release.yaml

name: Release

on:
  # A post-merge push can access release secrets even when the PR came from a fork.
  push:
    branches: [main, release-*]
    paths: [VERSION]
  workflow_dispatch: {}

permissions: {}

jobs:
  check-release:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      release: ${{ steps.check.outputs.release }}
    steps:
      - name: Check release label on merged PR
        id: check
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if [[ "${GITHUB_EVENT_NAME}" == workflow_dispatch ]]; then
            echo 'release=true' >> "${GITHUB_OUTPUT}"
            exit 0
          fi

          # Require this push to be the merge commit of a release-labeled PR.
          PULLS=$(gh api "repos/${GITHUB_REPOSITORY}/commits/${GITHUB_SHA}/pulls")
          if jq -e --arg sha "${GITHUB_SHA}" --arg base "${GITHUB_REF_NAME}" \
              '[.[] | select(.merged_at != null and .merge_commit_sha == $sha and .base.ref == $base and any(.labels[]?; .name == "release"))] | length > 0' \
              > /dev/null <<< "${PULLS}"; then
            echo 'release=true' >> "${GITHUB_OUTPUT}"
          else
            echo 'release=false' >> "${GITHUB_OUTPUT}"
          fi

  release:
    needs: check-release
    if: needs.check-release.outputs.release == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
    env:
      IMAGE: ghcr.io/${{ github.repository }}
    steps:
      - name: Create GitHub App token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        with:
          client-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}

      - name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}
          git_user_signingkey: true
          git_commit_gpgsign: true
          git_tag_gpgsign: true

      - name: Extract version
        id: version
        run: |
          VERSION=$(cat VERSION)
          if ! echo "${VERSION}" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "::error::Invalid version format: ${VERSION}"
            exit 1
          fi
          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
          echo "tag=v${VERSION}" >> "${GITHUB_OUTPUT}"

      - name: Create and push tag
        env:
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          if git rev-parse "${TAG}" >/dev/null 2>&1; then
            echo "::error::Tag ${TAG} already exists"
            exit 1
          fi
          git tag -s -m "Release ${TAG}" "${TAG}"
          git push origin "${TAG}"

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true # zizmor: ignore[cache-poisoning]

      - name: Build and push container image
        env:
          TAG: ${{ steps.version.outputs.tag }}
          ACTOR: ${{ github.actor }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          make buildimg IMG="${IMAGE}:${TAG}"
          podman login -u "${ACTOR}" -p "${GH_TOKEN}" ghcr.io
          podman push "${IMAGE}:${TAG}"

      - name: Build install manifest
        env:
          TAG: ${{ steps.version.outputs.tag }}
        run: make release-manifest IMG="${IMAGE}:${TAG}"

      - name: Create release
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          {
            printf '## Installation\n\n'
            printf '```bash\n'
            printf 'kubectl apply -f https://github.com/%s/releases/download/%s/install.yaml\n' \
              "${GITHUB_REPOSITORY}" "${TAG}"
            printf '```\n'
          } > notes.md
          gh release create "${TAG}" \
            --title "Release ${TAG}" \
            --notes-file notes.md \
            --generate-notes \
            --draft \
            install.yaml