draft-binaries.yml

name: Test Draft Release

on:
  workflow_dispatch:
    inputs:
      git_tag:
        description: Git Tag To Test From.
        required: true

permissions:
  contents: read

jobs:
  test_draft_release:
    name: Test Binaries
    strategy:
      fail-fast: false
      matrix:
        include:
        - os: ubuntu-22.04
          target: x86_64-unknown-linux-musl
          container: ghcr.io/build-trust/ockam-builder@sha256:26c5bba9deca18953043a3a2368ec6bb00035676965432f35be24f88e316363a
        - os: macos-12
          target: x86_64-apple-darwin
    runs-on: ${{ matrix.os }}
    container: ${{ matrix.container }}
    steps:
    - name: Checkout repository
      if: matrix.os == 'ubuntu-22.04'
      uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
      with:
        fetch-depth: 0
        ref: ${{ github.event.inputs.git_tag }}

    - name: Install Github CLi
      if: matrix.os == 'ubuntu-22.04'
      run: |
        curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && \
        chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg && \
        echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
        | tee /etc/apt/sources.list.d/github-cli.list > /dev/null && \
        apt update && \
        apt install gh -y

    - name: Download Binary And Signature
      run: gh release download ${{ github.event.inputs.git_tag }} -p ockam.${{ matrix.target }}* -R build-trust/ockam
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Install Cosign
      uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b

    - name: Verify Signature
      run: |
        curl --proto '=https' --tlsv1.2 -sSfL -o ockam.pub https://raw.githubusercontent.com/build-trust/ockam/develop/tools/docker/cosign.pub
        cosign verify-blob --key ockam.pub --signature ockam.${{ matrix.target }}.sig ockam.${{ matrix.target }}

    - name: Check Ockam Version
      run: |
        chmod +x ./ockam.${{ matrix.target }}
        v1=$(./ockam.${{ matrix.target }} --version | grep -Eo '[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+')
        v2=$(echo '${{ github.event.inputs.git_tag }}' | grep -Eo '[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+')
        if [[ $v1 != $v2 ]]; then
          echo "The Ockam version \"$v1\" doesn't match the version \"$v2\""
          exit 1
        fi

    - name: Run Tests
      if: matrix.os == 'ubuntu-22.04'
      run: |
        export PATH=$(pwd):$PATH;
        mv ./ockam.${{ matrix.target }} ./ockam
        bats implementations/rust/ockam/ockam_command/tests/commands.bats