ci-publish-cloud-production-artifacts.yaml

concurrency:
    cancel-in-progress: true
    group: publish-cloud-production-artifacts-${{github.ref_name}}
defaults:
    run:
        shell: bash
jobs:
    approve-release:
        environment: production-release
        if: ${{!cancelled() && !failure() && needs.set-up-variables.result == 'success'}}
        needs:
            -   push-rc-aws
            -   push-rc-aws-infrastructure
            -   push-rc-aws-infrastructure-provider
            -   push-rc-bootstrap-aws
            -   push-rc-bootstrap-gcp
            -   push-rc-default
            -   push-rc-gcp
            -   push-rc-gcp-infrastructure
            -   push-rc-gcp-infrastructure-provider
            -   push-rc-observability
            -   set-up-variables
            -   update-staging-charts
        runs-on: ubuntu-latest
        steps:
            -   name: Wait for manual approval
                run: |
                    echo "Approval to release was received. All release candidates will be promoted."
    check-aws:
        needs:
            -   test-cloud-helm-chart
            -   test-cloud-helm-chart-smoke
            -   test-cloud-terraform
        uses: ./.github/workflows/ci-reusable-check-helm-chart-version.yaml
        with:
            chart_name: liferay-aws
            working_directory: ./cloud/helm/aws
    check-aws-infrastructure:
        needs:
            -   test-cloud-helm-chart
            -   test-cloud-helm-chart-smoke
            -   test-cloud-terraform
        uses: ./.github/workflows/ci-reusable-check-helm-chart-version.yaml
        with:
            chart_name: liferay-aws-infrastructure
            working_directory: ./cloud/helm/aws-infrastructure
    check-aws-infrastructure-provider:
        needs:
            -   test-cloud-helm-chart
            -   test-cloud-helm-chart-smoke
            -   test-cloud-terraform
        uses: ./.github/workflows/ci-reusable-check-helm-chart-version.yaml
        with:
            chart_name: liferay-aws-infrastructure-provider
            working_directory: ./cloud/helm/aws-infrastructure-provider
    check-bootstrap-aws:
        needs:
            -   test-cloud-helm-chart
            -   test-cloud-helm-chart-smoke
            -   test-cloud-terraform
        uses: ./.github/workflows/ci-reusable-check-bootstrap-version.yaml
        with:
            provider: aws
    check-bootstrap-gcp:
        needs:
            -   test-cloud-helm-chart
            -   test-cloud-helm-chart-smoke
            -   test-cloud-terraform
        uses: ./.github/workflows/ci-reusable-check-bootstrap-version.yaml
        with:
            provider: gcp
    check-default:
        needs:
            -   test-cloud-helm-chart
            -   test-cloud-helm-chart-smoke
            -   test-cloud-terraform
        uses: ./.github/workflows/ci-reusable-check-helm-chart-version.yaml
        with:
            chart_name: liferay-default
            working_directory: ./cloud/helm/default
    check-gcp:
        needs:
            -   test-cloud-helm-chart
            -   test-cloud-helm-chart-smoke
            -   test-cloud-terraform
        uses: ./.github/workflows/ci-reusable-check-helm-chart-version.yaml
        with:
            chart_name: liferay-gcp
            working_directory: ./cloud/helm/gcp
    check-gcp-infrastructure:
        needs:
            -   test-cloud-helm-chart
            -   test-cloud-helm-chart-smoke
            -   test-cloud-terraform
        uses: ./.github/workflows/ci-reusable-check-helm-chart-version.yaml
        with:
            chart_name: liferay-gcp-infrastructure
            working_directory: ./cloud/helm/gcp-infrastructure
    check-gcp-infrastructure-provider:
        needs:
            -   test-cloud-helm-chart
            -   test-cloud-helm-chart-smoke
            -   test-cloud-terraform
        uses: ./.github/workflows/ci-reusable-check-helm-chart-version.yaml
        with:
            chart_name: liferay-gcp-infrastructure-provider
            working_directory: ./cloud/helm/gcp-infrastructure-provider
    check-observability:
        needs:
            -   test-cloud-helm-chart
            -   test-cloud-helm-chart-smoke
            -   test-cloud-terraform
        uses: ./.github/workflows/ci-reusable-check-helm-chart-version.yaml
        with:
            chart_name: observability
            working_directory: ./cloud/helm/observability
    promote-rc-aws:
        if: ${{!cancelled() && needs.approve-release.result == 'success' && needs.push-rc-aws.result == 'success'}}
        needs:
            -   approve-release
            -   push-rc-aws
        uses: ./.github/workflows/ci-reusable-promote-helm-chart.yaml
        with:
            chart_name: liferay-aws
            chart_version: ${{needs.push-rc-aws.outputs.chart_version}}
            source_image_ref: ${{needs.push-rc-aws.outputs.image_ref}}
    promote-rc-aws-infrastructure:
        if: ${{!cancelled() && needs.approve-release.result == 'success' && needs.push-rc-aws-infrastructure.result == 'success'}}
        needs:
            -   approve-release
            -   push-rc-aws-infrastructure
        uses: ./.github/workflows/ci-reusable-promote-helm-chart.yaml
        with:
            chart_name: liferay-aws-infrastructure
            chart_version: ${{needs.push-rc-aws-infrastructure.outputs.chart_version}}
