build.yml

name: Build

on:
  push:
    tags: [ "v*.*.*" ]
    branches: [ "main" ]
  pull_request:
    branches: [ "**" ]
  merge_group:
  schedule:
  - cron: '45 1 * * *'

# Declare default permissions as read-only.
permissions: read-all

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
  cancel-in-progress: true

env:
  BUILD_ID: build-${{ github.run_id }}
  REGISTRY: ghcr.io/${{ github.repository_owner }}/fts

jobs:
  test:
    env:
      MAVEN_ARGS: -B -U -T1C -Dfts.retryTimeout=false --also-make --projects ${{ matrix.agent }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Used in `settings.xml` generated by actions/setup-java
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        agent: [ clinical-domain-agent, trust-center-agent, research-domain-agent ]

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

    - name: Checkout
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Set up JDK 21
      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
      with:
        distribution: 'temurin'
        java-version: 21
        cache: 'maven'
        cache-dependency-path: |
          pom.xml
          {api,util,test-util}/pom.xml
          ${{ matrix.agent }}/pom.xml

    - name: Setup Keycloak
      working-directory: .github/test
      run: docker compose -f oauth2/compose.yaml up --build --wait

    - name: Run Tests
      run: |
        # shellcheck disable=SC2086
        mvn ${MAVEN_ARGS} verify

    - name: Generate Code Coverage Report
      run: |
        # shellcheck disable=SC2086
        mvn ${MAVEN_ARGS} jacoco:report-aggregate@report

    - name: Upload Coverage to Codecov
      uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        fail_ci_if_error: true

  build-jar:
    env:
      MAVEN_ARGS: -B -U -T1C -Dfts.retryTimeout=false --also-make --projects ${{ matrix.agent }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Used in `settings.xml` generated by actions/setup-java
      COMMIT_TAG: ${{ github.ref_type == 'tag' && github.ref_name || '' }}
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        agent: [ clinical-domain-agent, trust-center-agent, research-domain-agent ]
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

    - name: Checkout
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Set up JDK 21
      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
      with:
        distribution: 'temurin'
        java-version: 21
        cache: 'maven'
        cache-dependency-path: |
          pom.xml
          {api,util}/pom.xml
          ${{ matrix.agent }}/pom.xml

    - name: Build Agent
      run: |
        # shellcheck disable=SC2086
        mvn ${MAVEN_ARGS} -DskipTests package ${COMMIT_TAG:+-Drevision=${COMMIT_TAG#v}} \
          -Dproject.build.outputTimestamp="$(git log -1 --date="iso-strict-local" --format="%cd")"

    - name: Upload Jar
      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        name: ${{ matrix.agent }}-jar
        path: ${{ matrix.agent }}/target/${{ matrix.agent }}.jar
        if-no-files-found: error
        retention-days: 7

    - name: Upload Maven SBOM
      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        name: ${{ matrix.agent }}-sbom-mvn
        path: ${{ matrix.agent }}/target/sbom-mvn.json
        if-no-files-found: error
        retention-days: 7

  build-image:
    needs: [ build-jar ]
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        agent: [ clinical-domain-agent, trust-center-agent, research-domain-agent ]
    permissions:
      packages: write
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

    - name: Checkout
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Download Jar
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: ${{ matrix.agent }}-jar
        path: ${{ matrix.agent }}/target

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

    - name: Login to GHCR
      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Collect Info
      id: info
      run: |
        date="$(git log -1 --date="iso-strict-local" --format="%cd")"
        echo "commit_date=${date}" >>"${GITHUB_OUTPUT}"
        title="$(echo "${{ matrix.agent }}" | tr '-' ' ' | sed -E 's/(^| )([a-z])/\1\u\2/g')"
        echo "agent_name=${title}" >>"${GITHUB_OUTPUT}"
        abbr="$(echo "${title}" | tr -cd '[:upper:]')"
        echo "agent_abbr=${abbr}" >>"${GITHUB_OUTPUT}"

    - name: Generate Container Image Metadata
      id: meta
      uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
      with:
        images: ${{ env.REGISTRY }}/${{ matrix.agent }}
        labels: |
          org.opencontainers.image.description=SMITH FHIR Transfer Services ${{ steps.info.outputs.agent_name }}
          org.opencontainers.image.title=FTSnext ${{ steps.info.outputs.agent_abbr }}
          org.opencontainers.image.created=${{ steps.info.outputs.commit_date }}
        annotations: |
          org.opencontainers.image.description=SMITH FHIR Transfer Services ${{ steps.info.outputs.agent_name }}
          org.opencontainers.image.title=FTSnext ${{ steps.info.outputs.agent_abbr }}
          org.opencontainers.image.created=${{ steps.info.outputs.commit_date }}

