release.yml

name: Create a new release for RuntimeEnforcer stack

on:
  push:
    tags:
      - 'v*.*.*'

jobs:
  build:
    strategy:
      matrix:
        component: [controller, agent, debugger]
        arch: [amd64, arm64]
        include:
          - arch: amd64
            runner: ubuntu-latest
          - arch: arm64
            runner: ubuntu-24.04-arm
    permissions:
      contents: read # Access private repos
      packages: write
      id-token: write
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Build image
        uses: ./.github/actions/container-build
        with:
          arch: ${{ matrix.arch }}
          dockerfile: package/Dockerfile.${{ matrix.component }}
          image: ${{ matrix.component }}
          repo: ${{ github.repository }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  merge:
    runs-on: ubuntu-latest
    needs: [build]
    permissions:
      contents: read # Access private repos
      packages: write # Pushing multi-arch manifest to ghcr.io
      id-token: write # Signing images with cosign
    strategy:
      matrix:
        component: [controller, agent, debugger]
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Merge images
        uses: ./.github/actions/merge-multiarch
        with:
          arch: amd64,arm64
          image: ${{ matrix.component }}
          repo: ${{ github.repository }}
          tag: ${{ github.ref_name }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  attest:
    name: Sign attestations and upload as artifacts
    strategy:
      matrix:
        component: [controller, agent, debugger]
        arch: [amd64, arm64]
        include:
          - arch: amd64
            runner: ubuntu-latest
            platform: linux/amd64
          - arch: arm64
            runner: ubuntu-24.04-arm
            platform: linux/arm64
    needs: [merge]
    permissions:
      contents: read # Access private repos
      packages: write # Uploading signed artifacts to ghcr.io
      id-token: write # Signing images with cosign
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Attestation
        uses: ./.github/actions/attestation
        with:
          arch: ${{ matrix.arch }}
          image: ${{ matrix.component }}
          repo: ${{github.repository}}
          artifact_prefix: RuntimeEnforcer-
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  # kubectl plugin – build binaries for all target platforms via the Makefile.
  plugin-build:
    name: Plugin build
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "go.mod"
          cache: false
      - name: Build kubectl plugin for all platforms
        run: make kubectl-plugin-cross KUBECTL_PLUGIN_VERSION=${GITHUB_REF_NAME}
      - name: Generate checksums
        run: |
          cd bin/kubectl-plugin
          for f in kubectl-runtime_enforcer-*; do
            sha256sum "$f" > "$f.sha256"
          done
      - name: Upload plugin artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: kubectl-plugin
          path: bin/kubectl-plugin/
          if-no-files-found: error

  create-release:
    needs: [attest, plugin-build]
    permissions:
      contents: write # Creating a release
    runs-on: ubuntu-latest
    steps:
      - name: Retrieve tag name
        if: ${{ startsWith(github.ref, 'refs/tags/') }}
        run: |
          echo TAG_NAME=$(echo ${GITHUB_REF_NAME}) >> $GITHUB_ENV
      - name: Get release ID from the release created by release drafter
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            let releases = await github.rest.repos.listReleases({
                owner: context.repo.owner,
                repo: context.repo.repo,
            });
            for (const release of releases.data) {
              if (release.draft) {
                      core.info(release)
                      core.exportVariable('RELEASE_ID', release.id)
                      return
              }
            }
            core.setFailed(`Draft release not found`)
      - name: Download attestation artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: attestation-RuntimeEnforcer-*
          merge-multiple: true
      - name: Download plugin artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: kubectl-plugin
          merge-multiple: true
      - name: Display structure of downloaded files
        run: ls -R

      - name: Upload release assets
        id: upload_release_assets
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            let fs = require('fs');
            let path = require('path');
            let files = [
                'RuntimeEnforcer-agent-attestation-amd64-provenance.intoto.jsonl',
                'RuntimeEnforcer-agent-attestation-amd64-provenance.intoto.jsonl.bundle.sigstore',
                'RuntimeEnforcer-agent-attestation-amd64-sbom.json',
                'RuntimeEnforcer-agent-attestation-amd64-sbom.json.bundle.sigstore',
                'RuntimeEnforcer-controller-attestation-amd64-provenance.intoto.jsonl',
                'RuntimeEnforcer-controller-attestation-amd64-provenance.intoto.jsonl.bundle.sigstore',
                'RuntimeEnforcer-controller-attestation-amd64-sbom.json',
                'RuntimeEnforcer-controller-attestation-amd64-sbom.json.bundle.sigstore',
                'RuntimeEnforcer-debugger-attestation-amd64-provenance.intoto.jsonl',
                'RuntimeEnforcer-debugger-attestation-amd64-provenance.intoto.jsonl.bundle.sigstore',
                'RuntimeEnforcer-debugger-attestation-amd64-sbom.json',
                'RuntimeEnforcer-debugger-attestation-amd64-sbom.json.bundle.sigstore',

                'RuntimeEnforcer-agent-attestation-arm64-provenance.intoto.jsonl',
                'RuntimeEnforcer-agent-attestation-arm64-provenance.intoto.jsonl.bundle.sigstore',
                'RuntimeEnforcer-agent-attestation-arm64-sbom.json',
                'RuntimeEnforcer-agent-attestation-arm64-sbom.json.bundle.sigstore',
                'RuntimeEnforcer-controller-attestation-arm64-provenance.intoto.jsonl',
                'RuntimeEnforcer-controller-attestation-arm64-provenance.intoto.jsonl.bundle.sigstore',
                'RuntimeEnforcer-controller-attestation-arm64-sbom.json',
                'RuntimeEnforcer-controller-attestation-arm64-sbom.json.bundle.sigstore',
                'RuntimeEnforcer-debugger-attestation-arm64-provenance.intoto.jsonl',
                'RuntimeEnforcer-debugger-attestation-arm64-provenance.intoto.jsonl.bundle.sigstore',
                'RuntimeEnforcer-debugger-attestation-arm64-sbom.json',
                'RuntimeEnforcer-debugger-attestation-arm64-sbom.json.bundle.sigstore',

                'kubectl-runtime_enforcer-linux-amd64',
                'kubectl-runtime_enforcer-linux-amd64.sha256',
                'kubectl-runtime_enforcer-linux-arm64',
                'kubectl-runtime_enforcer-linux-arm64.sha256',
                'kubectl-runtime_enforcer-darwin-amd64',
                'kubectl-runtime_enforcer-darwin-amd64.sha256',
                'kubectl-runtime_enforcer-darwin-arm64',
                'kubectl-runtime_enforcer-darwin-arm64.sha256',
                ]
            const {RELEASE_ID} = process.env
            for (const file of files) {
              let file_data = fs.readFileSync(file);
              let response = await github.rest.repos.uploadReleaseAsset({
                owner: context.repo.owner,
                repo: context.repo.repo,
                release_id: `${RELEASE_ID}`,
                name: path.basename(file),
                data: file_data,
              });
            }
      - name: Publish release
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const {RELEASE_ID} = process.env
            const {TAG_NAME} = process.env
            isPreRelease = ${{ contains(github.ref_name, '-alpha') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-rc') }}
            github.rest.repos.updateRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: `${RELEASE_ID}`,
              draft: false,
              tag_name: `${TAG_NAME}`,
              name: `RuntimeEnforcer ${TAG_NAME}`,
              prerelease: isPreRelease,
              make_latest: !isPreRelease
            });
  update-charts:
    needs: [create-release]
    uses: ./.github/workflows/update-charts.yml
    permissions:
      contents: write # for updatecli to update the repository
      pull-requests: write # for updatecli to create a PR