            source_image_ref: ${{needs.push-rc-aws-infrastructure.outputs.image_ref}}
    promote-rc-aws-infrastructure-provider:
        if: ${{!cancelled() && needs.approve-release.result == 'success' && needs.push-rc-aws-infrastructure-provider.result == 'success'}}
        needs:
            -   approve-release
            -   push-rc-aws-infrastructure-provider
        uses: ./.github/workflows/ci-reusable-promote-helm-chart.yaml
        with:
            chart_name: liferay-aws-infrastructure-provider
            chart_version: ${{needs.push-rc-aws-infrastructure-provider.outputs.chart_version}}
            source_image_ref: ${{needs.push-rc-aws-infrastructure-provider.outputs.image_ref}}
    promote-rc-bootstrap-aws:
        if: ${{!cancelled() && needs.approve-release.result == 'success' && needs.push-rc-bootstrap-aws.result == 'success'}}
        needs:
            -   approve-release
            -   push-rc-bootstrap-aws
        uses: ./.github/workflows/ci-reusable-promote-bootstrap-tarball.yaml
        with:
            provider: aws
            source_object_name: ${{needs.push-rc-bootstrap-aws.outputs.object_name}}
    promote-rc-bootstrap-gcp:
        if: ${{!cancelled() && needs.approve-release.result == 'success' && needs.push-rc-bootstrap-gcp.result == 'success'}}
        needs:
            -   approve-release
            -   push-rc-bootstrap-gcp
        uses: ./.github/workflows/ci-reusable-promote-bootstrap-tarball.yaml
        with:
            provider: gcp
            source_object_name: ${{needs.push-rc-bootstrap-gcp.outputs.object_name}}
    promote-rc-default:
        if: ${{!cancelled() && needs.approve-release.result == 'success' && needs.push-rc-default.result == 'success'}}
        needs:
            -   approve-release
            -   push-rc-default
        uses: ./.github/workflows/ci-reusable-promote-helm-chart.yaml
        with:
            chart_name: liferay-default
            chart_version: ${{needs.push-rc-default.outputs.chart_version}}
            source_image_ref: ${{needs.push-rc-default.outputs.image_ref}}
    promote-rc-gcp:
        if: ${{!cancelled() && needs.approve-release.result == 'success' && needs.push-rc-gcp.result == 'success'}}
        needs:
            -   approve-release
            -   push-rc-gcp
        uses: ./.github/workflows/ci-reusable-promote-helm-chart.yaml
        with:
            chart_name: liferay-gcp
            chart_version: ${{needs.push-rc-gcp.outputs.chart_version}}
            source_image_ref: ${{needs.push-rc-gcp.outputs.image_ref}}
    promote-rc-gcp-infrastructure:
        if: ${{!cancelled() && needs.approve-release.result == 'success' && needs.push-rc-gcp-infrastructure.result == 'success'}}
        needs:
            -   approve-release
            -   push-rc-gcp-infrastructure
        uses: ./.github/workflows/ci-reusable-promote-helm-chart.yaml
        with:
            chart_name: liferay-gcp-infrastructure
            chart_version: ${{needs.push-rc-gcp-infrastructure.outputs.chart_version}}
            source_image_ref: ${{needs.push-rc-gcp-infrastructure.outputs.image_ref}}
    promote-rc-gcp-infrastructure-provider:
        if: ${{!cancelled() && needs.approve-release.result == 'success' && needs.push-rc-gcp-infrastructure-provider.result == 'success'}}
        needs:
            -   approve-release
            -   push-rc-gcp-infrastructure-provider
        uses: ./.github/workflows/ci-reusable-promote-helm-chart.yaml
        with:
            chart_name: liferay-gcp-infrastructure-provider
            chart_version: ${{needs.push-rc-gcp-infrastructure-provider.outputs.chart_version}}
            source_image_ref: ${{needs.push-rc-gcp-infrastructure-provider.outputs.image_ref}}
    promote-rc-observability:
        if: ${{!cancelled() && needs.approve-release.result == 'success' && needs.push-rc-observability.result == 'success'}}
        needs:
            -   approve-release
            -   push-rc-observability
        uses: ./.github/workflows/ci-reusable-promote-helm-chart.yaml
        with:
            chart_name: observability
            chart_version: ${{needs.push-rc-observability.outputs.chart_version}}
            source_image_ref: ${{needs.push-rc-observability.outputs.image_ref}}
    publish-aws-marketplace:
        env:
            ECR_REGISTRY: 709825985650.dkr.ecr.us-east-1.amazonaws.com
        if: ${{!cancelled() && needs.approve-release.result == 'success' && vars.ENABLE_AWS_MARKETPLACE_PUBLISHING == 'true'}}
        needs: approve-release
        runs-on: ubuntu-latest
        steps:
            -   name: Checkout code
                uses: actions/checkout@v4
                with:
                    fetch-depth: 1
                    filter: tree:0
                    show-progress: false
                    sparse-checkout: cloud/helm
            -   name: Configure AWS credentials
                uses: aws-actions/configure-aws-credentials@v5.1.0
                with:
                    aws-region: us-east-1
                    role-session-name: GitHubActions
                    role-to-assume: arn:aws:iam::831926597587:role/GitHubActionsRole
            -   name: Login to ECR
                run: |
                    set -o errexit
                    set -o nounset
                    set -o pipefail

