release.yaml

# Copyright 2026 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Image tag (e.g. v1.2.3-rc1). Leave blank to auto-generate from branch+SHA.'
        required: false
      create_release:
        description: 'Create a GitHub release'
        type: boolean
        default: false

permissions:
  contents: write
  packages: write

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Validate and resolve tag
        id: tag
        run: |
          TAG="${{ inputs.tag }}"
          if [[ -z "${TAG}" ]]; then
            BRANCH="${GITHUB_REF_NAME//\//-}"
            SHA="$(git rev-parse --short HEAD)"
            TAG="${BRANCH}-${SHA}"
          fi
          if [[ "${{ inputs.create_release }}" == "true" ]]; then
            if [[ ! "${TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9._-]+)?$ ]]; then
              echo "::error::Tag '${TAG}' must match vMAJOR.MINOR.PATCH[-prerelease] when creating a release (e.g. v1.2.3 or v1.2.3-rc1)"
              exit 1
            fi
          fi
          echo "value=${TAG}" >> "$GITHUB_OUTPUT"
          if [[ "${{ inputs.create_release }}" == "true" ]]; then
            echo "tags=${TAG},latest" >> "$GITHUB_OUTPUT"
          else
            echo "tags=${TAG}" >> "$GITHUB_OUTPUT"
          fi

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'

      - name: Install ko
        uses: ko-build/setup-ko@v0.7

      - name: Install Helm
        uses: azure/setup-helm@v4

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up QEMU (multi-arch)
        uses: docker/setup-qemu-action@v3

      - name: Build and push images
        env:
          # ghcr.io/<owner>/<repo> — resolves correctly in forks
          IMAGE_REPOSITORY: ghcr.io/${{ github.repository }}
          IMAGE_TAGS: ${{ steps.tag.outputs.tags }}
        run: |
          set -o errexit -o nounset -o pipefail

          for component in ateapi atecontroller atelet ateom-gvisor ateom-microvm podcertcontroller atenet; do
            KO_DOCKER_REPO="${IMAGE_REPOSITORY}/${component}" \
            ./hack/run-tool.sh ko build \
              --tags "${IMAGE_TAGS}" \
              --platform linux/amd64,linux/arm64 \
              --bare \
              "./cmd/${component}"
          done

      - name: Package and push Helm charts
        if: inputs.create_release
        env:
          HELM_EXPERIMENTAL_OCI: "1"
          CHART_REPOSITORY: oci://ghcr.io/kagent-dev/substrate/helm
        run: |
          set -o errexit -o nounset -o pipefail

          tag="${{ steps.tag.outputs.value }}"
          chart_version="${tag#v}"
          package_dir="${RUNNER_TEMP}/helm-packages"
          mkdir -p "${package_dir}"

          echo "${{ secrets.GITHUB_TOKEN }}" \
            | helm registry login ghcr.io \
              --username "${{ github.actor }}" \
              --password-stdin

          helm package charts/substrate-crds \
            --destination "${package_dir}" \
            --version "${chart_version}" \
            --app-version "${tag}"
          helm package charts/substrate \
            --destination "${package_dir}" \
            --version "${chart_version}" \
            --app-version "${tag}"

          helm push "${package_dir}/substrate-crds-${chart_version}.tgz" "${CHART_REPOSITORY}"
          helm push "${package_dir}/substrate-${chart_version}.tgz" "${CHART_REPOSITORY}"

      - name: Build kubectl-ate release binaries
        if: inputs.create_release
        env:
          VERSION: ${{ steps.tag.outputs.value }}
        run: |
          set -o errexit -o nounset -o pipefail

          mkdir -p dist
          for os in linux darwin; do
            for arch in amd64 arm64; do
              CGO_ENABLED=0 GOOS="${os}" GOARCH="${arch}" go build \
                -trimpath \
                -ldflags="-s -w -X=github.com/agent-substrate/substrate/internal/version.Version=${VERSION}" \
                -o "dist/kubectl-ate-${os}-${arch}" \
                ./cmd/kubectl-ate
            done
          done

      - name: Create GitHub Release
        if: inputs.create_release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.tag.outputs.value }}
          generate_release_notes: true
          files: dist/kubectl-ate-*