release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write
  packages: write
  id-token: write
  attestations: write
  artifact-metadata: write

jobs:
  ci:
    uses: ./.github/workflows/ci.yml

  release:
    needs: ci
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Validate release tag
        run: |
          if [[ "$GITHUB_REF_TYPE" != "tag" ]]; then
            echo "Release workflow must run on a tag ref." >&2
            exit 1
          fi
          if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
            echo "Release tags must look like v1.2.3 or v1.2.3-rc.1" >&2
            exit 1
          fi

      - name: Determine version
        id: version
        run: |
          echo "version=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"

      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Login to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Install cosign
        uses: sigstore/cosign-installer@v4.1.2

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}},value=${{ steps.version.outputs.version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ steps.version.outputs.version }},enable=${{ !contains(steps.version.outputs.version, '-') }}

      - name: Build and push multi-arch image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=drop-image
          cache-to: type=gha,scope=drop-image,mode=max

      - name: Compute lowercase image name
        id: image
        run: echo "name=ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"

      - name: Sign image with cosign
        env:
          COSIGN_EXPERIMENTAL: "1"
        run: |
          cosign sign --yes "${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }}"

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: ${{ steps.image.outputs.name }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

      - name: Package and push Helm charts
        run: |
          VERSION=${{ steps.version.outputs.version }}
          CHART_REGISTRY="oci://ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')/charts"
          echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${{ github.actor }} --password-stdin

          # Sync CRDs from generated sources into chart templates
          make sync-crds

          # Package and push main operator chart
          helm package charts/drop --version "${VERSION#v}" --app-version "${VERSION#v}"
          helm push drop-*.tgz "$CHART_REGISTRY"
          rm -f drop-*.tgz

          # Package and push CRDs chart
          helm package charts/drop-crds --version "${VERSION#v}" --app-version "${VERSION#v}"
          helm push drop-crds-*.tgz "$CHART_REGISTRY"

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          PRERELEASE_FLAG=""
          if [[ "$VERSION" == *-* ]]; then
            PRERELEASE_FLAG="--prerelease"
          fi
          gh release create "$VERSION" \
            --title "$VERSION" \
            --generate-notes \
            $PRERELEASE_FLAG