release.yaml

name: 'Release'
on:
  push:
    # take no actions on push to any branch...
    branches-ignore:
      - '**'
    # ... only act on release tags
    tags:
      - 'v*'

env:
  GO_VERSION: "1.22.x"

jobs:
  wait-for-checks:
    runs-on: ubuntu-latest
    steps:

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      # we don't want to release commits that have been pushed and tagged, but not necessarily merged onto main
      - name: Ensure tagged commit is on main
        run: |
          echo "Tag: ${GITHUB_REF##*/}"
          git fetch origin main
          git merge-base --is-ancestor ${GITHUB_REF##*/} origin/main && echo "${GITHUB_REF##*/} is a commit on main!"

      - name: Build snapshot artifacts
        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be #v1.2.0
        id: snapshot
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          # This check name is defined as the github actions job name (in .github/workflows/snapshot.yaml)
          checkName: "Build-Snapshot-Artifacts"
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Check static analysis
        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be #v1.2.0
        id: static-analysis
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          # This check name is defined as the github actions job name (in .github/workflows/static-analysis.yaml)
          checkName: "Static-Analysis (1.22.x, ubuntu-latest)"
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Check unit test results
        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be #v1.2.0
        id: tests-unit
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          # This check name is defined as the github actions job name (in .github/workflows/unit-test.yaml)
          checkName: "Unit-Tests (1.22.x, ubuntu-latest)"
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Quality gate
        if: steps.static-analysis.outputs.conclusion != 'success' || steps.tests-unit.outputs.conclusion != 'success' || steps.snapshot.outputs.conclusion != 'success'
        run: |
          echo "Static-Analysis Status : ${{ steps.static-analysis.outputs.conclusion }}"
          echo "Unit Test Status : ${{ steps.tests-unit.outputs.conclusion }}"
          echo "Build Snapshot Artifacts Status: ${{ steps.snapshot.outputs.conclusion }}"
          false

  release:
    needs: [ wait-for-checks ]
    runs-on: ubuntu-latest
    steps:

      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed #v5.1.0
        with:
          go-version: ${{ env.GO_VERSION }}

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Restore bootstrap cache
        id: cache
        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a #v4.1.2
        with:
          path: |
            ~/go/pkg/mod
            ${{ github.workspace }}/.tmp
          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('Makefile') }}-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('Makefile') }}-
            ${{ runner.os }}-go-${{ env.GO_VERSION }}-

      - name: Bootstrap dependencies
        if: steps.cache.outputs.cache-hit != 'true'
        run: make ci-bootstrap

      - name: Login to Docker Hub
        id: docker-login
        run: |
          echo "${DOCKER_PASS}" | docker login -u "${DOCKER_USER}" --password-stdin
        env:
          DOCKER_USER: ${{ secrets.TOOLBOX_DOCKER_USER }}
          DOCKER_PASS: ${{ secrets.TOOLBOX_DOCKER_PASS }}

      - name: Build snapshot artifacts
        run: make release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 #v4.4.3
        with:
          name: artifacts
          path: dist/**/*