release.yaml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to release (e.g. v1.2.3)"
        required: true
        type: string

permissions:
  contents: write
  packages: write
  pull-requests: write
  id-token: write # Required by build-and-push.yaml for keyless cosign signing

jobs:
  build-and-push:
    uses: ./.github/workflows/build-and-push.yaml
    with:
      version: ${{ inputs.version }}
    permissions:
      packages: write
      id-token: write

  version:
    runs-on: ubuntu-latest
    environment: production
    needs: build-and-push
    env:
      CHART_PATH: ./deploy/charts/burrito
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
          ref: main

      - name: Bump VERSION file
        run: echo "${{ inputs.version }}" > VERSION

      - name: Bump Helm Chart versions
        run: |
          export CHART_VERSION=$(echo "${{ inputs.version }}" | sed 's/v//g')
          export APP_VERSION="${{ inputs.version }}"
          yq -i '.version = env(CHART_VERSION)' $CHART_PATH/Chart.yaml
          yq -i '.appVersion = env(APP_VERSION)' $CHART_PATH/Chart.yaml

      - name: Pin image tag and digest in values.yaml
        run: |
          export IMAGE_TAG="${{ inputs.version }}@${{ needs.build-and-push.outputs.digest }}"
          yq -i '.global.deployment.image.tag = env(IMAGE_TAG)' $CHART_PATH/values.yaml
          yq -i '.config.burrito.runner.image.tag = env(IMAGE_TAG)' $CHART_PATH/values.yaml

      - name: Commit and open PR
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          BRANCH_NAME="bump-version-${{ inputs.version }}"
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add .
          git switch -c $BRANCH_NAME
          git commit -m "chore(release): bump version to ${{ inputs.version }}"
          git push origin $BRANCH_NAME
          gh pr create --fill --base main --head $BRANCH_NAME