                    aws \
                        ecr \
                        get-login-password \
                        --region \
                        us-east-1 \
                        | helm registry login "${ECR_REGISTRY}" --password-stdin --username AWS
            -   id: verify_version
                name: Verify Helm chart version
                run: |
                    set -o errexit
                    set -o nounset
                    set -o pipefail

                    function main {
                        local chart_version

                        chart_version=$(cat ./Chart.yaml | yq .version)

                        local chart_oci_url="oci://${ECR_REGISTRY}/liferay/liferay-aws-marketplace:${chart_version}"

                        if ! helm show readme "${chart_oci_url}" >/dev/null 2>&1
                        then
                            echo "CHART_VERSION=${chart_version}" >> ${GITHUB_ENV}

                            echo "should_publish=true" >> ${GITHUB_OUTPUT}
                        else
                            echo "\`${chart_oci_url}\` is already published." >> ${GITHUB_STEP_SUMMARY}

                            echo "should_release=false" >> ${GITHUB_OUTPUT}
                        fi
                    }

                    main "${@}"
                working-directory: ./cloud/helm/aws-marketplace
            -   if: ${{steps.verify_version.outputs.should_publish == 'true'}}
                name: Package and push Helm chart
                run: |
                    set -o errexit
                    set -o nounset
                    set -o pipefail

                    function main {
                        local dist_dir="${{runner.temp}}/aws-marketplace/dist"

                        rm --force --recursive "${dist_dir}"

                        mkdir --parents "${dist_dir}"

                        helm dependency update

                        helm \
                            package \
                            . \
                            --destination \
                            "${dist_dir}" \
                            --version \
                            "${CHART_VERSION}"

