release-lts.yml

name: Release NIC LTS
run-name: ${{ inputs.dry_run && '[DRY RUN] ' || '' }}Release NIC ${{ inputs.lts_version }} from ${{ inputs.release_branch }} by @${{ github.actor }}

on:
  workflow_dispatch:
    inputs:
      lts_version:
        description: "Version to release"
        required: true
        type: string
      source_tag:
        description: "Source tag to release"
        required: false
        type: string
      chart_version:
        description: "Helm Chart version to release"
        required: false
        type: string
      release_branch:
        description: "Branch to release from"
        required: true
        type: string
      dry_run:
        description: "Dry Run?"
        type: boolean
        default: false
      skip_step:
        description: "Comma separated list of jobs to skip"
        # publish-helm-chart,release-plus,azure-upload,github-release
        type: string
        required: false

defaults:
  run:
    shell: bash

permissions:
  contents: read

jobs:
  variables:
    name: Set Variables
    if: github.repository == 'nginx/kubernetes-ingress'
    runs-on: ubuntu-24.04-amd64
    permissions:
      contents: read
    outputs:
      source_tag: ${{ steps.vars.outputs.stable_tag }}
      short_tag: ${{ steps.vars.outputs.short_tag }}
      go_path: ${{ steps.vars.outputs.go_path }}
      go_proxy: ${{ steps.vars.outputs.go_proxy }}
      go_code_md5: ${{ steps.vars.outputs.go_code_md5 }}
      docker_md5: ${{ steps.vars.outputs.docker_md5 }}
      image_matrix_plus: ${{ steps.vars.outputs.image_matrix_plus }}
      date: ${{ steps.vars.outputs.date }}
      k8s_version: ${{ steps.vars.outputs.k8s_version }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 0
          ref: ${{ inputs.release_branch }}

      - name: Output Variables
        id: vars
        run: |
          if [ -n "${{ inputs.source_tag }}" ]; then
            echo "stable_tag=${{ inputs.source_tag }}" >> $GITHUB_OUTPUT
          else
            ./.github/scripts/variables.sh stable_tag >> $GITHUB_OUTPUT
          fi
          tag=${{ inputs.lts_version }}
          echo "short_tag=${tag%.*}" >> $GITHUB_OUTPUT
          echo "go_path=$(go env GOPATH)" >> $GITHUB_OUTPUT
          echo "go_proxy=${{ secrets.ARTIFACTORY_ENDPOINT }}" >> $GITHUB_OUTPUT
          echo "image_matrix_plus=$(cat .github/data/matrix-images-plus-lts.json | jq -c)" >> $GITHUB_OUTPUT
          ./.github/scripts/variables.sh docker_md5 >> $GITHUB_OUTPUT
          ./.github/scripts/variables.sh go_code_md5 >> $GITHUB_OUTPUT
          date=$(date "+%Y%m%d")
          echo "date=${date}" >> $GITHUB_OUTPUT
          k8s_version=$(grep "^K8S_CLUSTER_VERSION" tests/Makefile | cut -d '?' -f 2 | tr -d ' =')
          echo "k8s_version=${k8s_version}" >> $GITHUB_OUTPUT
          cat $GITHUB_OUTPUT

  build-artifacts:
    if: github.repository == 'nginx/kubernetes-ingress' && (!cancelled() && !failure() && !inputs.dry_run && !contains(inputs.skip_step, 'build-artifacts'))
    name: Build Artifacts
    needs: [variables]
    uses: ./.github/workflows/build-artifacts.yml
    with:
      force: true
      authenticated: true
      ic-version: ${{ inputs.lts_version }}
      go-path: ${{ needs.variables.outputs.go_path }}
      go-proxy: ${{ needs.variables.outputs.go_proxy }}
      image-matrix-oss: '{"include":[]}'
      image-matrix-plus: ${{ needs.variables.outputs.image_matrix_plus }}
      image-matrix-nap: '{"include":[]}'
      branch: ${{ inputs.release_branch }}
      tag: ${{ needs.variables.outputs.source_tag }}
      go-md5: ${{ needs.variables.outputs.go_code_md5 }}
      docker-md5: ${{ needs.variables.outputs.docker_md5 }}
      runner: "ubuntu-24.04-amd64"
      write-to-cache: true
      read-from-cache: false
    secrets: inherit
    permissions:
      contents: read
      actions: read
      security-events: write
      id-token: write
      packages: write
      pull-requests: write # for scout report
      checks: write # for setting status on commit

  tag:
    name: Create Tag on release branch in NIC repo
    runs-on: ubuntu-24.04
    needs: [build-artifacts]
    if: github.repository == 'nginx/kubernetes-ingress' && (!cancelled() && (needs.build-artifacts.result == 'success' || (needs.build-artifacts.result == 'skipped' && inputs.dry_run)))
    permissions:
      contents: write
    steps:
      - name: Checkout NIC repo
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ inputs.release_branch }}
          fetch-depth: 0

