sif/.github/workflows/release.yml

name: release

on:
  push:
    branches: [main]

permissions:
  contents: write
  packages: write

jobs:
  test:
    uses: ./.github/workflows/runtest.yml

  build-and-release:
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - name: set up go
        uses: actions/setup-go@v5
        with:
          go-version: "1.24"

      - name: build for windows
        run: |
          GOOS=windows GOARCH=amd64 go build -o sif-windows-amd64.exe ./cmd/sif
          GOOS=windows GOARCH=386 go build -o sif-windows-386.exe ./cmd/sif

      - name: build for macOS
        run: |
          GOOS=darwin GOARCH=amd64 go build -o sif-macos-amd64 ./cmd/sif
          GOOS=darwin GOARCH=arm64 go build -o sif-macos-arm64 ./cmd/sif

      - name: build for linux
        run: |
          GOOS=linux GOARCH=amd64 go build -o sif-linux-amd64 ./cmd/sif
          GOOS=linux GOARCH=386 go build -o sif-linux-386 ./cmd/sif
          GOOS=linux GOARCH=arm64 go build -o sif-linux-arm64 ./cmd/sif

      - name: package releases with modules
        run: |
          for binary in sif-linux-amd64 sif-linux-386 sif-linux-arm64 sif-macos-amd64 sif-macos-arm64; do
            mkdir -p "dist/${binary}"
            cp "${binary}" "dist/${binary}/sif"
            cp -r modules "dist/${binary}/"
            tar -czf "${binary}.tar.gz" -C dist "${binary}"
          done
          for binary in sif-windows-amd64 sif-windows-386; do
            mkdir -p "dist/${binary}"
            cp "${binary}.exe" "dist/${binary}/sif.exe"
            cp -r modules "dist/${binary}/"
            cd dist && zip -r "../${binary}.zip" "${binary}" && cd ..
          done

      - name: build debian packages
        run: |
          VERSION="0.1.0-$(git rev-parse --short HEAD)"

          declare -A arch_map=(
            ["sif-linux-amd64"]="amd64"
            ["sif-linux-386"]="i386"
            ["sif-linux-arm64"]="arm64"
          )

          for binary in sif-linux-amd64 sif-linux-386 sif-linux-arm64; do
            arch="${arch_map[$binary]}"
            pkg_dir="sif_${VERSION}_${arch}"

            mkdir -p "${pkg_dir}/DEBIAN"
            mkdir -p "${pkg_dir}/usr/bin"
            mkdir -p "${pkg_dir}/usr/share/sif/modules"

            cp "${binary}" "${pkg_dir}/usr/bin/sif"
            chmod 755 "${pkg_dir}/usr/bin/sif"
            cp -r modules/* "${pkg_dir}/usr/share/sif/modules/"

            cat > "${pkg_dir}/DEBIAN/control" << EOF
          Package: sif
          Version: ${VERSION}
          Section: security
          Priority: optional
          Architecture: ${arch}
          Maintainer: vmfunc <celeste@router.sex>
          Homepage: https://github.com/vmfunc/sif
          Description: Modular pentesting toolkit
           sif is a fast, concurrent, and extensible pentesting toolkit written in Go.
           It supports multiple scan types including directory fuzzing, subdomain
           enumeration, port scanning, and vulnerability detection.
          EOF

            dpkg-deb --build "${pkg_dir}"
          done

      - name: generate checksums
        run: |
          sha256sum \
            sif-windows-amd64.zip \
            sif-windows-386.zip \
            sif-macos-amd64.tar.gz \
            sif-macos-arm64.tar.gz \
            sif-linux-amd64.tar.gz \
            sif-linux-386.tar.gz \
            sif-linux-arm64.tar.gz \
            sif_*.deb \
            > checksums-sha256.txt

      - name: generate SBOM
        uses: anchore/sbom-action@v0
        with:
          artifact-name: sbom.spdx.json
          output-file: sbom.spdx.json

      - name: set release version
        run: echo "RELEASE_VERSION=$(git rev-parse --short HEAD)" >> $GITHUB_ENV

      - name: create release and upload assets
        uses: softprops/action-gh-release@v2
        with:
          tag_name: automated-release-${{ env.RELEASE_VERSION }}
          name: Release ${{ env.RELEASE_VERSION }}
          body: |
            Automated release v${{ env.RELEASE_VERSION }}

            ## Assets

            Each archive contains the sif binary and built-in modules.

            - Windows (64-bit): `sif-windows-amd64.zip`
            - Windows (32-bit): `sif-windows-386.zip`
            - macOS (64-bit Intel): `sif-macos-amd64.tar.gz`
            - macOS (64-bit ARM): `sif-macos-arm64.tar.gz`
            - Linux (64-bit): `sif-linux-amd64.tar.gz`
            - Linux (32-bit): `sif-linux-386.tar.gz`
            - Linux (64-bit ARM): `sif-linux-arm64.tar.gz`
            - Debian/Ubuntu (64-bit): `sif_*_amd64.deb`
            - Debian/Ubuntu (32-bit): `sif_*_i386.deb`
            - Debian/Ubuntu (64-bit ARM): `sif_*_arm64.deb`

            ## Verification

            ```bash
            sha256sum -c checksums-sha256.txt
            ```

            For more details, check the [commit history](https://github.com/${{ github.repository }}/commits/main).
          draft: false
          prerelease: false
          files: |
            sif-windows-amd64.zip
            sif-windows-386.zip
            sif-macos-amd64.tar.gz
            sif-macos-arm64.tar.gz
            sif-linux-amd64.tar.gz
            sif-linux-386.tar.gz
            sif-linux-arm64.tar.gz
            sif_*_amd64.deb
            sif_*_i386.deb
            sif_*_arm64.deb
            checksums-sha256.txt
            sbom.spdx.json
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: push to cloudsmith
        env:
          CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
        run: |
          pip install cloudsmith-cli
          for deb in sif_*.deb; do
            cloudsmith push deb sif/deb/any-distro/any-version "$deb" -k "$CLOUDSMITH_API_KEY"
          done