release.yml

name: Release
on:
  push:
    tags:
      - "v*" # Push events to matching v*, i.e. v1.0, v20.15.10
env:
  REGISTRY: ghcr.io/sovereigncloudstack
  metadata_flavor: latest=true
  metadata_tags: type=ref,event=tag
permissions:
  contents: write
  packages: write
  # Required to generate OIDC tokens for `sigstore/cosign-installer` authentication
  id-token: write
jobs:
  manager-image:
    name: Build and push manager image
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          fetch-depth: 0
      - uses: ./.github/actions/setup-go
      - name: Set up QEMU
        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3

      - name: Generate metadata cso
        id: metacso
        uses: ./.github/actions/metadata
        env:
          IMAGE_NAME: cso
        with:
          metadata_flavor: ${{ env.metadata_flavor }}
          metadata_tags: ${{ env.metadata_tags }}

      - name: Login to ghcr.io for CI
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

      - name: Install Bom
        shell: bash
        run: |
          curl -L https://github.com/kubernetes-sigs/bom/releases/download/v0.6.0/bom-amd64-linux -o bom
          sudo mv ./bom /usr/local/bin/bom
          sudo chmod +x /usr/local/bin/bom

      - name: Setup Env
        run: |
          DOCKER_BUILD_LDFLAGS="$(hack/version.sh)"
          echo 'DOCKER_BUILD_LDFLAGS<<EOF' >> $GITHUB_ENV
          echo $DOCKER_BUILD_LDFLAGS >> $GITHUB_ENV
          echo 'EOF' >> $GITHUB_ENV

      - name: Build and push cso image
        uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6
        id: docker_build_release_cso
        with:
          provenance: false
          context: .
          file: ./images/cso/Dockerfile
          push: true
          build-args: |
            LDFLAGS=${{ env.DOCKER_BUILD_LDFLAGS }}
          tags: ${{ steps.metacso.outputs.tags }}
          labels: ${{ steps.metacso.outputs.labels }}
          platforms: linux/amd64
          cache-from: type=gha, scope=${{ github.workflow }}
          cache-to: type=gha, mode=max, scope=${{ github.workflow }}

      - name: Sign Container Images
        run: |
          cosign sign --yes ghcr.io/sovereigncloudstack/cso@${{ steps.docker_build_release_cso.outputs.digest }}

      - name: Generate SBOM CSO
        shell: bash
        # To-Do: generate SBOM from source after https://github.com/kubernetes-sigs/bom/issues/202 is fixed
        run: |
          bom generate --format=json -o sbom_ci_main_cso_${{ steps.metacso.outputs.version }}-spdx.json \
          --image=ghcr.io/sovereigncloudstack/cso:${{ steps.metacso.outputs.version }}

      - name: Attest SBOM to Container Images cso
        run: |
          cosign attest --yes --type=spdxjson --predicate sbom_ci_main_cso_${{ steps.metacso.outputs.version }}-spdx.json ghcr.io/sovereigncloudstack/cso@${{ steps.docker_build_release_cso.outputs.digest }}

      - name: Sign SBOM Images cso
        run: |
          docker_build_release_digest="${{ steps.docker_build_release_cso.outputs.digest }}"
          image_name="ghcr.io/sovereigncloudstack/cso:${docker_build_release_digest/:/-}.sbom"
          docker_build_release_sbom_digest="sha256:$(docker buildx imagetools inspect --raw ${image_name} | sha256sum | head -c 64)"
          cosign sign --yes "ghcr.io/sovereigncloudstack/cso@${docker_build_release_sbom_digest}"

      - name: Image Releases digests cso
        shell: bash
        run: |
          mkdir -p image-digest/
          echo "ghcr.io/sovereigncloudstack/cso:{{ steps.metacso.outputs.version }}@${{ steps.docker_build_release_cso.outputs.digest }}" >> image-digest/cso.txt

      # Upload artifact digests
      - name: Upload artifact digests
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: image-digest cso
          path: image-digest
          retention-days: 90

      - name: Image Digests Output
        shell: bash
        run: |
          cd image-digest/
          find -type f | sort | xargs -d '\n' cat

  release:
    name: Create draft release
    runs-on: ubuntu-latest
    permissions:
      packages: read
      contents: write
    defaults:
      run:
        shell: bash
    needs:
      - manager-image
    steps:
      - name: Set env
        shell: bash
        run: echo "RELEASE_TAG=${GITHUB_REF:10}" >> $GITHUB_ENV

      - name: checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          fetch-depth: 0


      - uses: ./.github/actions/setup-go

      - name: install kustomize
        run: |
          make kustomize

      - name: generate release artifacts
        run: |
          make release

      - name: generate release notes
        run: |
          make release-notes

      - name: Release
        uses: softprops/action-gh-release@e7a8f85e1c67a31e6ed99a94b41bd0b71bbee6b8 # v2
        with:
          draft: true
          files: out/*
          body_path: _releasenotes/${{ env.RELEASE_TAG }}.md