Add nightly release workflow

Signed-off-by: Alexander Scheel <ascheel@gitlab.com>

Author: cipherboy

.github/workflows/release.yml

@@ -21,6 +21,11 @@ on:
         required: false
         default: true
         type: boolean
+      nightly:
+        description: "Mark as nightly build"
+        required: true
+        default: true
+        type: boolean
 
 permissions:
   contents: write
@@ -43,11 +48,45 @@ jobs:
           - openbsd
           - windows
     steps:
+      - name: Disable release on nightly repository
+        if: ${{ !inputs.nightly }}
+        run: |
+          if [ "$GITHUB_REPOSITORY" == "openbao/openbao-nightly" ]; then
+            echo "Refusing to run non-nightly release on nightly repo" 1>&2
+            exit 1
+          fi
+
       - name: Checkout
         uses: actions/checkout@v4.1.7
         with:
           fetch-depth: 0 # Required by GoRelease
 
+      - name: Disable nightly on primary repository
+        if: inputs.nightly
+        env:
+          PRERELEASE: ${{ inputs.prerelease }}
+        run: |
+          if [ "$GITHUB_REPOSITORY" != "openbao/openbao-nightly" ]; then
+            echo "Refusing to run nightly release on non-nightly repo" 1>&2
+            exit 1
+          fi
+
+          # Locally remove previous nightly tags so they do not interfere
+          # with nightly tag computation. Also add the upstream.
+          for tag in $(git tag); do
+            if [[ "$tag" == *nightly* ]]; then
+              echo "Deleting $tag"
+              git tag --delete "$tag"
+            fi
+          done
+          git remote add upstream https://github.com/openbao/openbao
+          git fetch --all
+
+          # Then create a nightly tag for this commit. Because this uses the
+          # time of commit, it is stable across different runners.
+          nightly_tag="$(bash ./scripts/nightly_tag.sh)"
+          git tag "$nightly_tag"
+
       - name: Golang Setup
         uses: ./.github/actions/set-up-go
 
@@ -98,22 +137,22 @@ jobs:
           key: ${{ github.ref }}
 
       - name: "Docker Login: ghcr.io"
-        if: startsWith(github.ref, 'refs/tags/')
+        if: startsWith(github.ref, 'refs/tags/') || inputs.nightly
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: "Docker Login: docker.io"
-        if: startsWith(github.ref, 'refs/tags/')
+        if: startsWith(github.ref, 'refs/tags/') || inputs.nightly
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
 
       - name: "Docker Login: quay.io"
-        if: startsWith(github.ref, 'refs/tags/')
+        if: startsWith(github.ref, 'refs/tags/') || inputs.nightly
         uses: docker/login-action@v3
         with:
           registry: quay.io
@@ -122,7 +161,7 @@ jobs:
 
         # Needed for nPFM
       - name: Create GPG Signing Key File
-        if: startsWith(github.ref, 'refs/tags/')
+        if: startsWith(github.ref, 'refs/tags/') || inputs.nightly
         run: |
           GPG_KEY_FILE=/tmp/signing-key.gpg
           echo "${{ secrets.GPG_PRIVATE_KEY_BASE64 }}" | base64 -di > "${GPG_KEY_FILE}"
@@ -145,14 +184,14 @@ jobs:
 
       # Execute Go binary builds
       - name: "Template GoRelaser configuration"
-        if: startsWith(github.ref, 'refs/tags/')
+        if: startsWith(github.ref, 'refs/tags/') || inputs.nightly
         run: |
           sed "s/REPLACE_WITH_RELEASE_GOOS/${{ matrix.release_os }}/g" .goreleaser-template.yaml > .goreleaser.yaml
           sed -i "s/^#OTHERARCH#//g" .goreleaser.yaml
           [ "${{ matrix.release_os }}" == "linux" ] && sed -i "s/^#LINUXONLY#//g" .goreleaser.yaml || true
 
       - name: "GoReleaser: Release"
-        if: startsWith(github.ref, 'refs/tags/')
+        if: startsWith(github.ref, 'refs/tags/') || inputs.nightly
         uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
@@ -168,6 +207,7 @@ jobs:
           GITHUB_RELEASE_PRERELEASE: ${{ inputs.prerelease }}
           GITHUB_RELEASE_MAKE_LATEST: ${{ inputs.make-latest }}
           NFPM_DEFAULT_PASSPHRASE: ${{ secrets.GPG_PASSWORD }}
+          NIGHTLY_RELEASE: ${{ inputs.nightly }}
 
       - name: Remove GPG Signing Key File
         if: always()