release.yaml

name: Release

on:
  workflow_dispatch:

jobs:
  semantic-release:
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    permissions:
      contents: write
      issues: write
      pull-requests: write
    outputs:
      new-release-published: ${{ steps.semantic.outputs.new_release_published }}
      new-release-version: ${{ steps.semantic.outputs.new_release_version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Create baseline tag for initial release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if ! git tag -l 'v*' | grep -q .; then
            FIRST_COMMIT=$(git rev-list --max-parents=0 HEAD)
            gh api repos/${{ github.repository }}/git/refs \
              -f ref="refs/tags/v0.0.0" \
              -f sha="${FIRST_COMMIT}"
            git tag v0.0.0 "${FIRST_COMMIT}"
          fi

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24

      - name: Run semantic-release
        id: semantic
        uses: cycjimmy/semantic-release-action@v6.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  crashloop-operator:
    needs: semantic-release
    if: needs.semantic-release.outputs.new-release-published == 'true'
    uses: ./.github/workflows/_container-build.yaml
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    with:
      image_name: crashloop-operator
      dockerfile: images/crashloop-operator/Containerfile
      context: '.'
      push: true
      latest: true
      image_tag: ${{ needs.semantic-release.outputs.new-release-version }}

  validate-crashloop-operator:
    needs: [semantic-release, crashloop-operator]
    if: needs.semantic-release.outputs.new-release-published == 'true'
    uses: ./.github/workflows/_conforma-validate.yaml
    permissions:
      contents: read
      id-token: write
      packages: read
    with:
      image: ${{ needs.crashloop-operator.outputs.image }}
      # Reporting only for now. Flip to true once a release has gone through
      # and the policy output has been reviewed, so that a first run cannot
      # block a release on a rule nobody has looked at yet.
      strict: false

  helm-charts:
    needs: [semantic-release, crashloop-operator]
    if: needs.semantic-release.outputs.new-release-published == 'true'
    runs-on: ubuntu-latest
    permissions:
      packages: write
      # Keyless cosign signing exchanges this OIDC token for a Fulcio
      # certificate, so no private key has to be managed.
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up Helm
        uses: azure/setup-helm@v5

      - name: Install cosign
        uses: sigstore/cosign-installer@v4.1.2

      - name: Login to ghcr.io
        run: |
          echo "${{ github.token }}" | helm registry login ghcr.io -u ${{ github.actor }} --password-stdin
          echo "${{ github.token }}" | cosign login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Inject version into Chart.yaml
        run: |
          VERSION="${{ needs.semantic-release.outputs.new-release-version }}"
          sed -i "s/^version:.*/version: ${VERSION}/" charts/crashloop-operator/Chart.yaml
          sed -i "s/^appVersion:.*/appVersion: \"${VERSION}\"/" charts/crashloop-operator/Chart.yaml

      - name: Package and push chart
        id: push-chart
        run: |
          helm package charts/crashloop-operator
          OUTPUT=$(helm push crashloop-operator-*.tgz \
            oci://ghcr.io/${{ github.repository_owner }}/charts 2>&1)
          echo "${OUTPUT}"
          DIGEST=$(echo "${OUTPUT}" | grep -oP 'sha256:[a-f0-9]+')
          if [ -z "${DIGEST}" ]; then
            echo "::error::could not determine the pushed chart digest, refusing to continue unsigned"
            exit 1
          fi
          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"

      - name: Sign chart with cosign (keyless)
        run: |
          cosign sign --yes \
            "ghcr.io/${{ github.repository_owner }}/charts/crashloop-operator@${{ steps.push-chart.outputs.digest }}"

      - name: Install oras
        uses: oras-project/setup-oras@v2

      - name: Push Artifact Hub metadata
        run: |
          REPOSITORY_ID=$(grep -E '^repositoryID:' artifacthub-repo.yml \
            | sed -E 's/^repositoryID:[[:space:]]*"?([^"]*)"?[[:space:]]*$/\1/')
          if [ -z "${REPOSITORY_ID}" ]; then
            echo "::notice::artifacthub-repo.yml has no repositoryID yet, skipping the metadata push"
            exit 0
          fi
          oras push \
            "ghcr.io/${{ github.repository_owner }}/charts/crashloop-operator:artifacthub.io" \
            --config /dev/null:application/vnd.cncf.artifacthub.config.v1+yaml \
            artifacthub-repo.yml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml

      - name: Upload chart artifact
        uses: actions/upload-artifact@v7
        with:
          name: helm-charts
          path: '*.tgz'

  release-assets:
    needs: [semantic-release, helm-charts]
    if: needs.semantic-release.outputs.new-release-published == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download chart artifacts
        uses: actions/download-artifact@v8
        with:
          name: helm-charts

      - name: Upload assets to GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: |
          VERSION="${{ needs.semantic-release.outputs.new-release-version }}"
          gh release upload "v${VERSION}" ./*.tgz