    - name: Build and Push Container Image
      id: push
      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
      with:
        context: ${{ matrix.agent }}
        platforms: linux/amd64,linux/arm64
        push: true
        tags: ${{ env.REGISTRY }}/${{ matrix.agent }}:${{ env.BUILD_ID }}
        labels: ${{ steps.meta.outputs.labels }}
        annotations: ${{ steps.meta.outputs.annotations }}

    - name: Output Image Digest
      id: digest
      run: echo "${{ matrix.agent }}-digest=${{ steps.push.outputs.digest }}" >>"${GITHUB_OUTPUT}"
    outputs:
      clinical-domain-agent-digest: ${{ steps.digest.outputs.clinical-domain-agent-digest }}
      trust-center-agent-digest: ${{ steps.digest.outputs.trust-center-agent-digest }}
      research-domain-agent-digest: ${{ steps.digest.outputs.research-domain-agent-digest }}

  scan-image:
    needs: [ build-image ]
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        agent: [ clinical-domain-agent, trust-center-agent, research-domain-agent ]
    permissions:
      security-events: write
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

    - name: Run Trivy Vulnerability Scanner
      uses: aquasecurity/trivy-action@8519037888b189f13047371758f7aed2283c6b58 # 0.31.0
      with:
        image-ref: ${{ env.REGISTRY }}/${{ matrix.agent }}:${{ env.BUILD_ID }}
        format: sarif
        output: trivy-results.sarif
        severity: 'CRITICAL,HIGH'
        timeout: '15m0s'

    - name: Upload Trivy Scan Results to GitHub Security Tab
      uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
      with:
        sarif_file: trivy-results.sarif

    - name: Generate SBOM
      uses: aquasecurity/trivy-action@8519037888b189f13047371758f7aed2283c6b58 # 0.31.0
      with:
        image-ref: ${{ env.REGISTRY }}/${{ matrix.agent }}:${{ env.BUILD_ID }}
        format: cyclonedx
        output: sbom-trivy.json
        scan-type: image

    - name: Upload Trivy SBOM
      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        name: ${{ matrix.agent }}-sbom-trivy
        path: sbom-trivy.json
        if-no-files-found: error
        retention-days: 7

  agent-e2e-tests:
    needs: [ build-image ]
    env:
      MAVEN_ARGS: -B -U -T1C -Dfts.retryTimeout=false -Pe2e --also-make --projects ${{ matrix.agent }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Used in `settings.xml` generated by actions/setup-java
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        agent: [ clinical-domain-agent, trust-center-agent, research-domain-agent ]
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

    - name: Checkout
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Set up JDK 21
      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
      with:
        distribution: 'temurin'
        java-version: 21
        cache: 'maven'
        cache-dependency-path: |
          pom.xml
          {api,util,test-util}/pom.xml
          ${{ matrix.agent }}/pom.xml

    - name: Run Agent e2e Tests
      run: |
        # shellcheck disable=SC2086
        mvn ${MAVEN_ARGS} verify

  e2e-tests:
    needs: [ build-image ]
    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: .github/test
    env:
      TEST_SET_SIZE: 100

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

    - name: Checkout
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Pull Container Images
      run: make pull

    - name: Configure PATH
      run: echo "${GITHUB_WORKSPACE}/.github/scripts" >>"${GITHUB_PATH}"

    - name: Install Blazectl
      env:
        # renovate: datasource=github-release-attachments depName=samply/blazectl
        BLAZECTL_VERSION: v1.4.0
        BLAZECTL_CHECKSUM: ed411d59b4856667c7817235caacdd0933c59858a342f91982141e6ce2c0e663
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: install-blazectl.sh

    - name: Prepare Auth Failing Tests
      uses: mikefarah/yq@5a7e72a743649b1b3a47d1a1d8214f3453173c51 # v4.52.4
      with:
        cmd: >-
          cd .github/test/cd-agent/projects &&
          yq '.cohortSelector.trustCenterAgent.server.auth.basic.password = "wrong-password"' gics-consent-example.yaml >basic-fail.yaml &&
          yq 'del(.bundleSender.researchDomainAgent.server.auth)' gics-consent-example.yaml >oauth2-fail.yaml

    - name: Start Test Environment
      run: make generate-certs start

    - name: Download Test Data Checksums
      run: |
        make download-test-data-checksums

    - name: Cache Test Data
      id: cache-test-data
      uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
      with:
        path: .github/test/test-data
        key: test-data:${{ env.TEST_SET_SIZE }}@${{ hashFiles('.github/test/test-data/**/checksums.*') }}

    - name: Check Test Data
      id: check-test-data
      continue-on-error: true
      run: make check-test-data

    - name: Download Test Data
      if: steps.cache-test-data.outputs.cache-hit != 'true'
        || steps.check-test-data.outcome != 'success'
      run: make download-test-data