                        for file_name in "${dist_dir}"/*.tgz
                        do
                            helm push "${file_name}" "oci://${ECR_REGISTRY}/liferay"
                        done
                    }

                    main "${@}"
                working-directory: ./cloud/helm/aws-marketplace
    push-rc-aws:
        if: ${{needs.check-aws.outputs.should_release == 'true'}}
        needs:
            -   check-aws
            -   set-up-variables
        uses: ./.github/workflows/ci-reusable-push-helm-chart.yaml
        with:
            chart_name: liferay-aws
            image_tag_suffix: ${{needs.set-up-variables.outputs.image_tag_suffix}}
            working_directory: ./cloud/helm/aws
    push-rc-aws-infrastructure:
        if: ${{needs.check-aws-infrastructure.outputs.should_release == 'true'}}
        needs:
            -   check-aws-infrastructure
            -   set-up-variables
        uses: ./.github/workflows/ci-reusable-push-helm-chart.yaml
        with:
            chart_name: liferay-aws-infrastructure
            image_tag_suffix: ${{needs.set-up-variables.outputs.image_tag_suffix}}
            working_directory: ./cloud/helm/aws-infrastructure
    push-rc-aws-infrastructure-provider:
        if: ${{needs.check-aws-infrastructure-provider.outputs.should_release == 'true'}}
        needs:
            -   check-aws-infrastructure-provider
            -   set-up-variables
        uses: ./.github/workflows/ci-reusable-push-helm-chart.yaml
        with:
            chart_name: liferay-aws-infrastructure-provider
            image_tag_suffix: ${{needs.set-up-variables.outputs.image_tag_suffix}}
            working_directory: ./cloud/helm/aws-infrastructure-provider
    push-rc-bootstrap-aws:
        if: ${{needs.check-bootstrap-aws.outputs.should_release == 'true'}}
        needs: check-bootstrap-aws
        uses: ./.github/workflows/ci-reusable-push-bootstrap-tarball.yaml
        with:
            provider: aws
    push-rc-bootstrap-gcp:
        if: ${{needs.check-bootstrap-gcp.outputs.should_release == 'true'}}
        needs: check-bootstrap-gcp
        uses: ./.github/workflows/ci-reusable-push-bootstrap-tarball.yaml
        with:
            provider: gcp
    push-rc-default:
        if: ${{needs.check-default.outputs.should_release == 'true'}}
        needs:
            -   check-default
            -   set-up-variables
        uses: ./.github/workflows/ci-reusable-push-helm-chart.yaml
        with:
            chart_name: liferay-default
            image_tag_suffix: ${{needs.set-up-variables.outputs.image_tag_suffix}}
            working_directory: ./cloud/helm/default
    push-rc-gcp:
        if: ${{needs.check-gcp.outputs.should_release == 'true'}}
        needs:
            -   check-gcp
            -   set-up-variables
        uses: ./.github/workflows/ci-reusable-push-helm-chart.yaml
        with:
            chart_name: liferay-gcp
            image_tag_suffix: ${{needs.set-up-variables.outputs.image_tag_suffix}}
            working_directory: ./cloud/helm/gcp
    push-rc-gcp-infrastructure:
        if: ${{needs.check-gcp-infrastructure.outputs.should_release == 'true'}}
        needs:
            -   check-gcp-infrastructure
            -   set-up-variables
        uses: ./.github/workflows/ci-reusable-push-helm-chart.yaml
        with:
            chart_name: liferay-gcp-infrastructure
            image_tag_suffix: ${{needs.set-up-variables.outputs.image_tag_suffix}}
            working_directory: ./cloud/helm/gcp-infrastructure
    push-rc-gcp-infrastructure-provider:
        if: ${{needs.check-gcp-infrastructure-provider.outputs.should_release == 'true'}}
        needs:
            -   check-gcp-infrastructure-provider
            -   set-up-variables
        uses: ./.github/workflows/ci-reusable-push-helm-chart.yaml
        with:
            chart_name: liferay-gcp-infrastructure-provider
            image_tag_suffix: ${{needs.set-up-variables.outputs.image_tag_suffix}}
            working_directory: ./cloud/helm/gcp-infrastructure-provider
    push-rc-observability:
