release.yml

name: Release Please

on:
  push:
    branches:
      - main
      - '[0-9]+.[0-9]+.x'
  workflow_dispatch:

defaults:
  run:
    shell: bash

env:
  GO_VERSION: "~1.20"
  # renovate: datasource=github-releases depName=kubernetes-sigs/controller-tools
  CONTROLLER_TOOLS_VERSION: "v0.12.1"
  SCHEDULER_COMPATIBLE_K8S_VERSION: "v0.24.3"

jobs:
  release-please:
    runs-on: ubuntu-22.04
    outputs:
      klt-release-created: ${{ steps.release.outputs.release_created }}
      klt-tag-name: ${{ steps.release.outputs.tag_name }}
      cert-manager-release-created: ${{ steps.release.outputs.klt-cert-manager--release_created }}
      cert-manager-tag-name: ${{ steps.release.outputs.klt-cert-manager--tag_name }}
      metrics-operator-release-created: ${{ steps.release.outputs.metrics-operator--release_created }}
      metrics-operator-tag-name: ${{ steps.release.outputs.metrics-operator--tag_name }}
      releases-created: ${{ steps.release.outputs.releases_created }}
      build-matrix: ${{ steps.build-matrix.outputs.result }}
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Run release please
        uses: google-github-actions/release-please-action@v3
        id: release
        with:
          command: manifest
          token: ${{ secrets.KEPTN_BOT_TOKEN }}
          default-branch: main
          signoff: "keptn-bot <86361500+keptn-bot@users.noreply.github.com>"

      - name: Release Info
        run: |
          echo "Release KLT:                  ${{ steps.release.outputs.release_created }}"
          echo "Release KLT Cert Manager:     ${{ steps.release.outputs.klt-cert-manager--release_created }}"
          echo "Release KLT Metrics Operator: ${{ steps.release.outputs.metrics-operator--release_created }}"
          echo "Anything to release:          ${{ steps.release.outputs.releases_created }}"
          echo "Paths to be released:         ${{ steps.release.outputs.paths_released }}"

      - name: Create build matrix
        id: build-matrix
        uses: actions/github-script@v6
        env:
          RELEASE_KLT: ${{ steps.release.outputs.release_created }}
          RELEASE_CERT_MANAGER: ${{ steps.release.outputs.klt-cert-manager--release_created }}
          RELEASE_METRICS_OPERATOR: ${{ steps.release.outputs.metrics-operator--release_created }}
          KLT_TAG: ${{ steps.release.outputs.tag_name }}
          CERT_MANAGER_TAG: ${{ steps.release.outputs.klt-cert-manager--tag_name }}
          METRICS_OPERATOR_TAG: ${{ steps.release.outputs.metrics-operator--tag_name }}
        with:
          script: |
            const { RELEASE_KLT, RELEASE_CERT_MANAGER, RELEASE_METRICS_OPERATOR, KLT_TAG, CERT_MANAGER_TAG, METRICS_OPERATOR_TAG } = process.env

            var result = []
            if (RELEASE_KLT === "true") {
              result.push(...[
                {
                    name: "lifecycle-operator",
                    folder: "lifecycle-operator/",
                    tagName: KLT_TAG
                },
                {
                    name: "scheduler",
                    folder: "scheduler/",
                    tagName: KLT_TAG
                },
                {
                    name: "functions-runtime",
                    folder: "functions-runtime/",
                    tagName: KLT_TAG
                },
                {
                    name: "python-runtime",
                    folder: "python-runtime/",
                    tagName: KLT_TAG
                }
              ])
            }

            if (RELEASE_CERT_MANAGER === "true") {
              result.push({
                  name: "certificate-operator",
                  folder: "klt-cert-manager/",
                  tagName: CERT_MANAGER_TAG
              })
            }

            if (RELEASE_METRICS_OPERATOR === "true") {
              result.push({
                  name: "metrics-operator",
                  folder: "metrics-operator/",
                  tagName: METRICS_OPERATOR_TAG
              })
            }

            return { config: result }

  build-release:
    if: needs.release-please.outputs.releases-created == 'true'
    needs:
      - release-please
    strategy:
      matrix: ${{ fromJson(needs.release-please.outputs.build-matrix) }}
    runs-on: ubuntu-22.04
    permissions:
      contents: write
      packages: write
      id-token: write
    env:
      IMAGE_NAME: ghcr.io/keptn/${{ matrix.config.name }}
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: "ghcr.io"
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Cosign
        uses: sigstore/cosign-installer@v3.1.1

