release.yml

name: Release
on:
  push:
    tags:
      - "v*"

# Declare default permissions as read only.
permissions:
  contents: read

jobs:
  version-check:
    name: Check Cargo.toml files version
    runs-on: ubuntu-latest
    steps:
      - name: Download source code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Check cargo file version
        env:
          GIT_REF_NAME: ${{ github.ref_name }}
        run: |
          CARGO_VERSION=$(sed -n 's/^version[[:space:]]*=[[:space:]]*"\(.*\)"/\1/p' crates/kwctl/Cargo.toml)
          POLICY_SERVER_VERSION=$(sed -n 's/^version[[:space:]]*=[[:space:]]*"\(.*\)"/\1/p' crates/policy-server/Cargo.toml)
          TAG_VERSION="${GIT_REF_NAME#v}"

          if [ "$CARGO_VERSION" != "$TAG_VERSION" ];then
              echo "::error title=Invalid Cargo.toml version::crates/kwctl/Cargo.toml version does not match the tag version"
              exit 1
          fi
          
          if [ "$POLICY_SERVER_VERSION" != "$TAG_VERSION" ];then
              echo "::error title=Invalid Cargo.toml version::crates/policy-server/Cargo.toml version does not match the tag version"
              exit 1
          fi

  ci:
    needs: version-check
    uses: ./.github/workflows/ci.yml
    # Specify all permissions explicitly - read for most, write for attestations
    permissions:
      actions: read
      artifact-metadata: read
      attestations: write
      checks: read
      contents: read
      deployments: read
      discussions: read
      id-token: write
      issues: read
      models: read
      packages: read
      pages: read
      pull-requests: read
      repository-projects: read
      security-events: read
      statuses: read
    with:
      run_all: true

  build-containers:
    name: Build container images
    strategy:
      matrix:
        component: [policy-server, controller, audit-scanner]
        arch: [amd64, arm64]
        include:
          - arch: amd64
            runner: ubuntu-latest
            platform: linux/amd64
          - arch: arm64
            runner: ubuntu-24.04-arm
            platform: linux/arm64
    permissions:
      packages: write # Pushing images to ghcr.io
      id-token: write # Signing images with cosign
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Build, sign, and upload digest
        uses: kubewarden/github-actions/container-build@e57db07ca384bf09ec40c4c49ff25d600c0d23d9 # v5.1.1
        with:
          component: ${{ matrix.component }}
          arch: ${{ matrix.arch }}
          platform: ${{ matrix.platform }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

  merge-containers:
    name: Merge multi-arch manifests
    runs-on: ubuntu-latest
    needs: [build-containers]
    permissions:
      packages: write # Pushing multi-arch manifest to ghcr.io
      id-token: write # Signing images with cosign
    strategy:
      matrix:
        component: [policy-server, controller, audit-scanner]
    steps:
      - name: Merge multi-arch images
        uses: kubewarden/github-actions/merge-multiarch@e57db07ca384bf09ec40c4c49ff25d600c0d23d9 # v5.1.1
        with:
          component: ${{ matrix.component }}
          tag: ${{ github.ref_name }}
          arch: amd64,arm64
          github-token: ${{ secrets.GITHUB_TOKEN }}

  build-kwctl:
    name: Build kwctl binaries
    uses: ./.github/workflows/build-kwctl.yml
    permissions:
      contents: read
      id-token: write
      attestations: write
    with:
      force_build: true

  attestation:
    name: Generate attestations
    needs: build-containers
    runs-on: ubuntu-latest
    permissions:
      packages: write
      id-token: write
    strategy:
      matrix:
        component: [controller, audit-scanner, policy-server]
        arch: [amd64, arm64]
    steps:
      - name: Generate and sign attestations
        uses: kubewarden/github-actions/attestation@e57db07ca384bf09ec40c4c49ff25d600c0d23d9 # v5.1.1
        with:
          component: ${{ matrix.component }}
          arch: ${{ matrix.arch }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

  release:
    name: Create release

    needs:
      - ci
      - merge-containers
      - build-kwctl
      - attestation

    permissions:
      contents: write

    runs-on: ubuntu-latest

    steps:
      - name: Retrieve tag name
        if: ${{ startsWith(github.ref, 'refs/tags/') }}
        env:
          GIT_REF_NAME: ${{ github.ref_name }}
        run: |
          echo TAG_NAME=$(echo "$GIT_REF_NAME") >> $GITHUB_ENV
      - name: Get latest release tag
        id: get_last_release_tag
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            let release = await github.rest.repos.getLatestRelease({
               owner: context.repo.owner,
               repo: context.repo.repo,
            });

            if (release.status  === 200 ) {
              core.setOutput('old_release_tag', release.data.tag_name)
              return
            }
            core.setFailed("Cannot find latest release")
      - name: Get release ID from the release created by release drafter
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            let releases = await github.rest.repos.listReleases({
               owner: context.repo.owner,
               repo: context.repo.repo,
            });
            for (const release of releases.data) {
              if (release.draft) {
                      core.info(release)
                      core.exportVariable('RELEASE_ID', release.id)
                      return
              }
            }
            core.setFailed(`Draft release not found`)
      - name: Download attestation artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: attestation-*
          merge-multiple: true
      - name: Download kwctl artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: kwctl-*
          merge-multiple: false
      - name: Display structure of downloaded files
        run: ls -R
      - name: Upload release assets
        id: upload_release_assets
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            let fs = require('fs');
            let path = require('path');

