ci-publish.yaml

# This file is part of Dependency-Track.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0
# Copyright (c) OWASP Foundation. All Rights Reserved.
name: Publish CI

on:
  push:
    tags:
      - '[0-9]*'
  workflow_dispatch:

permissions: {}

jobs:
  read-version:
    name: Read Version
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      version: ${{ steps.parse.outputs.version }}
    steps:
      - name: Assert ref type
        run: |-
          if [[ "$GITHUB_REF_TYPE" != "tag" ]]; then
            echo "::error::Publishing is only supported for tags!"
            exit 1
          fi

      - name: Checkout Repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # tag=v7.0.0
        with:
          persist-credentials: false

      - name: Parse Version from package.json
        id: parse
        run: |-
          VERSION=$(jq -r '.version' package.json)
          echo "version=${VERSION}" >> $GITHUB_OUTPUT

  call-build:
    name: Build
    needs:
      - read-version
    uses: ./.github/workflows/_meta-build.yaml
    with:
      app-version: ${{ needs.read-version.outputs.version }}
      publish-container: true
      ref-name: ${{ github.ref_name }}
    permissions:
      packages: write # Required to push images to ghcr.io
    secrets:
      registry-0-usr: ${{ github.repository_owner }}
      registry-0-psw: ${{ github.repository_owner == 'DependencyTrack' && secrets.BOT_IMAGE_PUSH_TOKEN || secrets.GITHUB_TOKEN }}

  update-github-release:
    name: Update GitHub Release
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: write # Required to edit release.
    needs:
      - read-version
      - call-build
    steps:
      - name: Checkout Repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # tag=v7.0.0
        with:
          persist-credentials: false

      - name: Download Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # tag=v8.0.1
        with:
          name: assembled-frontend

      - name: Create Checksums
        run: |-
          zip -qr frontend-dist.zip dist/*

          echo "# SHA1" >> checksums.txt
          sha1sum frontend-dist.zip >> checksums.txt
          echo "# SHA256" >> checksums.txt
          sha256sum frontend-dist.zip >> checksums.txt
          echo "# SHA512" >> checksums.txt
          sha512sum frontend-dist.zip >> checksums.txt

      - name: Update Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_VERSION: ${{ needs.read-version.outputs.version }}
        run: |-
          gh release upload "${RELEASE_VERSION}" \
            --clobber \
            frontend-dist.zip \
            checksums.txt \
            bom.xml bom.json

      - name: Publish Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_VERSION: ${{ needs.read-version.outputs.version }}
        run: |-
          gh release edit "${RELEASE_VERSION}" \
            --draft=false