      - name: Create new release Tag
        run: |
          git config --global user.email "kubernetes@nginx.com"
          git config --global user.name "NGINX Kubernetes Team"
          branch="${{ inputs.release_branch }}"
          tag="${{ inputs.lts_version }}"
          if ! git rev-parse --verify "refs/tags/${tag}"; then
            echo "Adding tag ${tag}."
            git tag -a "${tag}" -m "Version ${tag#v*}"
            echo "Pushing to tag ${tag} to branch ${branch}"
            if ! ${{ inputs.dry_run }}; then
              git push origin "${tag}"
            else
              echo "DRY RUN not making any changes"
              git push --dry-run origin "${tag}"
            fi
          else
            echo "Warning: Tag ${tag} already exists.  Not making any changes"
          fi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  release-plus-gcr-nginx:
    if: github.repository == 'nginx/kubernetes-ingress' && (!cancelled() && (needs.build-artifacts.result == 'success' || (needs.build-artifacts.result == 'skipped' && inputs.dry_run)) && !contains(inputs.skip_step, 'release-plus'))
    name: Release Docker Plus
    needs: [variables, build-artifacts]
    uses: ./.github/workflows/plus-release-lts.yml
    strategy:
      fail-fast: false
      matrix:
        tag:
          - "${{ inputs.lts_version }}"
          - "${{ inputs.lts_version }}-${{ needs.variables.outputs.date }}"
    with:
      gcr_release_registry: true
      nginx_registry: true
      source_tag: ${{ needs.variables.outputs.source_tag }}
      target_tag: ${{ matrix.tag }}
      branch: ${{ inputs.release_branch }}
      dry_run: ${{ inputs.dry_run }}
    permissions:
      contents: read
      id-token: write
    secrets: inherit

  publish-helm-chart:
    if: github.repository == 'nginx/kubernetes-ingress' && (! cancelled() && ! failure() && ! inputs.dry_run && ! contains(inputs.skip_step, 'publish-helm-chart'))
    name: Publish Helm Chart
    uses: ./.github/workflows/publish-helm.yml
    with:
      branch: ${{ inputs.release_branch }}
      ic_version: ${{ inputs.lts_version }}
      chart_version: ${{ inputs.chart_version }}
      chart_name: "nginx-ingress-lts"
      nginx_helm_repo: false # we don't want to publish to the nginx helm repo for LTS releases, but we want to run the workflow to publish to GHCR & DockerHub
      runner: "ubuntu-24.04-amd64"
    permissions:
      contents: write
      packages: write # for helm to push to GHCR
      id-token: write
    secrets: inherit

  binaries:
    if: github.repository == 'nginx/kubernetes-ingress' && (
      !cancelled() && (needs.build-artifacts.result == 'success' || (needs.build-artifacts.result == 'skipped' && contains(inputs.skip_step, 'build-artifacts')))
      )
    name: Process Binaries
    runs-on: ubuntu-24.04-amd64
    needs: [variables, build-artifacts]
    permissions:
      contents: read
      id-token: write # for cosign to sign artifacts
    steps:
      - name: Checkout Repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ inputs.release_branch }}

      - name: Fetch Binary Artifacts from Cache
        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
          path: ${{ github.workspace }}/dist
          key: nginx-ingress-${{ needs.variables.outputs.go_code_md5 }}

      - name: Download Syft
        id: syft
        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0

      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: 'v2.6.5'

      - name: Create Tarballs
        run: |
          ./.github/scripts/create-release-tarballs.sh dist ${{ inputs.lts_version }}
        env:
          SYFT_BIN: ${{ steps.syft.outputs.cmd }}

      - name: Store Tarball Artifacts in Cache
        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
          path: ${{ github.workspace }}/tarballs
          key: nginx-ingress-release-${{ needs.variables.outputs.go_code_md5 }}

  # Upload packages, sboms & checksums to release storage
  azure-upload:
    if: github.repository == 'nginx/kubernetes-ingress' && (! cancelled() && ! failure() && ! contains(inputs.skip_step, 'azure-upload'))
    name: Upload packages to Azure
    runs-on: ubuntu-24.04-amd64
    needs: [variables, binaries]
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout Repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ inputs.release_branch }}

