release.yaml

name: release
on:
  release:
    types: [published]
permissions:
  contents: read
  packages: write
  id-token: write
jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Clone repo
        uses: actions/checkout@v4
      - name: Setup Cosign
        uses: sigstore/cosign-installer@v3.7.0
      - name: Setup Helm
        uses: azure/setup-helm@v4
        with:
          version: v3.12.1
      - name: Setup QEMU
        uses: docker/setup-qemu-action@v3
      - name: Setup Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3
      - name: Setup yq
        uses: frenck/action-setup-yq@v1
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Prepare
        id: prep
        run: |
          VERSION=sha-${GITHUB_SHA::8}
          if [[ $GITHUB_REF == refs/tags/* ]]; then
            VERSION=${GITHUB_REF/refs\/tags\//}
          fi
          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
      - name: Generate images meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/spegel-org/spegel
          tags: type=raw,value=${{ steps.prep.outputs.VERSION }}
      - name: Publish multi-arch image
        uses: docker/build-push-action@v6
        id: build
        with:
          push: true
          builder: ${{ steps.buildx.outputs.name }}
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm/v7,linux/arm64
          tags: ghcr.io/spegel-org/spegel:${{ steps.prep.outputs.VERSION }}
          labels: ${{ steps.meta.outputs.labels }}
      - name: Sign the image with Cosign
        run: |
          cosign sign --yes ghcr.io/spegel-org/spegel@${{ steps.build.outputs.DIGEST }}
      - name: Publish Helm chart to GHCR
        id: helm
        run: |
          rm charts/spegel/artifacthub-repo.yml
          yq -i '.image.digest = "${{ steps.build.outputs.DIGEST }}"' charts/spegel/values.yaml
          helm package --app-version ${{ steps.prep.outputs.VERSION }} --version ${{ steps.prep.outputs.VERSION }} charts/spegel
          helm push spegel-${{ steps.prep.outputs.VERSION }}.tgz oci://ghcr.io/spegel-org/helm-charts 2> .digest
          DIGEST=$(cat .digest | awk -F "[, ]+" '/Digest/{print $NF}')
          echo "DIGEST=${DIGEST}" >> $GITHUB_OUTPUT
      - name: Sign the Helm chart with Cosign
        run: |
          cosign sign --yes ghcr.io/spegel-org/helm-charts/spegel@${{ steps.helm.outputs.DIGEST }}