release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: Existing tag to release or re-release
        required: true
        type: string

permissions:
  contents: write

env:
  RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }}
  RELEASE_SOURCE_REF: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', github.event.inputs.tag) || github.ref }}

jobs:
  goreleaser:
    # Pinned for the same reason as build-linux-arm64-cgo in ci.yml: the
    # multiarch install needs amd64 and arm64 packages at the same version,
    # and ubuntu-latest ships newer amd64 builds than the ports archive.
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          ref: ${{ env.RELEASE_SOURCE_REF }}

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false

      - name: Cache Go modules
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
          # Namespace bumped to v3 after dropping the libseccomp 2.6
          # source-build step. The key now salts only on go.sum so any
          # dependency change (including libseccomp-golang) invalidates
          # the cache. The old v2 key carried build artifacts compiled
          # against a custom-built static libseccomp.a; those are
          # incompatible with the new dynamic-link design.
          key: release-v3-${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            release-v3-${{ runner.os }}-go-

      - name: Free disk space
        run: |
          echo "=== Disk space before cleanup ==="
          df -h /tmp /home/runner
          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/share/powershell
          echo "=== Disk space after cleanup ==="
          df -h /tmp /home/runner

      - name: Install build deps (envshim, fuse, seccomp, multiarch)
        run: |
          # Ubuntu hosts arm64 packages on ports.ubuntu.com, not
          # archive.ubuntu.com. Without restricting the default sources
          # to amd64 and adding a ports source for arm64, `apt-get
          # update` after `dpkg --add-architecture arm64` 404s on every
          # arm64 Packages file.
          #
          # The suite comes from the host. It was hardcoded to noble, and
          # when ubuntu-latest moved past 24.04 the arm64 packages came
          # from an older release than the amd64 ones: libseccomp-dev
          # 2.5.5 for arm64 against 2.6.0 for amd64, which apt cannot
          # install side by side.
          . /etc/os-release
          sudo sed -i '/^Types: deb$/a Architectures: amd64' /etc/apt/sources.list.d/ubuntu.sources
          sudo tee /etc/apt/sources.list.d/arm64-ports.sources >/dev/null <<EOF
          Types: deb
          URIs: http://ports.ubuntu.com/ubuntu-ports
          Suites: ${VERSION_CODENAME} ${VERSION_CODENAME}-updates ${VERSION_CODENAME}-security
          Components: main universe restricted multiverse
          Architectures: arm64
          Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
          EOF
          sudo dpkg --add-architecture arm64
          sudo apt-get update
          sudo apt-get install -y \
            libfuse-dev \
            libseccomp-dev \
            libseccomp-dev:arm64 \
            pkg-config \
            gcc-aarch64-linux-gnu \
            make

      - name: Test
        run: |
          mkdir -p "$GOTMPDIR"
          go test -p=1 ./...
        env:
          GOTMPDIR: ${{ runner.temp }}/go-tmp

      - name: Smoke
        run: make smoke

      - name: Pin GoReleaser tag selection to release ref
        run: |
          current_tag="${{ env.RELEASE_TAG }}"
          echo "GORELEASER_CURRENT_TAG=$current_tag" >> "$GITHUB_ENV"

          previous_tag="$(
            git tag --list 'v*' --sort=-version:refname |
              awk -v current="$current_tag" '
                $0 == current { seen = 1; next }
                !seen { next }
                { print; exit }
              '
          )"

          if [[ "$current_tag" != *-* ]]; then
            previous_tag="$(
              git tag --list 'v*' --sort=-version:refname |
                awk -v current="$current_tag" '
                  $0 == current { seen = 1; next }
                  !seen { next }
                  $0 ~ /-/ { next }
                  { print; exit }
                '
            )"
          fi

          if [[ -n "$previous_tag" ]]; then
            echo "GORELEASER_PREVIOUS_TAG=$previous_tag" >> "$GITHUB_ENV"
          fi

