name: Upload Release Artifact
description: >-
  Upload release artifact along with an attestation.  The action assumes that
  the llvm-project repository has already been checked out.
inputs:
  release-version:
    description: >-
      The release where the artifact will be attached.
    required: true
  upload:
    description: >-
      Whether or not to upload the file and attestation to the release.  If this
      is set to false, then the file will be uploaded to the job as an artifact,
      but no atteastion will be generated and the artifact won't be uploaded
      to the release.
    default: true
  attestation-name:
    description: >-
      This will be used for the artifact name that is attached to the workflow and
      will be used as the basename for the attestation file which will be called
      $attestation-name.jsonl.  If this is not set, it will default
      to the falue of `files`.
    required: false
  artifact-id:
    description: >-
      Artifact id of the artifact with the files to upload.
    required: true
  digest:
    description: >-
      sha256 digest to verify the authenticity of the files being uploaded.
    required: true
  LLVM_TOKEN_GENERATOR_CLIENT_ID:
    description: >-
      Client ID for our GitHub App we use for generating access tokens.
    required: true
  LLVM_TOKEN_GENERATOR_PRIVATE_KEY:
    description: >-
      Private key for our GitHub App we use for generating access tokens.
    required: true

runs:
  using: "composite"
  steps:
    - name: Validate Input
      uses: ./.github/workflows/validate-release-version
      with:
        release-version: ${{ inputs.release-version }}

    - name: Download Artifact
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      id: download-artifact
      with:
        artifact-ids: ${{ inputs.artifact-id }}
        path: downloads

    # In theory github artifacts are immutable so we could just rely on using
    # the artifact-id to download it, but just to be extra safe we want to
    # generated a digest for the files we are uploading so we can verify it
    # when downloading.
    # See also: https://irsl.medium.com/github-artifact-immutability-is-a-lie-9b6244095694
    - name: Verify Files
      shell: bash
      env:
        INPUTS_DIGEST: ${{ inputs.digest }}
        DOWNLOAD_PATH: ${{ steps.download-artifact.outputs.download-path }}
      run: |
        digest_file="sha256"
        echo "$INPUTS_DIGEST -" > $digest_file
        cat $DOWNLOAD_PATH/* | sha256sum -c $digest_file

    - name: Attest Build Provenance
      id: provenance
      # TODO(boomanaiden154): This is now a thin wrapper around actions/attest.
      # We should eventually move over to that.
      uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
      with:
        subject-path: ${{ steps.download-artifact.outputs.download-path }}/*

    # Generate an attestation copy for each file to make it easier for users to verify
    # the files.
    - name: Rename attestation file
      shell: bash
      env:
        DOWNLOAD_PATH: ${{ steps.download-artifact.outputs.download-path }}
        BUNDLE_PATH: ${{ steps.provenance.outputs.bundle-path }}
      run: |
        for f in $DOWNLOAD_PATH/*; do
          cp $BUNDLE_PATH $(basename $f).jsonl
        done

    - name: Upload Build Provenance
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: ${{ inputs.attestation-name }}
        path: |
          *.jsonl

    - name: Install Python Requirements
      if: inputs.upload == 'true'
      shell: bash
      run: |
        pip install --require-hashes -r ./llvm/utils/git/requirements.txt

    - name: Check Permissions
      uses: ./.github/workflows/require-team-membership
      with:
        team-slug: llvm-release-managers
        LLVM_TOKEN_GENERATOR_CLIENT_ID: ${{ inputs.LLVM_TOKEN_GENERATOR_CLIENT_ID }}
        LLVM_TOKEN_GENERATOR_PRIVATE_KEY: ${{ inputs.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }}

    - name: Upload Release
      shell: bash
      if: inputs.upload == 'true'
      env:
        INPUTS_RELEASE_VERSION: ${{ inputs.release-version }}
        DOWNLOAD_PATH: ${{ steps.download-artifact.outputs.download-path }}
      run: |
        ./llvm/utils/release/github-upload-release.py \
        --token ${{ github.token }} \
        --release "$INPUTS_RELEASE_VERSION" \
        upload \
        --files $DOWNLOAD_PATH/* *.jsonl