.github: Add release verification job

Signed-off-by: timflannagan <[email protected]>

.github/workflows/release.yaml

@@ -1,6 +1,15 @@
 name: Release
 on:
   workflow_dispatch:
+    inputs:
+      validate:
+        type: boolean
+        default: false
+        description: "Validate the release artifacts"
+      version:
+        type: string
+        required: false
+        description: "Override the default version"
   push:
     tags:
       - 'v*'
@@ -33,13 +42,17 @@ jobs:
       - name: Set the release related variables
         id: set_vars
         run: |
-          GIT_TAG=$(git describe --tags --abbrev=0 --always)
+          set -x
           GIT_SHA=$(git rev-parse --short HEAD)
           GIT_BRANCH=$(git rev-parse --abbrev-ref HEAD | sed -e "s/\//-/g")
 
           # Set version based on event type
           if [[ ${{ github.event_name }} == 'workflow_dispatch' ]]; then
-            VERSION="${GIT_TAG}-${GIT_SHA}"
+            if [[ -n "${{ inputs.version }}" ]]; then
+              VERSION="${{ inputs.version }}"
+            else
+              VERSION="v0.0.0-manual-${GIT_SHA}"
+            fi
             echo "goreleaser_args=--clean --skip=validate" >> $GITHUB_OUTPUT
           elif [[ $GITHUB_REF == refs/tags/* ]]; then
             VERSION="${GITHUB_REF#refs/tags/}"
@@ -48,12 +61,13 @@ jobs:
             VERSION="v0.0.0-main"
             echo "goreleaser_args=--clean --skip=validate" >> $GITHUB_OUTPUT
           elif [[ $GITHUB_REF == refs/pull/* ]]; then
+            GIT_TAG=$(git describe --tags --abbrev=0)
             PR_NUM=$(echo "${GITHUB_REF}" | sed -E 's|refs/pull/([^/]+)/?.*|\1|')
             VERSION="${GIT_TAG}-pr.${PR_NUM}-${GIT_SHA}"
             echo "goreleaser_args=--snapshot --clean" >> $GITHUB_OUTPUT
           else
-            VERSION="${GIT_TAG}-${GIT_BRANCH}-${GIT_SHA}"
-            echo "goreleaser_args=--snapshot --clean" >> $GITHUB_OUTPUT
+            echo "Unknown event type"
+            exit 1
           fi
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
 
@@ -115,3 +129,49 @@ jobs:
           IMAGE_REGISTRY: ${{ env.IMAGE_REGISTRY }}
           GORELEASER_ARGS: ${{ needs.setup.outputs.goreleaser_args }}
           GORELEASER_CURRENT_TAG: ${{ needs.setup.outputs.version }}
+
+  validate:
+    name: Validate release artifacts
+    needs: [setup, helm, goreleaser]
+    if: ${{ startsWith(github.ref, 'refs/tags/') || inputs.validate == 'true' }}
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: "go.mod"
+
+      - name: Login to ghcr.io
+        if: ${{ github.event_name != 'pull_request' }}
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ${{ env.IMAGE_REGISTRY }} -u ${{ github.repository_owner }} --password-stdin
+
+      - name: Download module dependencies
+        run: make mod-download
+
+      - name: Setup kind cluster
+        run: ./ci/kind/setup-kind.sh
+        env:
+          VERSION: ${{ needs.setup.outputs.version }}
+          SKIP_DOCKER: "true"
+          CONFORMANCE: "true"
+
+      - name: Install the released chart
+        run: |
+          helm install --create-namespace --namespace kgateway-system kgateway \
+            oci://${{ env.IMAGE_REGISTRY }}/charts/kgateway \
+            --version ${{ needs.setup.outputs.version }} \
+            --set controller.image.registry=${{ env.IMAGE_REGISTRY }} \
+            --set gateway.envoyContainer.image.registry=${{ env.IMAGE_REGISTRY }} \
+            --set gateway.sdsContainer.image.registry=${{ env.IMAGE_REGISTRY }} \
+            --wait --timeout 5m
+
+      - name: Wait for the kgateway deployment to be ready
+        run: |
+          kubectl wait --for=condition=available --timeout=5m deployment/kgateway -n kgateway-system
+
+      - name: Run Conformance Tests
+        run: make conformance
+        shell: bash
+        env:
+          VERSION: ${{ needs.setup.outputs.version }}