE.BIN
          echo "::endgroup::"

      - name: Stage release artifacts + checksums
        run: |
          set -euo pipefail
          mkdir -p dist
          cp UPDATE.BIN dist/UPDATE.BIN
          cp firmware/obc-boot/target/thumbv8m.main-none-eabihf/release/obc-boot dist/obc-boot.elf
          cp firmware/obc-fw-nrf54l/target/thumbv8m.main-none-eabihf/release/obc-fw-nrf54l dist/obc-fw-nrf54l.elf
          ( cd dist && sha256sum UPDATE.BIN obc-boot.elf obc-fw-nrf54l.elf > SHA256SUMS.txt )
          echo "::group::SHA256SUMS.txt"
          cat dist/SHA256SUMS.txt
          echo "::endgroup::"

      - name: Generate manifest.json
        env:
          FW_BASE_URL: ${{ vars.OBC_FW_BASE_URL || 'https://updates.openbikecomputer.com' }}
        run: |
          set -euo pipefail
          BYTES=$(stat -c %s dist/UPDATE.BIN)
          SHA=$(sha256sum dist/UPDATE.BIN | cut -d' ' -f1)
          URL="${FW_BASE_URL%/}/fw/${VERSION}/UPDATE.BIN"
          NOTES="${{ github.server_url }}/${{ github.repository }}/releases/tag/${VERSION}"
          jq -n \
            --arg version "$VERSION" \
            --argjson bytes "$BYTES" \
            --arg sha256 "$SHA" \
            --arg url "$URL" \
            --arg notes "$NOTES" \
            '{version: $version, bytes: $bytes, sha256: $sha256, url: $url, notes: $notes}' \
            > dist/manifest.json
          echo "::group::manifest.json"
          cat dist/manifest.json
          echo "::endgroup::"

      - name: Retain exact candidate firmware
        uses: actions/upload-artifact@v4
        with:
          name: ${{ inputs.artifact_name }}
          path: dist/*
          retention-days: 90
          if-no-files-found: error