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
        with:
          version: v2.13.1
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # Build Alpine/musl binaries separately (requires different libc).
  #
  # We intentionally do NOT use `container: golang:1.25.7-alpine` at the job
  # level, because on arm64 GitHub runners this breaks JavaScript actions
  # (actions/checkout@v4): Node.js is not shipped for the Alpine-on-arm64
  # combo. Instead, the job runs on a plain ubuntu-* host, checkout happens
  # there, and the actual musl/CGO compile is delegated to `docker run`
  # against the multi-arch golang:alpine image. Docker pulls the matching
  # arch variant natively on each runner (no QEMU needed).
  alpine-build:
    needs: goreleaser  # Wait for release to be created
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            runs-on: ubuntu-latest
          - arch: arm64
            runs-on: ubuntu-24.04-arm
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ env.RELEASE_SOURCE_REF }}

      - name: Build musl-static binaries in Alpine container
        env:
          VERSION: ${{ env.RELEASE_TAG }}
          ARCH: ${{ matrix.arch }}
        run: |
          # Keep the build script in a temp file so we avoid quoting hell
          # around -ldflags='-s -w -extldflags "-static"' inside docker run.
          cat > /tmp/alpine-build.sh <<'SCRIPT'
          #!/bin/sh
          set -eux
          apk add --no-cache gcc musl-dev libseccomp-dev libseccomp-static make git file

          # The repo is mounted from the host runner at /workspace. Files are
          # owned by the host uid (e.g. 1001) but this container runs as root,
          # so git refuses to operate on it (safe.directory check). Go's build
          # VCS stamping invokes git and fails with "exit status 128". Mark
          # the workspace as safe before any go build commands.
          git config --global --add safe.directory /workspace

          CGO_ENABLED=1 \
          CGO_LDFLAGS="-static -lseccomp" \
          go build -ldflags='-s -w -extldflags "-static"' \
            -o agentmon ./cmd/agentmon
          file agentmon

          CGO_ENABLED=1 \
          CGO_LDFLAGS="-static -lseccomp" \
          go build -ldflags='-s -w -extldflags "-static"' \
            -o agentmon-unixwrap ./cmd/agentmon-unixwrap
          file agentmon-unixwrap

          CGO_ENABLED=0 \
          go build -ldflags='-s -w' \
            -o agentmon-shell-shim ./cmd/agentmon-shell-shim

          mkdir -p dist
          tar -czvf "dist/agentmon_${VERSION}_linux_${ARCH}_musl.tar.gz" \
            agentmon \
            agentmon-unixwrap \
            agentmon-shell-shim \
            packaging/bash_startup.sh \
            README.md \
            LICENSE \
            config.yml \
            configs/policies \
            default-policy.yml
          SCRIPT
          chmod +x /tmp/alpine-build.sh

          docker run --rm \
            -v "$PWD:/workspace" \
            -v "/tmp/alpine-build.sh:/alpine-build.sh:ro" \
            -w /workspace \
            -e VERSION \
            -e ARCH \
            golang:1.25.7-alpine \
            /alpine-build.sh

          # Files created inside the container are root-owned on the host.
          # Chown them back so subsequent host-side steps can read them.
          sudo chown -R "$(id -u):$(id -g)" dist agentmon agentmon-unixwrap agentmon-shell-shim 2>/dev/null || true

      - name: Upload Alpine binaries to release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ env.RELEASE_TAG }}
          ARCH: ${{ matrix.arch }}
        run: |
          gh release upload "$VERSION" \
            "dist/agentmon_${VERSION}_linux_${ARCH}_musl.tar.gz" \
            --repo "${{ github.repository }}" \
            --clobber

  # Build, sign, and notarize macOS app bundle with system extension.
  build-macos-app:
    runs-on: macos-latest
    needs: goreleaser
    environment: build
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ env.RELEASE_SOURCE_REF }}

      - name: Select Xcode
        run: |
          sudo xcode-select -s /Applications/Xcode.app/Contents/Developer
          xcodebuild -version

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: Import signing certificate
        env:
          MACOS_SIGNING_CERT_P12: ${{ secrets.MACOS_SIGNING_CERT_P12 }}
          MACOS_SIGNING_CERT_PASSWORD: ${{ secrets.MACOS_SIGNING_CERT_PASSWORD }}
        run: |
          echo "$MACOS_SIGNING_CERT_P12" | base64 --decode > cert.p12
          KEYCHAIN="build.keychain"
          KEYCHAIN_PASSWORD="actions"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
          security default-keychain -s "$KEYCHAIN"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
          security import cert.p12 -k "$KEYCHAIN" -P "$MACOS_SIGNING_CERT_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
          rm cert.p12