        if: ${{needs.check-observability.outputs.should_release == 'true'}}
        needs:
            -   check-observability
            -   set-up-variables
        uses: ./.github/workflows/ci-reusable-push-helm-chart.yaml
        with:
            chart_name: observability
            image_tag_suffix: ${{needs.set-up-variables.outputs.image_tag_suffix}}
            working_directory: ./cloud/helm/observability
    record-release:
        if: ${{!cancelled() && !failure() && needs.approve-release.result == 'success'}}
        needs:
            -   approve-release
            -   promote-rc-aws
            -   promote-rc-aws-infrastructure
            -   promote-rc-aws-infrastructure-provider
            -   promote-rc-bootstrap-aws
            -   promote-rc-bootstrap-gcp
            -   promote-rc-default
            -   promote-rc-gcp
            -   promote-rc-gcp-infrastructure
            -   promote-rc-gcp-infrastructure-provider
            -   promote-rc-observability
            -   publish-aws-marketplace
            -   push-rc-aws
            -   push-rc-aws-infrastructure
            -   push-rc-aws-infrastructure-provider
            -   push-rc-bootstrap-aws
            -   push-rc-bootstrap-gcp
            -   push-rc-default
            -   push-rc-gcp
            -   push-rc-gcp-infrastructure
            -   push-rc-gcp-infrastructure-provider
            -   push-rc-observability
        permissions:
            contents: write
        runs-on: ubuntu-latest
        steps:
            -   name: Checkout code
                uses: actions/checkout@v4
                with:
                    fetch-depth: 1
                    filter: tree:0
                    show-progress: false
                    sparse-checkout: .github
            -   env:
                    BOOTSTRAP_SHA256_aws: ${{needs.promote-rc-bootstrap-aws.outputs.sha256}}
                    BOOTSTRAP_SHA256_gcp: ${{needs.promote-rc-bootstrap-gcp.outputs.sha256}}
                    BOOTSTRAP_VERSION_aws: ${{needs.push-rc-bootstrap-aws.outputs.version}}
                    BOOTSTRAP_VERSION_gcp: ${{needs.push-rc-bootstrap-gcp.outputs.version}}
                    DIGEST_liferay_aws: ${{needs.promote-rc-aws.outputs.image_digest}}
                    DIGEST_liferay_aws_infrastructure: ${{needs.promote-rc-aws-infrastructure.outputs.image_digest}}
                    DIGEST_liferay_aws_infrastructure_provider: ${{needs.promote-rc-aws-infrastructure-provider.outputs.image_digest}}
                    DIGEST_liferay_default: ${{needs.promote-rc-default.outputs.image_digest}}
                    DIGEST_liferay_gcp: ${{needs.promote-rc-gcp.outputs.image_digest}}
                    DIGEST_liferay_gcp_infrastructure: ${{needs.promote-rc-gcp-infrastructure.outputs.image_digest}}
                    DIGEST_liferay_gcp_infrastructure_provider: ${{needs.promote-rc-gcp-infrastructure-provider.outputs.image_digest}}
                    DIGEST_observability: ${{needs.promote-rc-observability.outputs.image_digest}}
                    VERSION_liferay_aws: ${{needs.push-rc-aws.outputs.chart_version}}
                    VERSION_liferay_aws_infrastructure: ${{needs.push-rc-aws-infrastructure.outputs.chart_version}}
                    VERSION_liferay_aws_infrastructure_provider: ${{needs.push-rc-aws-infrastructure-provider.outputs.chart_version}}
                    VERSION_liferay_default: ${{needs.push-rc-default.outputs.chart_version}}
                    VERSION_liferay_gcp: ${{needs.push-rc-gcp.outputs.chart_version}}
                    VERSION_liferay_gcp_infrastructure: ${{needs.push-rc-gcp-infrastructure.outputs.chart_version}}
                    VERSION_liferay_gcp_infrastructure_provider: ${{needs.push-rc-gcp-infrastructure-provider.outputs.chart_version}}
                    VERSION_observability: ${{needs.push-rc-observability.outputs.chart_version}}
                name: Record the release
                run: |
                    set -o errexit
                    set -o nounset
                    set -o pipefail

