operatorhub.yaml

name: OperatorHub Submission

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (e.g. v0.1.0)'
        required: true

jobs:
  submit:
    name: Submit to OperatorHub
    runs-on: ubuntu-latest
    steps:
      - name: Resolve tag
        id: version
        run: |
          TAG="${{ github.event.inputs.tag || github.ref_name }}"
          VERSION="${TAG#v}"
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "tag=$TAG" >> $GITHUB_OUTPUT

      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ steps.version.outputs.tag }}

      - name: Prepare bundle
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          TAG="${{ steps.version.outputs.tag }}"
          BUNDLE_DIR="submission/operators/paperclip-operator/${VERSION}"

          # Resolve the published image to an immutable digest reference so the
          # submitted bundle is pinned (OLM best practice). Fall back to the
          # floating tag if the digest cannot be resolved (e.g. registry hiccup).
          IMG="ghcr.io/paperclipinc/paperclip-operator"
          DIGEST="$(docker buildx imagetools inspect "${IMG}:${TAG}" --format '{{ .Manifest.Digest }}' 2>/dev/null || true)"
          if [ -n "${DIGEST}" ]; then IMG_REF="${IMG}@${DIGEST}"; else IMG_REF="${IMG}:${TAG}"; fi
          echo "Pinning image to: ${IMG_REF}"

          mkdir -p "${BUNDLE_DIR}/manifests" "${BUNDLE_DIR}/metadata"

          # Copy and version the CSV
          sed \
            -e "s/paperclip-operator\.v[0-9]\+\.[0-9]\+\.[0-9]\+/paperclip-operator.v${VERSION}/g" \
            -e "s|ghcr.io/paperclipinc/paperclip-operator:v[0-9]\+\.[0-9]\+\.[0-9]\+|${IMG_REF}|g" \
            -e "s/createdAt: .*/createdAt: \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"/" \
            -e "s/^  version: [0-9]\+\.[0-9]\+\.[0-9]\+/  version: ${VERSION}/" \
            bundle/manifests/paperclip-operator.v*.clusterserviceversion.yaml \
            > "${BUNDLE_DIR}/manifests/paperclip-operator.v${VERSION}.clusterserviceversion.yaml"

          # Copy all CRD manifests and metadata as-is. The bundle ships every
          # CRD the operator's controllers watch (instances,
          # paperclipclusterdefaults, paperclipselfconfigs); an OLM install that
          # is missing any of them crashes on cache sync. Prefer the curated
          # bundle/manifests/ copies, falling back to config/crd/bases/.
          if ls bundle/manifests/paperclip.inc_*.yaml >/dev/null 2>&1; then
            cp bundle/manifests/paperclip.inc_*.yaml "${BUNDLE_DIR}/manifests/"
          else
            cp config/crd/bases/paperclip.inc_*.yaml "${BUNDLE_DIR}/manifests/"
          fi
          cp bundle/metadata/annotations.yaml "${BUNDLE_DIR}/metadata/"

          echo "Bundle prepared at ${BUNDLE_DIR}:"
          find "${BUNDLE_DIR}" -type f

      - name: Fork and submit to community-operators
        env:
          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          BRANCH="paperclip-operator-v${VERSION}"

          # Configure gh as git credential helper so git push works with the PAT
          gh auth setup-git

          # Clone the community-operators repo (fork is auto-created by gh).
          # --remote is incompatible with passing a repo argument in modern gh;
          # gh repo fork --clone already sets up origin=fork and upstream=canonical
          # in the new clone.
          gh repo fork k8s-operatorhub/community-operators --clone=true -- community-operators
          cd community-operators

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          # Sync fork with upstream to avoid stale-branch CI failures
          git fetch upstream main
          git reset --hard upstream/main

          git checkout -b "${BRANCH}"

          # Copy prepared bundle
          mkdir -p operators/paperclip-operator
          cp -r ../submission/operators/paperclip-operator/${VERSION} operators/paperclip-operator/${VERSION}

          # Write the operator-level ci.yaml so framework-automation auto-applies
          # the `authorized-changes` label on our bundle PRs. Without this, each
          # PR waits for a human maintainer review (typically ~hours to a day).
          # Idempotent: if the file already exists upstream with the same content,
          # git will see no diff.
          cat > operators/paperclip-operator/ci.yaml <<'CI_YAML'
          ---
          # Authorized reviewers for paperclip-operator PRs.
          # A PR authored by any user listed here gets the `authorized-changes` label
          # applied automatically by framework-automation, which enables the PR to
          # auto-merge once framework checks pass.
          reviewers:
            - stubbi
          CI_YAML

          git add "operators/paperclip-operator/${VERSION}" operators/paperclip-operator/ci.yaml
          git commit -s -m "operator paperclip-operator (${VERSION})"
          git push --force origin "${BRANCH}"

          # Create PR or update existing one
          FORK_OWNER=$(gh api user --jq '.login')

          if ! gh pr view "${FORK_OWNER}:${BRANCH}" --repo k8s-operatorhub/community-operators --json state --jq '.state' 2>/dev/null | grep -q OPEN; then
            gh pr create \
              --repo k8s-operatorhub/community-operators \
              --head "${FORK_OWNER}:${BRANCH}" \
              --title "operator paperclip-operator (${VERSION})" \
              --body "$(cat <<EOF
          ### Update to paperclip-operator

          **Version:** ${VERSION}
          **Operator:** [Paperclip Kubernetes Operator](https://github.com/paperclipinc/paperclip-operator)