    - name: Upload Test Data
      run: make upload-test-data

    - name: Check Consent
      run: make check-consent

    - name: Run e2e with failing Basic Auth
      run: |
        LAST_UPDATED=$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)
        make transfer-all PROJECT=basic-fail
        make wait
        make check-status RESULTS_FILE=basic-fail.json
        check-resources.sh basic-fail.json "${LAST_UPDATED}"

    - name: Run e2e with failing OAuth2 Auth
      run: |
        LAST_UPDATED=$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)
        make transfer-all PROJECT=oauth2-fail
        make wait
        make check-status RESULTS_FILE=oauth2-fail.json
        check-resources.sh oauth2-fail.json "${LAST_UPDATED}"

    - name: Run e2e for all Consented Patients with gICS Consent
      run: |
        LAST_UPDATED=$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)
        make transfer-all PROJECT=gics-consent-example
        make wait
        make check-status RESULTS_FILE=example.json
        check-resources.sh example.json "${LAST_UPDATED}"
        check-pseudonymization.sh

    - name: Run e2e for 10 Consented Patients with FHIR Consent
      run: |
        LAST_UPDATED=$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)
        make transfer-with-fhir-consent-list PROJECT=fhir-consent-example TEST_SET_SIZE=10 
        make wait
        make check-status RESULTS_FILE=example-with-fhir-consent.json
        check-resources.sh example-with-fhir-consent.json "${LAST_UPDATED}"
        check-pseudonymization.sh

    - name: Collect Agent Logs
      if: failure() || cancelled()
      run: docker compose logs cd-agent tc-agent rd-agent

    - name: Collect MOSAIC Logs
      if: failure() || cancelled()
      run: docker compose logs gics gpas

    - name: Collect HDS Logs
      if: failure() || cancelled()
      run: docker compose logs cd-hds rd-hds

    - name: Collect DB Logs
      if: failure() || cancelled()
      run: docker compose logs gics-db gpas-db keystore

    - name: Collect OAuth2 Server Logs
      if: failure() || cancelled()
      run: docker compose logs keycloak

  combine-sboms:
    needs: [ build-jar, scan-image ]
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        agent: [ clinical-domain-agent, trust-center-agent, research-domain-agent ]
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

    - name: Checkout
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Install CycloneDX CLI
      env:
        # Check the cyclonedx binary against a pinned checksum here, it must be updated accordingly
        # renovate: datasource=github-release-attachments depName=CycloneDX/cyclonedx-cli
        CDX_CLI_VERSION: v0.30.0
        CDX_CLI_CHECKSUM: f89876326620f5fc78a9b27cc1af57d6ed13d019aab87490e1246a44a910babb
      run: .github/scripts/install-cyclonedx.sh

    - name: Download SBOMs
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        pattern: ${{ matrix.agent }}-sbom-*
        path: .
        merge-multiple: true

    - name: Merge SBOMS
      run: cyclonedx merge --input-files sbom-mvn.json sbom-trivy.json --output-file sbom.json

    - name: Upload Combined SBOM
      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        name: ${{ matrix.agent }}-sbom
        path: sbom.json
        if-no-files-found: error
        retention-days: 7

  tag-image:
    if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork
    # `test` must succeed before finally tagging (i.e., publishing) the image
    needs: [ test, build-image, scan-image, e2e-tests ]
    runs-on: ubuntu-24.04
    permissions:
      packages: write
    strategy:
      matrix:
        agent: [ clinical-domain-agent, trust-center-agent, research-domain-agent ]
    env:
      DIGEST: ${{ needs.build-image.outputs[format('{0}-digest', matrix.agent )]}}

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

    - name: Install SLSA Verifier
      uses: slsa-framework/slsa-verifier/actions/installer@ea584f4502babc6f60d9bc799dbbb13c1caa9ee6 # v2.7.1

    - name: Install crane
      uses: iarekylew00t/crane-installer@65372ffaef057f1714fed388fc3df3ad2c441aef # v4.0.10

    - name: Login to GHCR
      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Generate Container Image Metadata
      id: meta
      uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
      with:
        images: ghcr.io/${{ github.repository_owner }}/fts/${{ matrix.agent }}
        tags: |
          type=schedule
          type=ref,event=branch
          type=ref,event=pr
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=raw,value=latest,enable={{is_default_branch}}

    - name: Retag and Push Container Image
      run: |
        while read -r tag; do
          echo "${tag}" | cut -d: -f2 | xargs crane tag "${REGISTRY}/${{ matrix.agent }}@${DIGEST}"
        done <<<"${{ steps.meta.outputs.tags }}"

  sign-image:
    needs: [ build-image, combine-sboms ]
    runs-on: ubuntu-24.04
    permissions:
      packages: write
      id-token: write
    strategy:
      matrix:
        agent: [ clinical-domain-agent, trust-center-agent, research-domain-agent ]
    env:
      DIGEST: ${{ needs.build-image.outputs[format('{0}-digest', matrix.agent )]}}
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

    - name: Install cosign
      uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0

    - name: Download SBOM
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: ${{ matrix.agent }}-sbom
        path: .