      - name: Fetch Cached Tarball Artifacts
        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
          key: nginx-ingress-release-${{ needs.variables.outputs.go_code_md5 }}
          path: ${{ github.workspace }}/tarballs
          fail-on-cache-miss: true

      - name: Azure login for secrets
        uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
        with:
          client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}

      - name: Setup secrets
        id: secrets
        run: |
          echo "Setting secrets for job"
          AZURE_STORAGE=$(az keyvault secret show --name azure-storage --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
          echo "::add-mask::$AZURE_STORAGE"
          AZURE_STORAGE_ACCOUNT=$(echo $AZURE_STORAGE | jq -r '.account')
          echo "::add-mask::$AZURE_STORAGE_ACCOUNT"
          echo "AZURE_STORAGE_ACCOUNT=$AZURE_STORAGE_ACCOUNT" >> $GITHUB_OUTPUT
          AZURE_BUCKET_NAME=$(echo $AZURE_STORAGE | jq -r '.bucket')
          echo "::add-mask::$AZURE_BUCKET_NAME"
          echo "AZURE_BUCKET_NAME=$AZURE_BUCKET_NAME" >> $GITHUB_OUTPUT

      - name: Azure login for upload
        uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Azure Upload Release Packages
        uses: azure/CLI@9eb25b8360668fb0ecbafa808d40e2197b2f5f52 # v3.0.0
        with:
          inlineScript: |
            for i in $(find tarballs -type f); do
              echo -n "Uploading ${i} to kubernetes-ingress/${{ inputs.lts_version }}/${i##*/} ... "
              if ${{ ! inputs.dry_run}}; then
                az storage blob upload --auth-mode=login -f "$i" -c ${{ steps.secrets.outputs.AZURE_BUCKET_NAME }} \
                  --account-name ${{ steps.secrets.outputs.AZURE_STORAGE_ACCOUNT }} --overwrite -n kubernetes-ingress/${{ inputs.lts_version }}/${i##*/}
                echo "done"
              else
                echo "skipped, dry_run."
              fi
            done

  release-gate:
    name: All prerequisites met
    runs-on: ubuntu-24.04
    needs: [binaries, release-plus-gcr-nginx, publish-helm-chart]
    if: >-
      github.repository == 'nginx/kubernetes-ingress' && (
      cancelled() == false &&
      needs.binaries.result == 'success' &&
      (needs.release-plus-gcr-nginx.result == 'success' || contains(inputs.skip_step, 'release-plus')) &&
      (needs.publish-helm-chart.result == 'success' || contains(inputs.skip_step, 'publish-helm-chart'))
      )
    steps:
      - run: echo "All prerequisites met"

  github-release:
    needs: [variables, release-gate]
    if: github.repository == 'nginx/kubernetes-ingress' && (!cancelled() && needs.release-gate.result == 'success' && !contains(inputs.skip_step, 'github-release'))
    name: Publish release to GitHub
    runs-on: ubuntu-24.04-amd64
    permissions:
      contents: write # to modify the release
      issues: write # to close milestone
      actions: read # for slack notification
    steps:
      - name: Checkout Repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ inputs.release_branch }}

      - name: Fetch Cached Tarball Artifacts
        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
          key: nginx-ingress-release-${{ needs.variables.outputs.go_code_md5 }}
          path: ${{ github.workspace }}/tarballs
          fail-on-cache-miss: true

      - name: Upload Release Assets
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        # clobber overwrites existing assets of the same name
        run: |
          if ! ${{ inputs.dry_run }}; then
            gh release upload --clobber ${{ inputs.lts_version }} \
              $(find ./tarballs -type f)
          else
            echo "Skipping adding binaries to Github Release, DRY_RUN"
          fi

      - name: Get Github release id
        id: release-id
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          release_id=$(gh api \
            -H "Accept: application/vnd.github.v3+json" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            /repos/${{ github.repository }}/releases \
            | jq --arg version "${{ inputs.lts_version }}" -r \
            '.[] | select(.name == $version) | .id')
          echo "release_id=${release_id}" >> $GITHUB_OUTPUT

      - name: Publish Github Release
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const {RELEASE_ID} = process.env
            const release = (await github.rest.repos.updateRelease({
              owner: context.payload.repository.owner.login,
              repo: context.payload.repository.name,
              release_id: `${RELEASE_ID}`,
              draft: false,
            }))
            console.log(`Release published: ${release.data.html_url}`)
        env:
          RELEASE_ID: ${{ steps.release-id.outputs.release_id }}
        if: ${{ ! inputs.dry_run }}