release.yaml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  packages: write
  id-token: write

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    steps:
      # Mint a short-lived App installation token. Required for the
      # release-undraft and SBOM-upload steps: GITHUB_TOKEN-issued events
      # don't fan out to downstream workflows. Replaces the long-lived
      # RELEASE_PLEASE_TOKEN PAT.
      - uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ vars.RELEASE_BOT_APP_ID }}
          private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}

      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Install Syft
        uses: anchore/sbom-action/download-syft@v0

      - name: Run GoReleaser
        id: goreleaser
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser
          version: latest
          # --skip=validate bypasses the git-state checks (dirty tree,
          # tag-on-HEAD). dist/install.yaml is generated by the
          # `before:hooks` in .goreleaser.yaml, which runs after --clean.
          args: release --clean --skip=validate
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Compute image tags
        id: image_tags
        run: |
          TAG="${{ github.ref_name }}"
          MAJOR_MINOR=$(echo "$TAG" | sed 's/^v//' | cut -d. -f1,2)
          IMAGE="ghcr.io/paperclipinc/hermes-operator"
          {
            echo "image=${IMAGE}"
            echo "major_minor=${MAJOR_MINOR}"
          } >> "$GITHUB_OUTPUT"
          {
            echo "tags<<EOF"
            echo "${IMAGE}:${TAG}"
            echo "${IMAGE}:${MAJOR_MINOR}"
            echo "${IMAGE}:latest"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Build and push container image (multi-arch)
        id: docker_build
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.image_tags.outputs.tags }}
          provenance: true
          sbom: false
          cache-from: type=gha
          cache-to: type=gha,mode=max
          labels: |
            org.opencontainers.image.title=hermes-operator
            org.opencontainers.image.version=${{ github.ref_name }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.source=https://github.com/paperclipinc/hermes-operator
            org.opencontainers.image.licenses=Apache-2.0

      - name: Sign container image with cosign (keyless OIDC)
        env:
          COSIGN_EXPERIMENTAL: "true"
          IMAGE: ${{ steps.image_tags.outputs.image }}
          DIGEST: ${{ steps.docker_build.outputs.digest }}
        run: cosign sign --yes "${IMAGE}@${DIGEST}"

      - name: Generate SBOM for container image
        uses: anchore/sbom-action@v0
        with:
          image: ghcr.io/paperclipinc/hermes-operator:${{ github.ref_name }}
          artifact-name: sbom-${{ github.ref_name }}.spdx.json
          output-file: sbom-${{ github.ref_name }}.spdx.json

      - name: Attest SBOM with cosign
        env:
          COSIGN_EXPERIMENTAL: "true"
          IMAGE: ${{ steps.image_tags.outputs.image }}
          DIGEST: ${{ steps.docker_build.outputs.digest }}
          TAG: ${{ github.ref_name }}
        run: cosign attest --yes --predicate "sbom-${TAG}.spdx.json" --type spdxjson "${IMAGE}@${DIGEST}"

      - name: Upload SBOM to GitHub release
        uses: softprops/action-gh-release@v2
        with:
          files: sbom-${{ github.ref_name }}.spdx.json
          token: ${{ steps.app-token.outputs.token }}

      - name: Publish release (undraft)
        uses: softprops/action-gh-release@v2
        with:
          draft: false
          token: ${{ steps.app-token.outputs.token }}

  helm-release:
    name: Helm OCI Release
    runs-on: ubuntu-latest
    needs: release
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Helm
        uses: azure/setup-helm@v5
        with:
          version: latest

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Package, push, and sign Helm chart
        run: |
          CHART_VERSION="${{ github.ref_name }}"
          CHART_VERSION="${CHART_VERSION#v}"
          helm package charts/hermes-operator \
            --version "${CHART_VERSION}" \
            --app-version "${{ github.ref_name }}"
          PUSH_OUT=$(helm push "hermes-operator-${CHART_VERSION}.tgz" oci://ghcr.io/paperclipinc/charts 2>&1)
          echo "${PUSH_OUT}"
          DIGEST=$(echo "${PUSH_OUT}" | awk '/Digest:/ {print $2}')
          if [ -z "${DIGEST}" ]; then echo "::error::could not parse chart digest"; exit 1; fi
          cosign sign --yes "ghcr.io/paperclipinc/charts/hermes-operator@${DIGEST}"