      - name: Clean up image tag
        id: clean-image-tag
        env:
          IMAGE_TAG: ${{ matrix.config.tagName }}
        run: |
          # Remove artifact prefix from tag so that we get clean image tags
          temp="${IMAGE_TAG##klt-}"
          temp="${temp##cert-manager-}"
          echo "IMAGE_TAG=${temp##metrics-operator-}" >> "$GITHUB_OUTPUT"

      - name: Build Docker Image
        id: docker_build_image
        uses: docker/build-push-action@v4
        with:
          context: ${{ matrix.config.folder }}
          platforms: linux/amd64,linux/arm64
          target: production
          tags: |
            ${{ env.IMAGE_NAME }}:${{ steps.clean-image-tag.outputs.IMAGE_TAG }}
          build-args: |
            GIT_HASH=${{ env.GIT_SHA }}
            RELEASE_VERSION=dev-${{ env.DATETIME }}
            BUILD_TIME=${{ env.BUILD_TIME }}
            CONTROLLER_TOOLS_VERSION=${{ env.CONTROLLER_TOOLS_VERSION }}
            SCHEDULER_COMPATIBLE_K8S_VERSION=${{ env.SCHEDULER_COMPATIBLE_K8S_VERSION }}
          builder: ${{ steps.buildx.outputs.name }}
          push: true
          cache-from: type=gha,scope=${{ github.ref_name }}-${{ matrix.config.name }}
          cache-to: type=gha,scope=${{ github.ref_name }}-${{ matrix.config.name }}

      - name: Sign container image
        env:
          IMAGE_DIGEST: ${{ steps.docker_build_image.outputs.digest }}
        run: |
          cosign sign --yes ${{ env.IMAGE_NAME }}@${{ env.IMAGE_DIGEST }}
          cosign verify \
            --certificate-identity-regexp="https://github.com/keptn/lifecycle-toolkit/.*" \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            ${{ env.IMAGE_NAME }}@${{ env.IMAGE_DIGEST }}

      - name: Generate SBOM
        uses: anchore/sbom-action@v0.14.3
        with:
          image: ${{ env.IMAGE_NAME }}:${{ steps.clean-image-tag.outputs.IMAGE_TAG }}
          artifact-name: sbom-${{ matrix.config.name }}
          output-file: ./sbom-${{ matrix.config.name }}.spdx.json

      - name: Attach SBOM to release
        uses: softprops/action-gh-release@v1
        with:
          tag_name: ${{ matrix.config.tagName }}
          files: ./sbom-${{ matrix.config.name }}.spdx.json

  release-manifests:
    if: needs.release-please.outputs.releases-created == 'true'
    needs:
      - release-please
      - build-release
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Cache build tools lifecycle-operator
        if: needs.release-please.outputs.klt-release-created == 'true'
        id: cache-build-tools-lifecycle-operator
        uses: actions/cache@v3
        with:
          path: ./lifecycle-operator/bin
          key: build-tools-${{ github.ref_name }}

      - name: Cache build tools metrics-operator
        if: needs.release-please.outputs.metrics-operator-release-created == 'true'
        id: cache-build-tools-metrics-operator
        uses: actions/cache@v3
        with:
          path: ./metrics-operator/bin
          key: build-tools-${{ github.ref_name }}

      - name: Cache build tools scheduler
        if: needs.release-please.outputs.klt-release-created == 'true'
        id: cache-build-tools-scheduler
        uses: actions/cache@v3
        with:
          path: ./scheduler/bin
          key: build-tools-${{ github.ref_name }}

      - name: Cache build tools cert-manager
        if: needs.release-please.outputs.cert-manager-release-created == 'true'
        id: cache-build-tools-klt-cert-manager
        uses: actions/cache@v3
        with:
          path: ./klt-cert-manager/bin
          key: build-tools-${{ github.ref_name }}

      - name: Set up Go
        uses: actions/setup-go@v4
        with:
          go-version: ${{ env.GO_VERSION }}
          check-latest: true

