release.yml

# MIT License
#
# Copyright (c) 2023 Matheus Pimenta
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.

name: release

on:
  push:
    branches: [main]
  workflow_dispatch: # for manual trigger in the UI

concurrency:
  group: continuous-integration # lock for shared CI resources
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: write
      id-token: write
      packages: write

    steps:
    - uses: actions/checkout@v4

    - uses: ./.github/actions/ci-login/
      with:
        google-service-account-name: release
        github-token: ${{ secrets.GITHUB_TOKEN }}

    - id: check-new-releases
      uses: ./.github/actions/check-new-releases/

    - uses: ./.github/actions/ci-checks/
      if: steps.check-new-releases.outputs.release-container == 'yes' || steps.check-new-releases.outputs.release-helm == 'yes'

    - uses: sigstore/cosign-installer@v3.3.0
      if: steps.check-new-releases.outputs.release-container == 'yes' || steps.check-new-releases.outputs.release-helm == 'yes'

    - name: Release Container in GitHub Container Registry
      id: release-container-ghcr
      if: steps.check-new-releases.outputs.release-container == 'yes'
      uses: ./.github/actions/release-container/
      with:
        registry: ghcr.io
    - uses: ./.github/actions/sign-and-verify-image/
      if: steps.check-new-releases.outputs.release-container == 'yes'
      with:
        image: ${{ steps.release-container-ghcr.outputs.container-with-digest }}
    - name: Release Container in GitHub
      if: steps.check-new-releases.outputs.release-container == 'yes'
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        gh release create v$(cat container-version.txt) \
          container-digest.txt \
          --repo="$GITHUB_REPOSITORY" \
          --generate-notes \
          --latest

    - name: Release Helm Chart in GitHub Container Registry
      id: release-helm-ghcr
      if: steps.check-new-releases.outputs.release-helm == 'yes'
      uses: ./.github/actions/release-helm/
      with:
        registry: ghcr.io
    - uses: ./.github/actions/sign-and-verify-image/
      if: steps.check-new-releases.outputs.release-helm == 'yes'
      with:
        image: ${{ steps.release-helm-ghcr.outputs.helm-with-digest }}
    - name: Release Helm Chart in GitHub
      if: steps.check-new-releases.outputs.release-helm == 'yes'
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        gh release create helm-v$(cat helm-version.txt) \
          helm-digest.txt \
          --repo="$GITHUB_REPOSITORY" \
          --generate-notes \
          --latest=false