# .stagefreight.yml — Multi-Toolchain Artifact Build
#
# Who: Projects that need multiple language toolchains to produce a single
#      artifact. Go + .NET, Rust + C FFI, Java + native libraries, etc.
# What: Creates release notes on semver tags and runs security scanning
#       with SBOM. Today this is the minimal manifest for a non-Docker
#       project with security requirements. When artifact builds land,
#       this config will gain multistage extraction and release assets.
# Build: None (container-wise). Artifact builds are a future feature.
# Why: Establishes the manifest with security scanning now, and artifact
#      builds slot in without restructuring when the feature ships.

version: 1

policies:
  git_tags:
    stable: "^\\d+\\.\\d+\\.\\d+$"

targets:
  - id: primary-release
    kind: release
    when: { git_tags: [stable], events: [tag] }

security:
  enabled: true
  sbom: true

# ── Roadmap (not yet implemented) ──────────────────────────────
# build:
#   artifacts:
#     # Windows agent with .NET LibreHardwareMonitor wrapper
#     - name: beszel-agent-windows
#       dockerfile: build/Dockerfile.beszel-windows
#       target: export
#       platforms: [linux/amd64]
#       build_args:
#         UPSTREAM_VERSION: "{version}"
#       extract:
#         - from: /out/beszel-agent.exe
#           to: dist/beszel-agent-windows/
#         - from: /out/*.dll
#           to: dist/beszel-agent-windows/
#       package:
#         - type: zip
#           name: "beszel-agent-windows-{version}.zip"
#           contents: dist/beszel-agent-windows/
#
#     # Linux agent (simpler — Go only, no .NET needed)
#     - name: beszel-agent-linux
#       dockerfile: build/Dockerfile.beszel-linux
#       target: export
#       matrix:
#         - { goarch: amd64, suffix: linux-amd64 }
#         - { goarch: arm64, suffix: linux-arm64 }
#       extract:
#         - from: /out/beszel-agent
#           to: "dist/beszel-agent-{suffix}/"
#       package:
#         - type: tar.gz
#           name: "beszel-agent-{version}-{suffix}.tar.gz"
#           contents: "dist/beszel-agent-{suffix}/"
#
#   release_assets: true
#
# security:
#   audit_deps: true