      - name: Create KLT manifest
        if: needs.release-please.outputs.klt-release-created == 'true'
        env:
          RELEASE_REGISTRY: ghcr.io/keptn
          CHART_APPVERSION: ${{ needs.release-please.outputs.klt-tag-name }}
        run: |
          cd scheduler
          make release-manifests
          cd ../lifecycle-operator
          make controller-gen release-manifests
          cd ../klt-cert-manager
          make controller-gen release-manifests
          cd ../metrics-operator
          make controller-gen release-manifests
          cd ..
          echo "---" >> lifecycle-operator/config/rendered/release.yaml
          echo "---" >> scheduler/config/rendered/release.yaml
          echo "---" >> klt-cert-manager/config/rendered/release.yaml
          cat >> namespace.yaml << EOF
          ---
          apiVersion: v1
          kind: Namespace
          metadata:
            name: keptn-lifecycle-toolkit-system
          ---
          EOF
          cat namespace.yaml \
            lifecycle-operator/config/rendered/release.yaml \
            scheduler/config/rendered/release.yaml \
            klt-cert-manager/config/rendered/release.yaml \
            metrics-operator/config/rendered/release.yaml > klt-manifest.yaml

      - name: Create Cert-Manager manifest
        if: needs.release-please.outputs.cert-manager-release-created == 'true'
        env:
          RELEASE_REGISTRY: ghcr.io/keptn
          CHART_APPVERSION: ${{ needs.release-please.outputs.cert-manager-tag-name }}
        run: |
          cd klt-cert-manager
          make controller-gen release-manifests
          cd ..
          echo "---" >> klt-cert-manager/config/rendered/release.yaml
          cat >> namespace.yaml << EOF
          ---
          apiVersion: v1
          kind: Namespace
          metadata:
            name: keptn-lifecycle-toolkit-system
          ---
          EOF
          cat namespace.yaml \
            klt-cert-manager/config/rendered/release.yaml > cert-manager-manifest.yaml

      - name: Create Metrics Operator manifest
        if: needs.release-please.outputs.metrics-operator-release-created == 'true'
        env:
          RELEASE_REGISTRY: ghcr.io/keptn
          CHART_APPVERSION: ${{ needs.release-please.outputs.metrics-operator-tag-name }}
        run: |
          cd metrics-operator
          make controller-gen release-manifests
          cd ..
          echo "---" >> metrics-operator/config/rendered/release.yaml
          cat >> namespace.yaml << EOF
          ---
          apiVersion: v1
          kind: Namespace
          metadata:
            name: keptn-lifecycle-toolkit-system
          ---
          EOF
          cat namespace.yaml \
            metrics-operator/config/rendered/release.yaml > metrics-operator-manifest.yaml

      - name: Attach KLT release assets
        if: needs.release-please.outputs.klt-release-created == 'true'
        uses: softprops/action-gh-release@v1
        with:
          tag_name: ${{ needs.release-please.outputs.klt-tag-name }}
          files: klt-manifest.yaml

      - name: Attach Cert-Manager release assets
        if: needs.release-please.outputs.cert-manager-release-created == 'true'
        uses: softprops/action-gh-release@v1
        with:
          tag_name: ${{ needs.release-please.outputs.cert-manager-tag-name }}
          files: cert-manager-manifest.yaml

      - name: Attach Metrics Operator release assets
        if: needs.release-please.outputs.metrics-operator-release-created == 'true'
        uses: softprops/action-gh-release@v1
        with:
          tag_name: ${{ needs.release-please.outputs.metrics-operator-tag-name }}
          files: metrics-operator-manifest.yaml

  update-docs:
    name: Update Documentation
    needs:
      - release-please
    if: needs.release-please.outputs.klt-release-created == 'true'
    with:
      tag_name: ${{ needs.release-please.outputs.klt-tag-name }}
    uses: keptn/docs-tooling/.github/workflows/release-docs.yml@v0.1.4
    secrets: inherit

  update-examples:
    name: Update examples
    needs:
      - release-please
    if: needs.release-please.outputs.klt-release-created == 'true'
    with:
      tag_name: ${{ needs.release-please.outputs.klt-tag-name }}
    uses: ./.github/workflows/release-examples.yml
    secrets: inherit