      - name: Download darwin archives from GoReleaser
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ env.RELEASE_TAG }}
        run: |
          # arm64 only. Apple Silicon is the only macOS target; darwin/amd64
          # was dropped rather than shipped untested.
          ARCHIVE="agentmon_${VERSION#v}_darwin_arm64.tar.gz"
          gh release download "$VERSION" \
            --pattern "$ARCHIVE" \
            --repo "${{ github.repository }}" \
            --dir .
          mkdir -p unsigned-arm64
          tar -xzf "$ARCHIVE" -C unsigned-arm64

      - name: Rebuild CGO binaries on macOS
        env:
          VERSION: ${{ env.RELEASE_TAG }}
        run: |
          LDFLAGS="-s -w -X main.version=${VERSION#v} -X main.commit=$(git rev-parse --short HEAD)"
          # GoReleaser cross-compiles darwin from Linux with CGO_ENABLED=0.
          # Two binaries need cgo and so must be rebuilt here, on a real macOS
          # runner:
          #   agentmon         -- system extension support
          #   agentmon-macwrap -- sandbox_init_with_parameters; without cgo the
          #                       build selects main_nocgo.go, a stub that exits
          #                       non-zero, so seatbelt enforcement is dead.
          # nofuse: macFUSE headers are not available on CI.
          CGO_ENABLED=1 GOARCH=arm64 go build -tags nofuse -ldflags "$LDFLAGS" \
            -o build/agentmon-arm64 ./cmd/agentmon
          CGO_ENABLED=1 GOARCH=arm64 go build -ldflags "$LDFLAGS" \
            -o build/agentmon-macwrap-arm64 ./cmd/agentmon-macwrap
          cp build/agentmon-arm64 unsigned-arm64/agentmon
          # macwrap is absent from the GoReleaser archive entirely (it cannot
          # be cross-compiled with cgo), so this is a create, not a replace.
          cp build/agentmon-macwrap-arm64 unsigned-arm64/agentmon-macwrap

      - name: Verify cgo binaries are real, not nocgo stubs
        run: |
          # A cgo-less agentmon-macwrap builds, lipos and signs cleanly, then
          # fails at every exec. Catch it here, not in a user's audit log.
          # Note otool -L is no use for this: the pure-Go darwin runtime links
          # libSystem either way. Check the recorded build setting instead.
          for bin in unsigned-arm64/agentmon unsigned-arm64/agentmon-macwrap; do
            if ! go version -m "$bin" | grep -q "^	build	CGO_ENABLED=1$"; then
              echo "::error::$bin was built with CGO_ENABLED=0"
              go version -m "$bin" | grep CGO_ENABLED || true
              exit 1
            fi
          done
          # Belt and braces for the one binary whose whole purpose is this
          # private API: prove the symbol is actually linked.
          if ! nm -u unsigned-arm64/agentmon-macwrap | grep -q "_sandbox_init_with_parameters"; then
            echo "::error::unsigned-arm64/agentmon-macwrap does not reference sandbox_init_with_parameters"
            exit 1
          fi
          echo "unsigned-arm64: agentmon and agentmon-macwrap are cgo builds"

      - name: Collect Go binaries
        run: |
          # arm64 only, so there is nothing to lipo. The directory name stays
          # go-universal because assemble-macos-bundle.sh and the bundle layout
          # refer to it; renaming it is a separate change.
          mkdir -p build/go-universal
          collected=0
          for bin in unsigned-arm64/agentmon*; do
            name=$(basename "$bin")
            [ -f "$bin" ] || continue
            file "$bin" | grep -q "Mach-O" || continue
            cp "$bin" "build/go-universal/${name}"
            lipo -info "build/go-universal/${name}"
            collected=$((collected + 1))
          done
          if [ "$collected" -eq 0 ]; then
            echo "::error::No macOS binaries were collected"
            exit 1
          fi
          echo "Created $created binaries"