                    function main {
                        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

                        git config user.name "github-actions[bot]"

                        git \
                            fetch \
                            --filter=tree:0 \
                            --no-tags \
                            --shallow-since="3 months ago" \
                            https://github.com/brianchandotcom/liferay-portal \
                            "+refs/heads/master:refs/remotes/brianchandotcom/master"

                        git \
                            fetch \
                            --filter=tree:0 \
                            --no-tags \
                            --shallow-since="3 months ago" \
                            origin \
                            "+refs/heads/${GITHUB_REF_NAME}:refs/remotes/origin/${GITHUB_REF_NAME}"

                        git \
                            fetch \
                            --no-tags \
                            origin \
                            "+refs/heads/releases:refs/remotes/origin/releases" || true

                        local base_commit

                        base_commit=$(git merge-base brianchandotcom/master "${GITHUB_SHA}")

                        local previous_base_commit=""

                        if git rev-parse --quiet --verify origin/releases > /dev/null
                        then
                            local previous_release_id

                            previous_release_id=$( \
                                git ls-tree --full-tree --name-only -r origin/releases -- releases \
                                | { grep --extended-regexp '/manifest\.json$' || true; } \
                                | sed -e 's#releases/##' -e 's#/manifest.json##' \
                                | sort \
                                | tail --lines 1)

                            if [[ -n "${previous_release_id}" ]]
                            then
                                previous_base_commit=$( \
                                    git \
                                        show \
                                        "origin/releases:releases/${previous_release_id}/manifest.json" \
                                    | jq --raw-output '.base_commit // empty')
                            fi
                        fi

                        if [[ -n "${previous_base_commit}" ]] && \
                            ! git merge-base --is-ancestor "${previous_base_commit}" "${base_commit}" 2> /dev/null
                        then
                            git \
                                fetch \
                                --filter=tree:0 \
                                --no-tags \
                                --unshallow \
                                https://github.com/brianchandotcom/liferay-portal \
                                "+refs/heads/master:refs/remotes/brianchandotcom/master" || true
                        fi

                        local included_lcd_tickets="[]"

                        if [[ -n "${previous_base_commit}" ]]
                        then
                            included_lcd_tickets=$( \
                                git log --format='%s' "${previous_base_commit}..${base_commit}" \
                                | { grep --extended-regexp --only-matching 'LCD-[0-9]+' || true; } \
                                | sort --unique \
                                | jq --raw-input --slurp 'split("\n") | map(select(length > 0))')
                        fi

                        local chart
                        local charts="{}"

                        for chart in \
                            liferay-aws \
                            liferay-aws-infrastructure \
                            liferay-aws-infrastructure-provider \
                            liferay-default \
                            liferay-gcp \
                            liferay-gcp-infrastructure \
                            liferay-gcp-infrastructure-provider \
                            observability
                        do
                            local digest_key="DIGEST_${chart//-/_}"
                            local version_key="VERSION_${chart//-/_}"

                            local digest="${!digest_key:-}"

                            [[ -n "${digest}" ]] || continue

                            charts=$( \
                                echo \
                                    "${charts}" \
                                    | jq \
                                        --arg c "${chart}" \
                                        --arg d "${digest}" \
                                        --arg v "${!version_key:-}" \
                                        '.[$c] = {digest: $d, version: $v}')
                        done

                        local bootstraps="{}"
                        local provider

                        for provider in aws gcp
                        do
                            local sha256_key="BOOTSTRAP_SHA256_${provider}"
                            local version_key="BOOTSTRAP_VERSION_${provider}"

                            local sha256="${!sha256_key:-}"

                            [[ -n "${sha256}" ]] || continue

                            bootstraps=$( \
                                echo \
                                    "${bootstraps}" \
                                    | jq \
                                        --arg p "${provider}" \
                                        --arg s "${sha256}" \
                                        --arg v "${!version_key:-}" \
                                        '.[$p] = {sha256: $s, version: $v}')
                        done

                        local release_id

                        release_id="release-$(date --utc +%Y-%m-%dT%H-%M-%SZ)"

                        local release_ticket

                        release_ticket=$( \
                            echo \
                                "${GITHUB_REF_NAME}" \
                                | grep --extended-regexp --only-matching 'LCD-[0-9]+')

