quick-release.yml

name: Quick Release

on:
  workflow_dispatch:
    inputs:
      push-to-upbound:
        description: 'Mirror to Upbound registry'
        required: false
        type: boolean
        default: true

env:
  # Common versions
  GO_VERSION: '1.24'
  GOLANGCI_VERSION: 'v2.0.0'
  DOCKER_BUILDX_VERSION: 'v0.22.0'
  UP_VERSION: 'v0.38.4'

  # Registry/Org names
  CROSSPLANE_REGORG: 'ghcr.io/crossplane-contrib'
  UPBOUND_REGORG: 'xpkg.upbound.io/crossplane-contrib'
  PROVIDER_REPO: provider-keycloak

  # Upbound registry specific variables
  UP_DOMAIN: "https://upbound.io"

jobs:
  build-and-publish:
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.version.outputs.VERSION }}
    permissions:
      packages: write
      contents: read
    steps:
      - name: Setup QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
        with:
          platforms: all

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
        with:
          version: ${{ env.DOCKER_BUILDX_VERSION }}
          install: true

      - name: Login to GHCR
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          submodules: true
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Find the Go Build Cache
        id: go
        run: echo "cache=$(make go.cachedir)" >> $GITHUB_OUTPUT

      - name: Cache the Go Build Cache
        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5
        with:
          path: ${{ steps.go.outputs.cache }}
          key: ${{ runner.os }}-build-publish-artifacts-${{ hashFiles('**/go.sum') }}
          restore-keys: ${{ runner.os }}-build-publish-artifacts-

      - name: Cache Go Dependencies
        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5
        with:
          path: .work/pkg
          key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }}
          restore-keys: ${{ runner.os }}-pkg-

      - name: Vendor Dependencies
        run: make vendor vendor.check

      - name: Find the version
        id: version
        run: make common.buildvars >> $GITHUB_OUTPUT

      - name: Build Artifacts
        run: |-
          make -j2 XPKG_REG_ORGS="${{ env.CROSSPLANE_REGORG }}" XPKG_REG_ORGS_NO_PROMOTE="${{ env.CROSSPLANE_REGORG }}" BRANCH_NAME="main" VERSION="${{ steps.version.outputs.VERSION }}" build.all
        env:
          # We're using docker buildx, which doesn't actually load the images it
          # builds by default. Specifying --load does so.
          BUILD_ARGS: "--load"

      - name: Upload Artifacts to GitHub
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: output
          path: _output/**

      - name: Publish Artifacts
        run: |-
          make -j2 XPKG_REG_ORGS="${{ env.CROSSPLANE_REGORG }}" XPKG_REG_ORGS_NO_PROMOTE="${{ env.CROSSPLANE_REGORG }}" BRANCH_NAME="main" VERSION="${{ steps.version.outputs.VERSION }}" publish

  mirror-to-upbound:
    runs-on: ubuntu-24.04
    needs: build-and-publish
    if: ${{ inputs.push-to-upbound && needs.build-and-publish.result == 'success' }}
    steps:
      - name: Setup QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
        with:
          platforms: all

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
        with:
          version: ${{ env.DOCKER_BUILDX_VERSION }}
          install: true

      - name: Setup crane
        uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e # v0.4

      - name: Validate crane installation
        run: crane version

      - name: Login to Upbound
        uses: docker/login-action@0567fa5ae8c9a197cb207537dc5cbb43ca3d803f
        with:
          registry: "xpkg.upbound.io"
          username: ${{ secrets.UPBOUND_MARKETPLACE_PUSH_ROBOT_USR }}
          password: ${{ secrets.UPBOUND_MARKETPLACE_PUSH_ROBOT_PSW }}

      - name: Mirror to xpkg.upbound.io
        run: |
          crane copy ${{ env.CROSSPLANE_REGORG }}/${{ env.PROVIDER_REPO }}:${{ needs.build-and-publish.outputs.version }} ${{ env.UPBOUND_REGORG }}/${{ env.PROVIDER_REPO }}:${{ needs.build-and-publish.outputs.version }} --allow-nondistributable-artifacts

  summary:
    runs-on: ubuntu-24.04
    needs: [build-and-publish, mirror-to-upbound]
    if: always()
    steps:
      - name: Summary
        run: |
          echo "## Quick Release Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Version:** ${{ needs.build-and-publish.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Published Artifacts:" >> $GITHUB_STEP_SUMMARY
          echo "- **GHCR:** \`${{ env.CROSSPLANE_REGORG }}/${{ env.PROVIDER_REPO }}:${{ needs.build-and-publish.outputs.version }}\`" >> $GITHUB_STEP_SUMMARY
          if [[ "${{ needs.mirror-to-upbound.result }}" == "success" ]]; then
            echo "- **Upbound:** \`${{ env.UPBOUND_REGORG }}/${{ env.PROVIDER_REPO }}:${{ needs.build-and-publish.outputs.version }}\`" >> $GITHUB_STEP_SUMMARY
          else
            echo "- **Upbound:** ⚠️ Skipped or Failed" >> $GITHUB_STEP_SUMMARY
          fi
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Job Results:" >> $GITHUB_STEP_SUMMARY
          echo "- **Lint:** ${{ needs.lint.result || 'skipped' }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Unit Tests:** ${{ needs.unit-tests.result || 'skipped' }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Build & Publish:** ${{ needs.build-and-publish.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Mirror to Upbound:** ${{ needs.mirror-to-upbound.result || 'skipped' }}" >> $GITHUB_STEP_SUMMARY