release.yaml

name: Release AMD64 artifacts

on:
  push:
    tags:
      - v*
permissions: read-all
jobs:
  core:
    name: ${{ matrix.image_name }}
    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@8952c3a5f4f6255cc63af88cb3637a9684970c8d # v1.1.3
    permissions:
      id-token: write  # OIDC support
      contents: write
      security-events: write
      actions: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - image_name: "hadron"
            base_image: "ghcr.io/kairos-io/hadron:v0.5.1"
            trusted_boot: false
            custom_job_name_format: "core-amd64-generic"
          - image_name: "hadron"
            base_image: "ghcr.io/kairos-io/hadron:v0.5.1"
            trusted_boot: true
            custom_job_name_format: "core-amd64-generic-uki"
    secrets:
      registry_username: ${{ secrets.QUAY_USERNAME }}
      registry_password: ${{ secrets.QUAY_PASSWORD }}
    with:
      auroraboot_version: "v0.23.0"
      dockerfile_path: "images/Dockerfile"
      base_image: ${{ matrix.base_image }}
      arch: "amd64"
      model: "generic"
      version: "auto"
      no_cache: true
      registry_domain: "quay.io"
      registry_namespace: "kairos"
      trusted_boot: ${{ matrix.trusted_boot }}
      iso: ${{ !matrix.trusted_boot }}
      grype: true
      grype_sarif: true
      trivy: true
      trivy_sarif: true
      # Report-only: the scan still runs and reports, but criticals from the
      # upstream base image must not block releases. Mirrors master builds.
      # Both gates must be relaxed: security_scan_mode (the enforce step) AND
      # grype_sarif_fail_build (the SARIF step, which defaults to true).
      security_scan_mode: "report-only"
      grype_sarif_fail_build: false
      custom_job_name_format: ${{ matrix.custom_job_name_format }}
      list_release_artifacts: ${{ !matrix.trusted_boot }}
      cosign: true
      release: ${{ !matrix.trusted_boot }}
  get-k3s-versions:
    runs-on: ubuntu-latest
    outputs:
      kubernetes_versions: ${{ steps.get-k3s-releases.outputs.kubernetes_versions }}
    steps:
      - run: |
          sudo apt update && sudo apt install -y jq curl
      - name: Get latest k3s releases
        id: get-k3s-releases
        run: |
          kubernetes_versions=$(curl -s https://api.github.com/repos/k3s-io/k3s/releases | jq -r '
            [.[] | select(.prerelease == false and .draft == false and (.tag_name | test("rc") | not)) | .tag_name]
            | map(select(test("^v[0-9]+\\.[0-9]+\\.[0-9]+\\+k3s[0-9]+$")))
            | map({
               version: .,
               minor: (split(".")[1:2]|join("")),
               patch: (split(".")[2:3]|join("")|split("+")[0]),
               revision: (split("+k3s")[1])
             })
           | group_by(.minor)
           | map(sort_by([(.patch | tonumber), (.revision | tonumber)]) | reverse | .[0])
           | sort_by(.minor | tonumber)
           | reverse
           | .[0:3]
           | map(.version)
          ' | jq -c '.')
          echo "kubernetes_versions=$kubernetes_versions" >> $GITHUB_OUTPUT

  get-k0s-versions:
    runs-on: ubuntu-latest
    outputs:
      kubernetes_versions: ${{ steps.get-k0s-releases.outputs.kubernetes_versions }}
    steps:
      - run: |
          sudo apt update && sudo apt install -y jq curl
      - name: Get latest k0s releases
        id: get-k0s-releases
        run: |
          kubernetes_versions=$(curl -s https://api.github.com/repos/k0sproject/k0s/releases | jq -r '
           [.[] | select(.prerelease == false and .draft == false and (.tag_name | test("rc") | not)) | .tag_name]
           | map(select(test("^v[0-9]+\\.[0-9]+\\.[0-9]+\\+k0s\\.[0-9]+$")))
           | map({
             version: .,
             minor: (split(".")[1:2]|join("")),
             patch: (split(".")[2:3]|join("")|split("+")[0]),
             revision: (split("+k0s.")[1])
           })
           | group_by(.minor)
           | map(sort_by([(.patch | tonumber), (.revision | tonumber)]) | reverse | .[0])
           | sort_by(.minor | tonumber)
           | reverse
           | .[0:3]
           | map(.version)
           '| jq -c '.')
          echo "kubernetes_versions=$kubernetes_versions" >> $GITHUB_OUTPUT

  standard-k3s:
    name: ${{ matrix.image_name }}
    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@8952c3a5f4f6255cc63af88cb3637a9684970c8d # v1.1.3
    needs:
      - get-k3s-versions
    permissions:
      id-token: write  # OIDC support
      contents: write
      security-events: write
      actions: read
    strategy:
      fail-fast: false
      matrix:
        image_name:
          - "hadron"
        base_image:
          - "ghcr.io/kairos-io/hadron:v0.5.1"
        kubernetes_version: ${{ fromJson(needs.get-k3s-versions.outputs.kubernetes_versions) }}
    secrets:
      registry_username: ${{ secrets.QUAY_USERNAME }}
      registry_password: ${{ secrets.QUAY_PASSWORD }}
    with:
      auroraboot_version: "v0.23.0"
      dockerfile_path: "images/Dockerfile"
      base_image: ${{ matrix.base_image }}
      arch: "amd64"
      model: "generic"
      version: "auto"
      no_cache: true
      registry_domain: "quay.io"
      registry_namespace: "kairos"
      iso: true
      kubernetes_version: ${{ matrix.kubernetes_version }}
      kubernetes_distro: "k3s"
      grype: true
      grype_sarif: true
      trivy: true
      trivy_sarif: true
      security_scan_mode: "report-only"
      # k3s CVEs come from upstream and are out of our control; the SARIF
      # step must not fail the release. Gating is left to security_scan_mode.
      grype_sarif_fail_build: false
      custom_job_name_format: "standard-amd64-generic-k3s"
      list_release_artifacts: true
      cosign: true
      release: true
  standard-k0s:
    name: ${{ matrix.image_name }}
    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@8952c3a5f4f6255cc63af88cb3637a9684970c8d # v1.1.3
    needs:
      - get-k0s-versions
    permissions:
      id-token: write  # OIDC support
      contents: write
      security-events: write
      actions: read
    strategy:
      fail-fast: false
      matrix:
        image_name:
          - "hadron"
        base_image:
          - "ghcr.io/kairos-io/hadron:v0.5.1"
        kubernetes_version: ${{ fromJson(needs.get-k0s-versions.outputs.kubernetes_versions) }}
    secrets:
      registry_username: ${{ secrets.QUAY_USERNAME }}
      registry_password: ${{ secrets.QUAY_PASSWORD }}
    with:
      auroraboot_version: "v0.23.0"
      dockerfile_path: "images/Dockerfile"
      base_image: ${{ matrix.base_image }}
      arch: "amd64"
      model: "generic"
      version: "auto"
      no_cache: true
      registry_domain: "quay.io"
      registry_namespace: "kairos"
      iso: true
      kubernetes_version: ${{ matrix.kubernetes_version }}
      kubernetes_distro: "k0s"
      grype: true
      grype_sarif: true
      trivy: true
      trivy_sarif: true
      security_scan_mode: "report-only"
      # k0s CVEs come from upstream and are out of our control; the SARIF
      # step must not fail the release. Gating is left to security_scan_mode.
      grype_sarif_fail_build: false
      custom_job_name_format: "standard-amd64-generic-k0s"
      list_release_artifacts: true
      cosign: true
      release: true