                        jq \
                            --arg base_commit "${base_commit}" \
                            --arg release_id "${release_id}" \
                            --arg release_ticket "${release_ticket}" \
                            --arg source_branch "${GITHUB_REF_NAME}" \
                            --argjson bootstraps "${bootstraps}" \
                            --argjson charts "${charts}" \
                            --argjson included_lcd_tickets "${included_lcd_tickets}" \
                            --null-input \
                            '{
                                base_commit: $base_commit,
                                bootstraps: $bootstraps,
                                charts: $charts,
                                included_lcd_tickets: $included_lcd_tickets,
                                release_id: $release_id,
                                release_ticket: $release_ticket,
                                source_branch: $source_branch
                            }' > /tmp/manifest.json

                        local parent=""

                        export GIT_INDEX_FILE=/tmp/release-index

                        rm --force "${GIT_INDEX_FILE}"

                        if git rev-parse --quiet --verify origin/releases > /dev/null
                        then
                            git read-tree origin/releases

                            parent=$(git rev-parse origin/releases)
                        else
                            git read-tree --empty
                        fi

                        local manifest_blob

                        manifest_blob=$(git hash-object -w /tmp/manifest.json)

                        git \
                            update-index \
                            --add \
                            --cacheinfo "100644,${manifest_blob},releases/${release_id}/manifest.json"

                        local tree

                        tree=$(git write-tree)

                        local commit

                        if [[ -n "${parent}" ]]
                        then
                            commit=$(git commit-tree "${tree}" -m "Record ${release_id} (${release_ticket})" -p "${parent}")
                        else
                            commit=$(git commit-tree "${tree}" -m "Record ${release_id} (${release_ticket})")
                        fi

                        unset GIT_INDEX_FILE

                        git push origin "${commit}:refs/heads/releases"
                    }

                    main "${@}"
    set-up-variables:
        if: ${{github.repository == 'cloudnative-team/liferay-portal'}}
        outputs:
            image_tag_suffix: ${{steps.vars.outputs.image_tag_suffix}}
        runs-on: ubuntu-latest
        steps:
            -   id: vars
                name: Set up variables
                run: |
                    set -o errexit
                    set -o nounset
                    set -o pipefail

                    function main {
                        echo "image_tag_suffix=-g${GITHUB_SHA::7}" >> ${GITHUB_OUTPUT}
                    }

                    main "${@}"
    test-cloud-helm-chart:
        needs: set-up-variables
        permissions:
            checks: write
            contents: read
        uses: ./.github/workflows/ci-reusable-test-cloud-helm-chart.yaml
    test-cloud-helm-chart-smoke:
        needs: set-up-variables
        permissions:
            contents: read
        uses: ./.github/workflows/ci-reusable-test-cloud-helm-chart-smoke.yaml
    test-cloud-terraform:
        needs: set-up-variables
        permissions:
            checks: write
            contents: read
        uses: ./.github/workflows/ci-reusable-test-cloud-terraform.yaml
    update-staging-charts:
        if: |-
            ${{
                !cancelled() &&
                !failure() &&
                needs.set-up-variables.result == 'success' &&
                (
                    needs.push-rc-gcp-infrastructure-provider.result == 'success' ||
                    needs.push-rc-gcp-infrastructure.result == 'success' ||
                    needs.push-rc-gcp.result == 'success'
                )
            }}
        needs:
            -   push-rc-aws
            -   push-rc-aws-infrastructure
            -   push-rc-aws-infrastructure-provider
            -   push-rc-bootstrap-aws
            -   push-rc-bootstrap-gcp
            -   push-rc-default
            -   push-rc-gcp
            -   push-rc-gcp-infrastructure
            -   push-rc-gcp-infrastructure-provider
            -   set-up-variables
            -   test-cloud-helm-chart
            -   test-cloud-helm-chart-smoke
            -   test-cloud-terraform
        secrets: inherit
        uses: ./.github/workflows/ci-reusable-update-paas-staging-environment-charts.yaml
        with:
            liferay_gcp_image_ref: ${{needs.push-rc-gcp.outputs.image_ref}}
            liferay_gcp_infrastructure_image_ref: ${{needs.push-rc-gcp-infrastructure.outputs.image_ref}}
            liferay_gcp_infrastructure_provider_image_ref: ${{needs.push-rc-gcp-infrastructure-provider.outputs.image_ref}}
on:
    push:
        branches:
            -   release/**
permissions:
    contents: read
    id-token: write