            let files = [
              'controller-attestation-amd64-provenance.intoto.jsonl',
              'controller-attestation-amd64-provenance.intoto.jsonl.bundle.sigstore',
              'controller-attestation-arm64-provenance.intoto.jsonl',
              'controller-attestation-arm64-provenance.intoto.jsonl.bundle.sigstore',
              'controller-attestation-amd64-sbom.json',
              'controller-attestation-amd64-sbom.json.bundle.sigstore',
              'controller-attestation-arm64-sbom.json',
              'controller-attestation-arm64-sbom.json.bundle.sigstore',
              'audit-scanner-attestation-amd64-provenance.intoto.jsonl',
              'audit-scanner-attestation-amd64-provenance.intoto.jsonl.bundle.sigstore',
              'audit-scanner-attestation-arm64-provenance.intoto.jsonl',
              'audit-scanner-attestation-arm64-provenance.intoto.jsonl.bundle.sigstore',
              'audit-scanner-attestation-amd64-sbom.json',
              'audit-scanner-attestation-amd64-sbom.json.bundle.sigstore',
              'audit-scanner-attestation-arm64-sbom.json',
              'audit-scanner-attestation-arm64-sbom.json.bundle.sigstore',
              'policy-server-attestation-amd64-provenance.intoto.jsonl',
              'policy-server-attestation-amd64-provenance.intoto.jsonl.bundle.sigstore',
              'policy-server-attestation-arm64-provenance.intoto.jsonl',
              'policy-server-attestation-arm64-provenance.intoto.jsonl.bundle.sigstore',
              'policy-server-attestation-amd64-sbom.json',
              'policy-server-attestation-amd64-sbom.json.bundle.sigstore',
              'policy-server-attestation-arm64-sbom.json',
              'policy-server-attestation-arm64-sbom.json.bundle.sigstore',
              './kwctl-airgap-scripts/kubewarden-load-policies.sh',
              './kwctl-airgap-scripts/kubewarden-save-policies.sh',
              './kwctl-darwin-aarch64/kwctl-darwin-aarch64.zip',
              './kwctl-darwin-aarch64-sbom/kwctl-darwin-aarch64-sbom.spdx',
              './kwctl-darwin-aarch64-sbom/kwctl-darwin-aarch64-sbom.spdx.bundle.sigstore',
              './kwctl-darwin-x86_64/kwctl-darwin-x86_64.zip',
              './kwctl-darwin-x86_64-sbom/kwctl-darwin-x86_64-sbom.spdx',
              './kwctl-darwin-x86_64-sbom/kwctl-darwin-x86_64-sbom.spdx.bundle.sigstore',
              './kwctl-linux-aarch64/kwctl-linux-aarch64.zip',
              './kwctl-linux-aarch64-sbom/kwctl-linux-aarch64-sbom.spdx',
              './kwctl-linux-aarch64-sbom/kwctl-linux-aarch64-sbom.spdx.bundle.sigstore',
              './kwctl-linux-x86_64/kwctl-linux-x86_64.zip',
              './kwctl-linux-x86_64-sbom/kwctl-linux-x86_64-sbom.spdx',
              './kwctl-linux-x86_64-sbom/kwctl-linux-x86_64-sbom.spdx.bundle.sigstore',
              './kwctl-windows-x86_64/kwctl-windows-x86_64.exe.zip',
              './kwctl-windows-x86_64-sbom/kwctl-windows-x86_64-sbom.spdx',
              './kwctl-windows-x86_64-sbom/kwctl-windows-x86_64-sbom.spdx.bundle.sigstore']
            const {RELEASE_ID} = process.env

            for (const file of files) {
              let file_data = fs.readFileSync(file);

              let response = await github.rest.repos.uploadReleaseAsset({
                owner: context.repo.owner,
                repo: context.repo.repo,
                release_id: `${RELEASE_ID}`,
                name: path.basename(file),
                data: file_data,
              });
            }
      - name: Publish release
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const {RELEASE_ID} = process.env
            const {TAG_NAME} = process.env
            isPreRelease = ${{ contains(github.ref_name, '-alpha') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-rc') }}
            github.rest.repos.updateRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: `${RELEASE_ID}`,
              draft: false,
              tag_name: `${TAG_NAME}`,
              name: `${TAG_NAME}`,
              prerelease: isPreRelease,
              make_latest: !isPreRelease
            });

  sync-helm-charts:
    name: Trigger Helm Charts Sync Workflow
    needs: release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
        id: generate-token
        with:
          app-id: ${{ secrets.APP_ID }} # zizmor: ignore[secrets-outside-env]
          private-key: ${{ secrets.APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env]
          owner: ${{ github.repository_owner }}
          repositories: |
            helm-charts
      - name: Trigger chart update
        env:
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
          SOURCE_REPO: ${{ github.repository }}
          GIT_REF_NAME: ${{ github.ref_name }}
          REPO_OWNER: ${{ github.repository_owner }}
        run: |
          jq -n \
            --arg source_repo "$SOURCE_REPO" \
            --arg tag "$GIT_REF_NAME" \
            '{"event_type":"release-adm-controller","client_payload":{"source_repo":$source_repo,"tag":$tag}}' \
            > payload.json
          gh api "repos/$REPO_OWNER/helm-charts/dispatches" \
            -X POST \
            --input payload.json