      - name: Build Swift targets
        run: |
          # CURRENT_PROJECT_VERSION becomes the extension's CFBundleVersion, and
          # macOS replaces an installed system extension only when the incoming
          # one is higher. It was hardcoded to 1.0.0, so every release shipped
          # the same version and an already-installed extension was never
          # swapped in -- users would keep the first one they installed.
          xcodebuild \
            -project macos/AgentMon/agentmon.xcodeproj \
            -scheme agentmon \
            -configuration Release \
            -derivedDataPath build/DerivedData \
            CURRENT_PROJECT_VERSION="$(git rev-list --count HEAD)" \
            ARCHS=arm64 \
            ONLY_ACTIVE_ARCH=NO \
            CODE_SIGN_IDENTITY="" \
            CODE_SIGNING_REQUIRED=NO \
            CODE_SIGNING_ALLOWED=NO

      - name: Assemble app bundle
        run: GO_BIN_DIR=build/go-universal scripts/assemble-macos-bundle.sh build/AgentMon.app

      - name: Sign app bundle (inside-out)
        env:
          SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
        run: scripts/sign-macos-bundle.sh build/AgentMon.app

      - name: Verify provisioning profiles
        run: scripts/verify-macos-bundle.sh build/AgentMon.app

      - name: Notarize app bundle
        env:
          APPLE_ID: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.MACOS_NOTARIZATION_PASSWORD }}
          TEAM_ID: ${{ secrets.MACOS_NOTARIZATION_TEAM_ID }}
        run: |
          ditto -c -k --keepParent build/AgentMon.app build/AgentMon.zip

          # Submit and capture submission ID
          SUBMIT_OUT=$(xcrun notarytool submit build/AgentMon.zip \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_PASSWORD" \
            --team-id "$TEAM_ID" \
            --output-format json)
          echo "$SUBMIT_OUT"
          SUBMISSION_ID=$(echo "$SUBMIT_OUT" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
          echo "Submission ID: $SUBMISSION_ID"

          # Wait for completion (best-effort — if it times out, use staple-macos workflow later)
          if xcrun notarytool wait "$SUBMISSION_ID" \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_PASSWORD" \
            --team-id "$TEAM_ID" \
            --timeout 35m; then
            xcrun notarytool info "$SUBMISSION_ID" \
              --apple-id "$APPLE_ID" \
              --password "$APPLE_PASSWORD" \
              --team-id "$TEAM_ID"
            xcrun stapler staple build/AgentMon.app
            echo "NOTARIZED=true" >> "$GITHUB_ENV"
          else
            echo "::warning::Notarization timed out (submission $SUBMISSION_ID). Run staple-macos workflow later."
            xcrun notarytool info "$SUBMISSION_ID" \
              --apple-id "$APPLE_ID" \
              --password "$APPLE_PASSWORD" \
              --team-id "$TEAM_ID" || true
            echo "NOTARIZED=false" >> "$GITHUB_ENV"
          fi

      - name: Create DMG and upload to release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ env.RELEASE_TAG }}
        run: |
          # Create DMG
          hdiutil create -volname "AgentMon" \
            -srcfolder build/AgentMon.app \
            -ov -format UDZO \
            "build/AgentMon-${VERSION}.dmg"

          # Delete the darwin tarball from the release; the DMG supersedes it.
          # amd64 is still swept here, deliberately: a release cut before
          # darwin/amd64 was dropped can leave one behind, and `|| true` makes
          # the removal a no-op when there is nothing to remove.
          for arch in arm64 amd64; do
            ARCHIVE="agentmon_${VERSION#v}_darwin_${arch}.tar.gz"
            gh release delete-asset "$VERSION" "$ARCHIVE" \
              --repo "${{ github.repository }}" \
              --yes || true
          done

          # Upload DMG
          gh release upload "$VERSION" "build/AgentMon-${VERSION}.dmg" \
            --repo "${{ github.repository }}" \
            --clobber

  # Update checksums after macOS signing replaces the darwin archives.
  update-checksums:
    runs-on: ubuntu-latest
    needs: [goreleaser, alpine-build, build-macos-app]
    timeout-minutes: 10
    steps:
      - name: Download all release assets and regenerate checksums
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ env.RELEASE_TAG }}
        run: |
          mkdir -p assets
          gh release download "$VERSION" \
            --repo "${{ github.repository }}" \
            --dir assets \
            --skip-existing
          # Remove old checksums file
          rm -f assets/checksums.txt
          # Generate new checksums for all assets
          cd assets
          sha256sum * > checksums.txt
          cd ..
          gh release upload "$VERSION" assets/checksums.txt \
            --repo "${{ github.repository }}" \
            --clobber

