release.yml

name: kubewarden-controller release
on:
  push:
    tags:
      - "v*"

# Declare default permissions as read only.
permissions: read-all

jobs:
  ci:
    uses: ./.github/workflows/ci.yml
    permissions: read-all

  build:
    name: Build container image, sign it, and generate SBOMs
    uses: ./.github/workflows/container-build.yml
    permissions:
      id-token: write
      packages: write

  crds:
    name: Build CRDs
    runs-on: ubuntu-latest
    steps:
      - name: Install Golang
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          go-version: "1.23"

      - name: Checkout code
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1

      - name: Generate CRDs
        run: |
          make generate-crds
          tar -czf CRDS.tar.gz -C generated-crds $(ls generated-crds)
      - name: Upload CRDs as artifacts
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: CRDS
          path: CRDS.tar.gz

  release:
    name: Create release

    needs:
      - ci
      - crds
      - build

    permissions:
      contents: write

    runs-on: ubuntu-latest

    steps:
      - name: Retrieve tag name
        if: ${{ startsWith(github.ref, 'refs/tags/') }}
        run: |
          echo TAG_NAME=$(echo ${{ github.ref_name }}) >> $GITHUB_ENV

      - name: Get latest release tag
        id: get_last_release_tag
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            let release = await github.rest.repos.getLatestRelease({
               owner: context.repo.owner,
               repo: context.repo.repo,
            });

            if (release.status  === 200 ) {
              core.setOutput('old_release_tag', release.data.tag_name)
              return
            }
            core.setFailed("Cannot find latest release")

      - name: Get release ID from the release created by release drafter
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            let releases = await github.rest.repos.listReleases({
               owner: context.repo.owner,
               repo: context.repo.repo,
            });
            for (const release of releases.data) {
              if (release.draft) {
                      core.info(release)
                      core.exportVariable('RELEASE_ID', release.id)
                      return
              }
            }
            core.setFailed(`Draft release not found`)

      - name: Download attestation artifacts
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          pattern: attestation-*
          merge-multiple: true

      - name: Download CRDs artifact
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: CRDS

      - name: Display structure of downloaded files
        run: ls -R

      - name: Create tarball for the attestation files
        run: |
          for arch in "amd64" "arm64"; do
            tar -czf attestation-$arch.tar.gz $(ls kubewarden-controller-attestation-$arch-*)
          done

      - name: Upload release assets
        id: upload_release_assets
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            let fs = require('fs');
            let path = require('path');

            let files = [
              'attestation-amd64.tar.gz',
              'attestation-arm64.tar.gz',
              "CRDS.tar.gz"]
            const {RELEASE_ID} = process.env

            for (const file of files) {
              let file_data = fs.readFileSync(file);

              let response = await github.rest.repos.uploadReleaseAsset({
                owner: context.repo.owner,
                repo: context.repo.repo,
                release_id: `${RELEASE_ID}`,
                name: path.basename(file),
                data: file_data,
              });
              // store the crds asset id used it in the helm chart update
              if (file === "CRDS.tar.gz") {
                core.setOutput('crds_asset_id', response.data.id)
              }
            }

      - name: Publish release
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            const {RELEASE_ID} = process.env
            const {TAG_NAME} = process.env
            isPreRelease = ${{ contains(github.ref_name, '-alpha') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-rc') }}
            github.rest.repos.updateRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: `${RELEASE_ID}`,
              draft: false,
              tag_name: `${TAG_NAME}`,
              name: `${TAG_NAME}`,
              prerelease: isPreRelease,
              make_latest: !isPreRelease
            });

      - name: Trigger chart update
        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
        with:
          token: ${{ secrets.WORKFLOW_PAT }}
          repository: "${{github.repository_owner}}/helm-charts"
          event-type: update-chart
          client-payload: '{"version": "${{ github.ref_name }}", "oldVersion": "${{ steps.get_last_release_tag.outputs.old_release_tag }}", "repository": "${{ github.repository }}", "crds_asset_id": "${{steps.upload_release_assets.outputs.crds_asset_id}}"}'