    - name: Login to GHCR
      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Sign Image
      env:
        IMAGE_REF: ${{ env.REGISTRY }}/${{ matrix.agent }}@${{ env.DIGEST }}
      run: cosign sign --yes "${IMAGE_REF}"

    - name: Attest Image SBOM
      env:
        IMAGE_REF: ${{ env.REGISTRY }}/${{ matrix.agent }}@${{ env.DIGEST }}
      run: cosign attest --yes --predicate "sbom.json" --type cyclonedx "${IMAGE_REF}"

  attest-image:
    needs: [ build-image ]
    permissions:
      actions: read # for detecting the Github Actions environment.
      id-token: write
      packages: write # for uploading attestations.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
    with:
      image: ghcr.io/${{ github.repository_owner }}/fts/${{ matrix.agent }}
      digest: ${{ needs.build-image.outputs[format('{0}-digest', matrix.agent)] }}
      registry-username: ${{ github.repository_owner }}
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}
    strategy:
      matrix:
        agent: [ clinical-domain-agent, trust-center-agent, research-domain-agent ]

  create-release:
    needs: [ build-image ]
    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: .github/release
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

    - name: Checkout
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Check Link Targets
      run: make check-links

    - name: Create Release Archives
      id: create
      env:
        COMMIT_TAG: ${{ github.ref_type == 'tag' && github.ref_name || '' }}
        CD_AGENT_DIGEST: ${{ needs.build-image.outputs.clinical-domain-agent-digest }}
        TC_AGENT_DIGEST: ${{ needs.build-image.outputs.trust-center-agent-digest }}
        RD_AGENT_DIGEST: ${{ needs.build-image.outputs.research-domain-agent-digest }}
      run: |
        make cd-agent tc-agent rd-agent
        # shellcheck disable=SC2016
        checksums="$(cat ./*.tar.gz.sha256 | xargs -L1 bash -c 'echo -n "{\"$(echo $1 | cut -d. -f1)\": \"$(echo "$0 $1" | base64 -w0)\"}"' | jq -sc 'add')"
        echo "checksums-b64=${checksums}" >>"${GITHUB_OUTPUT}"
        files="$(find . -name "*.tar.gz.sha256" -printf "%f\n" | cut -d. -f1 | jq -R | jq -sc)"
        echo "files=${files}" >>"${GITHUB_OUTPUT}"

    - name: Upload Release Archives
      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        name: release-archives
        path: |
          .github/release/*.tar.gz
          .github/release/*.tar.gz.sha256
        if-no-files-found: error
        retention-days: 7

    outputs:
      checksums-b64: ${{ steps.create.outputs.checksums-b64 }}
      files: ${{ steps.create.outputs.files }}

  attest-release:
    needs: [ create-release ]
    permissions:
      actions: read
      contents: write
      id-token: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    strategy:
      matrix:
        file: ${{ fromJson(needs.create-release.outputs.files) }}
    with:
      base64-subjects: ${{ fromJson(needs.create-release.outputs.checksums-b64)[matrix.file] }}
      upload-assets: false

  publish-release:
    needs: [ attest-release, tag-image ]
    runs-on: ubuntu-24.04
    if: github.ref_type == 'tag'
    permissions:
      contents: write
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

    - name: Checkout
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Download Release Archives
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: release-archives
        path: .

    - name: Download Provenance
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        pattern: "*-agent.tar.gz.intoto.jsonl"
        merge-multiple: true
        path: .

    - name: Recognize Prerelease
      id: prerelease
      env:
        GITHUB_REF: ${{ github.ref_name }}
      # In SemVer 2.0, a prerelease version is always indicated by the presence of a hyphen
      run: |
        if [[ "${GITHUB_REF}" == *-* ]]; then
          echo "is-prerelease=true" >>"${GITHUB_OUTPUT}"
        fi

    - name: Generate Release Notes
      id: notes
      working-directory: .github/release
      env:
        GH_REPO: ${{ github.repository }}
        MISTRAL_API_KEY: ${{ secrets.MISTRAL_API_KEY }}
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        file="$(./generate-notes.sh ${{ github.ref_name }})"
        echo "Release notes generated: ${file}"
        echo "file=${file}" >>"${GITHUB_OUTPUT}"

    - name: Release
      uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
      with:
        files: |
          *.tar.gz
          *.tar.gz.sha256
          *.tar.gz.intoto.jsonl
        draft: true
        prerelease: ${{ steps.prerelease.outputs.is-prerelease }}
        body_path: ${{ steps.notes.outputs.file }}