release.yaml

name: Release

on:
  workflow_dispatch:
    inputs:
      release_candidate:
        type: boolean
        description: "Release Candidate"
        required: false
        default: false

env:
  REGISTRY: ghcr.io
  DOCKERFILE: ${{ github.workspace }}/goreleaser.dockerfile

jobs:
  tests:
    uses: ./.github/workflows/tests.yaml
    permissions:
      contents: read
      pull-requests: 'read'
  release:
    needs: tests
    name: Trigger release build
    runs-on: ubuntu-latest
    permissions:
      contents: 'write'
      id-token: 'write'
      pull-requests: 'read'
      repository-projects: 'write'
      packages: 'write'
    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
    - name: Setup Go
      uses: actions/setup-go@v5
      with:
        go-version-file: '${{ github.workspace }}/go.mod'
    - name: Cache go-build and mod
      uses: actions/cache@v3
      with:
        path: |
          ~/.cache/go-build/
          ~/go/pkg/mod/
        key: go-${{ hashFiles('go.sum') }}
        restore-keys: |
          go-
    - name: Set release version
      run: |
        if ${{ inputs.release_candidate }}; then
          echo "RELEASE_VERSION=$(go run $GITHUB_WORKSPACE/pkg/version/generate/release_generate.go print-rc-version)" >> $GITHUB_ENV
        else
          echo "RELEASE_VERSION=$(go run $GITHUB_WORKSPACE/pkg/version/generate/release_generate.go print-version)" >> $GITHUB_ENV
        fi
    - name: Set release notes file
      run: |
        echo "RELEASE_NOTES_FILE=docs/release_notes/$(go run $GITHUB_WORKSPACE/pkg/version/generate/release_generate.go print-version).md" >> $GITHUB_ENV
    - name: Validate release notes
      run: |
        if [[ ! -f ${{ env.RELEASE_NOTES_FILE }} ]]; then
          >&2 echo "Must have release notes ${{ env.RELEASE_NOTES_FILE }}"
          exit 6
        fi
    - name: Create and push branch
      env:
        RELEASE_BRANCH: release-${{ env.RELEASE_VERSION }}
      run: |
        if ! git checkout ${RELEASE_BRANCH} >/dev/null; then
            echo "Creating ${RELEASE_BRANCH} from $(git branch --show-current)"
            git checkout -b ${RELEASE_BRANCH}
            git push origin "$(git branch --show-current)"
        else
            git checkout ${RELEASE_BRANCH}
            git pull --ff-only origin ${RELEASE_BRANCH}
        fi
    - name: Setup git config
      run: |
        git config user.name "GitHub Actions Bot"
        git config user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
    - name: Create and push tag
      run: |
        msg="Release ${{ env.RELEASE_VERSION }}"
        git tag --annotate --message "${msg}" ${{ env.RELEASE_VERSION }}
        git push origin ${{ env.RELEASE_VERSION }}
    - name: Log in to the Container registry
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Generate manifests
      run: |
        mkdir -p output
        kustomize build ./config/default > ./output/install.yaml
    - name: Setup Syft
      uses: anchore/sbom-action/download-syft@7ccf588e3cf3cc2611714c2eeae48550fbc17552 # v0.15.11
    - name: Setup Cosign
      uses: sigstore/cosign-installer@v3.5.0
    - name: Run goreleaser
      uses: goreleaser/goreleaser-action@v5
      with:
        distribution: goreleaser
        version: latest
        args: release --clean --timeout 60m --skip-validate --config=./.goreleaser.yaml --release-notes=${{ env.RELEASE_NOTES_FILE }}
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        GORELEASER_CURRENT_TAG: ${{ env.RELEASE_VERSION }}