          #### Changes
          See [release notes](https://github.com/paperclipinc/paperclip-operator/releases/tag/v${VERSION}).

          #### Testing
          - CI tests pass on the source repository
          - Container image is published and signed at \`ghcr.io/paperclipinc/paperclip-operator:v${VERSION}\`
          EOF
          )"
          else
            echo "PR already exists for ${FORK_OWNER}:${BRANCH} - branch was force-pushed with updated content"
          fi

  submit-redhat:
    name: Submit to RedHat community-operators-prod
    runs-on: ubuntu-latest
    steps:
      - name: Resolve tag
        id: version
        run: |
          TAG="${{ github.event.inputs.tag || github.ref_name }}"
          VERSION="${TAG#v}"
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "tag=$TAG" >> $GITHUB_OUTPUT

      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ steps.version.outputs.tag }}

      - name: Prepare bundle
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          TAG="${{ steps.version.outputs.tag }}"
          BUNDLE_DIR="submission/operators/paperclip-operator/${VERSION}"

          # Resolve the published image to an immutable digest reference so the
          # submitted bundle is pinned (OLM best practice). Fall back to the
          # floating tag if the digest cannot be resolved (e.g. registry hiccup).
          IMG="ghcr.io/paperclipinc/paperclip-operator"
          DIGEST="$(docker buildx imagetools inspect "${IMG}:${TAG}" --format '{{ .Manifest.Digest }}' 2>/dev/null || true)"
          if [ -n "${DIGEST}" ]; then IMG_REF="${IMG}@${DIGEST}"; else IMG_REF="${IMG}:${TAG}"; fi
          echo "Pinning image to: ${IMG_REF}"

          mkdir -p "${BUNDLE_DIR}/manifests" "${BUNDLE_DIR}/metadata"

          # Copy and version the CSV
          sed \
            -e "s/paperclip-operator\.v[0-9]\+\.[0-9]\+\.[0-9]\+/paperclip-operator.v${VERSION}/g" \
            -e "s|ghcr.io/paperclipinc/paperclip-operator:v[0-9]\+\.[0-9]\+\.[0-9]\+|${IMG_REF}|g" \
            -e "s/createdAt: .*/createdAt: \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"/" \
            -e "s/^  version: [0-9]\+\.[0-9]\+\.[0-9]\+/  version: ${VERSION}/" \
            bundle/manifests/paperclip-operator.v*.clusterserviceversion.yaml \
            > "${BUNDLE_DIR}/manifests/paperclip-operator.v${VERSION}.clusterserviceversion.yaml"

          # Copy all CRD manifests and metadata as-is. The bundle ships every
          # CRD the operator's controllers watch (instances,
          # paperclipclusterdefaults, paperclipselfconfigs); an OLM install that
          # is missing any of them crashes on cache sync. Prefer the curated
          # bundle/manifests/ copies, falling back to config/crd/bases/.
          if ls bundle/manifests/paperclip.inc_*.yaml >/dev/null 2>&1; then
            cp bundle/manifests/paperclip.inc_*.yaml "${BUNDLE_DIR}/manifests/"
          else
            cp config/crd/bases/paperclip.inc_*.yaml "${BUNDLE_DIR}/manifests/"
          fi
          cp bundle/metadata/annotations.yaml "${BUNDLE_DIR}/metadata/"

          echo "Bundle prepared at ${BUNDLE_DIR}:"
          find "${BUNDLE_DIR}" -type f

      - name: Fork and submit to community-operators-prod
        env:
          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          BRANCH="paperclip-operator-v${VERSION}"

          # Configure gh as git credential helper so git push works with the PAT
          gh auth setup-git

          # Clone the community-operators-prod repo (fork is auto-created by gh).
          # gh repo fork --clone already sets up origin=fork and upstream=canonical
          # in the new clone.
          gh repo fork redhat-openshift-ecosystem/community-operators-prod --clone=true -- community-operators-prod
          cd community-operators-prod

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          # Sync fork with upstream to avoid stale-branch CI failures
          git fetch upstream main
          git reset --hard upstream/main

          git checkout -b "${BRANCH}"

          # Copy prepared bundle. RedHat uses a different review model, so we do
          # NOT write a ci.yaml here (unlike the k8s community-operators job).
          mkdir -p operators/paperclip-operator
          cp -r ../submission/operators/paperclip-operator/${VERSION} operators/paperclip-operator/${VERSION}

          git add "operators/paperclip-operator/${VERSION}"
          git commit -s -m "operator paperclip-operator (${VERSION})"
          git push --force origin "${BRANCH}"

          # Create PR or update existing one
          FORK_OWNER=$(gh api user --jq '.login')

          if ! gh pr view "${FORK_OWNER}:${BRANCH}" --repo redhat-openshift-ecosystem/community-operators-prod --json state --jq '.state' 2>/dev/null | grep -q OPEN; then
            gh pr create \
              --repo redhat-openshift-ecosystem/community-operators-prod \
              --head "${FORK_OWNER}:${BRANCH}" \
              --title "operator paperclip-operator (${VERSION})" \
              --body "$(cat <<EOF
          ### Update to paperclip-operator

          **Version:** ${VERSION}
          **Operator:** [Paperclip Kubernetes Operator](https://github.com/paperclipinc/paperclip-operator)

          #### Changes
          See [release notes](https://github.com/paperclipinc/paperclip-operator/releases/tag/v${VERSION}).

          #### Testing
          - CI tests pass on the source repository
          - Container image is published and signed at \`ghcr.io/paperclipinc/paperclip-operator:v${VERSION}\`
          EOF
          )"
          else
            echo "PR already exists for ${FORK_OWNER}:${BRANCH} - branch was force-pushed with updated content"
          fi