release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      releaseVersion:
        description: 'Release Version (e.g., 0.49.0 for GA or 0.49.0-rc1 for RC)'
        required: true
        type: string
      useSuffix:
        description: 'Build suffixed images (e.g., 0.49.0-0 before final 0.49.0)'
        required: true
        type: boolean
        default: true
      releaseSuffix:
        description: 'Release Suffix (e.g., 0 for 0.49.0-0, used only if useSuffix is true)'
        required: true
        type: string
        default: '0'
      sourceBuildRunId:
        description: 'GitHub Actions Run ID of the source build (find in Actions tab URL)'
        required: true
        type: string

# Declare default permissions as read only
permissions:
  contents: read

jobs:
  # Prepare release artifacts - builds release files, documentation, and pushes to Maven Central
  prepare-release-artifacts:
    name: Prepare Release Artifacts
    if: ${{ startsWith(github.ref, 'refs/heads/release-') }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6

      - name: Setup Java and Maven
        uses: strimzi/github-actions/.github/actions/dependencies/setup-java@main
        with:
          javaVersion: "21"

      - name: Install yq
        uses: strimzi/github-actions/.github/actions/dependencies/install-yq@main
        with:
          version: "v4.6.3"

      - name: Install Helm
        uses: strimzi/github-actions/.github/actions/dependencies/install-helm@main
        with:
          helmVersion: "v3.16.0"

      - name: Install AsciiDoctor
        uses: strimzi/github-actions/.github/actions/dependencies/install-ascii-doctor@main
        with:
          rubyVersion: "3.2"

      - name: Prepare release artifacts
        uses: strimzi/github-actions/.github/actions/build/release-artifacts@main
        with:
          releaseVersion: ${{ inputs.releaseVersion }}
          artifactSuffix: "operators"

      - name: Deploy to Maven Central
        uses: strimzi/github-actions/.github/actions/build/deploy-java@main
        with:
          modules: "./,crd-annotations,crd-generator,test,api,v1-api-conversion"
          gpgPassphrase: ${{ secrets.GPG_PASSPHRASE }}
          gpgSigningKey: ${{ secrets.GPG_SIGNING_KEY }}
          centralUsername: ${{ secrets.CENTRAL_USERNAME }}
          centralPassword: ${{ secrets.CENTRAL_PASSWORD }}

      - name: "Build documentation"
        uses: ./.github/actions/build/build-docs
        with:
          artifactName: "documentation.tar"

  # Push Java artifacts to GHCR for long-term storage (for CVE rebuilds)
  push-java-artifacts-to-ghcr:
    name: Push Java artifacts to GHCR
    if: ${{ startsWith(github.ref, 'refs/heads/release-') }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      packages: write
    steps:
      - uses: actions/checkout@v6

      - name: Setup ORAS
        uses: oras-project/setup-oras@v1

      - name: Download strimzi binaries from source build
        uses: actions/download-artifact@v7
        with:
          name: binaries-operators.tar
          run-id: ${{ inputs.sourceBuildRunId }}
          github-token: ${{ github.token }}

      - name: Login to GHCR
        run: echo "${{ github.token }}" | oras login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Push Java artifacts to GHCR
        run: |
          oras push ghcr.io/${{ env.REPOSITORY }}/binaries-operators:${{ env.TAG }} binaries-operators.tar:application/x-tar
        env:
          TAG: ${{ inputs.releaseVersion }}-${{ inputs.sourceBuildRunId }}
          REPOSITORY: "strimzi"

  # Push containers with suffix (e.g., 0.49.0-0) - optional step
  push-containers-with-suffix:
    name: Push Containers with suffix
    needs:
      - prepare-release-artifacts
      - push-java-artifacts-to-ghcr
    if: ${{ startsWith(github.ref, 'refs/heads/release-') && inputs.useSuffix == true }}
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v6

      - name: Install Docker
        uses: strimzi/github-actions/.github/actions/dependencies/install-docker@main

      - name: Install yq
        uses: strimzi/github-actions/.github/actions/dependencies/install-yq@main
        with:
          version: "v4.6.3"

      - name: Install Syft
        uses: strimzi/github-actions/.github/actions/dependencies/install-syft@main
        with:
          version: "1.20.0"

      - name: Push containers using push-containers action
        uses: strimzi/github-actions/.github/actions/build/push-containers@main
        with:
          registryUser: ${{ secrets.QUAY_USER }}
          registryPassword: ${{ secrets.QUAY_PASS }}
          containerRegistry: "quay.io"
          containerOrg: "strimzi"
          containerTag: "${{ inputs.releaseVersion }}-${{ inputs.releaseSuffix }}"
          architectures: "amd64,arm64,ppc64le,s390x"
          artifactSuffix: "operators"
          buildRunId: ${{ inputs.sourceBuildRunId }}

  # Push containers without suffix (e.g., 0.49.0)
  push-containers:
    name: Push Containers without suffix (${{ inputs.releaseVersion }})
    needs:
      - push-containers-with-suffix
      - push-java-artifacts-to-ghcr
      - prepare-release-artifacts
    # Run if push-containers-with-suffix succeeded/skipped and we're on a release branch
    if: |-
      ${{ always() && startsWith(github.ref, 'refs/heads/release-') &&
        needs.prepare-release-artifacts.result == 'success' &&
        needs.push-java-artifacts-to-ghcr.result == 'success' &&
        (needs.push-containers-with-suffix.result == 'success' ||
        needs.push-containers-with-suffix.result == 'skipped')
      }}
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v6

      - name: Install Docker
        uses: strimzi/github-actions/.github/actions/dependencies/install-docker@main

      - name: Install yq
        uses: strimzi/github-actions/.github/actions/dependencies/install-yq@main
        with:
          version: "v4.6.3"

      - name: Install Syft
        uses: strimzi/github-actions/.github/actions/dependencies/install-syft@main
        with:
          version: "1.20.0"

      - name: Push containers using push-containers action
        uses: strimzi/github-actions/.github/actions/build/push-containers@main
        with:
          registryUser: ${{ secrets.QUAY_USER }}
          registryPassword: ${{ secrets.QUAY_PASS }}
          containerRegistry: "quay.io"
          containerOrg: "strimzi"
          containerTag: "${{ inputs.releaseVersion }}"
          architectures: "amd64,arm64,ppc64le,s390x"
          artifactSuffix: "operators"

  # Publish Helm Chart as OCI artifact
  publish-helm-chart:
    name: Publish Helm Chart
    needs:
      - prepare-release-artifacts
      - push-java-artifacts-to-ghcr
      - push-containers
    if: |-
      ${{ always() && startsWith(github.ref, 'refs/heads/release-') && 
        needs.push-containers.result == 'success'
      }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6

      - name: Install Helm
        uses: strimzi/github-actions/.github/actions/dependencies/install-helm@main
        with:
          helmVersion: "v3.16.0"

      - name: Publish Helm charts using publish-helm action
        uses: strimzi/github-actions/.github/actions/build/publish-helm-chart@main
        with:
          registryUser: ${{ secrets.QUAY_HELM_USER }}
          registryPassword: ${{ secrets.QUAY_HELM_PASS }}
          containerRegistry: "quay.io"
          containerOrg: "strimzi-helm"
          helmChartName: "strimzi-kafka-operator-helm-3-chart"
          releaseVersion: ${{ inputs.releaseVersion }}
          artifactSuffix: "operators"