  # Publish Homebrew cask to canyonroad/homebrew-tap (stable releases only).
  publish-homebrew-cask:
    runs-on: ubuntu-latest
    needs: [build-macos-app]
    if: ${{ !contains(github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name, '-') }}
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ env.RELEASE_SOURCE_REF }}

      - name: Download DMG and compute SHA256
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ env.RELEASE_TAG }}
        run: |
          gh release download "$VERSION" \
            --pattern "AgentMon-*.dmg" \
            --repo "${{ github.repository }}" \
            --dir .
          DMG_FILE=$(ls AgentMon-*.dmg)
          if [ "$(echo "$DMG_FILE" | wc -l)" -ne 1 ]; then
            echo "::error::Expected exactly one DMG file, found: $DMG_FILE"
            exit 1
          fi
          SHA256=$(sha256sum "$DMG_FILE" | awk '{print $1}')
          echo "SHA256=$SHA256" >> "$GITHUB_ENV"
          echo "CLEAN_VERSION=${VERSION#v}" >> "$GITHUB_ENV"

      - name: Generate cask formula from template
        run: |
          sed -e "s/__VERSION__/$CLEAN_VERSION/g" \
              -e "s/__SHA256__/$SHA256/g" \
              scripts/homebrew-cask.rb.tmpl > agentmon.rb
          echo "--- Generated cask formula ---"
          cat agentmon.rb

      - name: Push to homebrew-tap
        env:
          TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
        run: |
          git clone "https://x-access-token:${TAP_TOKEN}@github.com/canyonroad/homebrew-tap.git" tap
          mkdir -p tap/Casks
          cp agentmon.rb tap/Casks/agentmon.rb
          cd tap
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Casks/agentmon.rb
          git diff --cached --quiet || git commit -m "Update agentmon cask to ${CLEAN_VERSION}"
          git push

  # Run integration tests across all supported Linux distros.
  docker-test:
    runs-on: ubuntu-latest
    needs: [goreleaser, alpine-build]
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: debian
            dockerfile: Dockerfile.test
            docker_run_flags: ""
          - name: fedora
            dockerfile: Dockerfile.test.rpm
            docker_run_flags: ""
          - name: archlinux
            dockerfile: Dockerfile.test.arch
            docker_run_flags: ""
          - name: alpine
            dockerfile: Dockerfile.test.alpine
            docker_run_flags: ""
          - name: ubuntu
            dockerfile: Dockerfile.test.ubuntu
            docker_run_flags: "--device /dev/fuse --cap-add SYS_ADMIN"
          - name: ubuntu2204
            dockerfile: Dockerfile.test.ubuntu2204
            docker_run_flags: "--device /dev/fuse --cap-add SYS_ADMIN"
          - name: debian-trixie
            dockerfile: Dockerfile.test.debian-trixie
            docker_run_flags: ""
          - name: rockylinux10
            dockerfile: Dockerfile.test.rockylinux10
            docker_run_flags: ""
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ env.RELEASE_SOURCE_REF }}

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false

      - name: Build sigurg_probe for docker matrix
        run: |
          go build -o /tmp/sigurg_probe scripts/docker-test/sigurg_probe.go
          chmod +x /tmp/sigurg_probe
          ls -la /tmp/sigurg_probe

      - name: Build and run ${{ matrix.name }} integration test
        env:
          DOCKER_BUILDKIT: "1"
        run: |
          docker build -f ${{ matrix.dockerfile }} \
            --build-arg AGENTMON_TAG=${{ env.RELEASE_TAG }} \
            -t agentmon-test-${{ matrix.name }}:latest .
          RUN_FLAGS="${{ matrix.docker_run_flags }}"
          # Only pass FUSE flags if /dev/fuse exists on the runner
          if echo "$RUN_FLAGS" | grep -q '/dev/fuse' && [ ! -e /dev/fuse ]; then
            echo "::warning::Skipping FUSE flags: /dev/fuse not available on this runner"
            RUN_FLAGS=""
          fi
          docker run --rm $RUN_FLAGS \
            -v /tmp/sigurg_probe:/probe/sigurg_probe:ro \
            agentmon-test-${{ matrix.name }}:latest