release.yml

# Copyright 2024 Defense Unicorns
# SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial

# Terraform Provider release workflow.
name: Release

# This GitHub action creates a release when a tag that matches the pattern
# "v*" (e.g. v0.1.0) is created or when triggered by another workflow.
on:
  push:
    tags:
      - "v*"
      - "!v*-nightly*"
  workflow_call:
    inputs:
      tag_name:
        required: false
        type: string
        description: "The tag name to use for the release"
      skip_github_release:
        required: false
        type: boolean
        default: false
        description: >-
          Build release artifacts without creating a GitHub release
    secrets:
      UDS_REGISTRY_USER:
        required: true
        description: "Username for UDS registry authentication"
      UDS_REGISTRY_TOKEN:
        required: true
        description: "Token for UDS registry authentication"
      GPG_PRIVATE_KEY:
        required: true
        description: "ASCII-armored GPG private key used to sign release checksums"
      GPG_PASSPHRASE:
        required: true
        description: "Passphrase for the GPG private key"

permissions: {}

concurrency:
  group: release-${{ inputs.tag_name || github.ref }}
  cancel-in-progress: false

jobs:
  goreleaser:
    name: Build and publish release
    runs-on: uds-ubuntu-big-boy-4-core
    timeout-minutes: 60 # Match the timeout in the goreleaser command
    permissions:
      contents: write # Required by GoReleaser to create the GitHub release.
      packages: write # Required to publish the provider to GHCR.
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.tag_name || github.ref }}
          # Allow goreleaser to access older tag information
          fetch-depth: 0
          fetch-tags: true
          persist-credentials: false

      - name: Setup tools
        uses: ./.github/actions/setup

      - name: Install syft
        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
        with:
          # renovate: datasource=github-tags depName=anchore/syft versioning=semver
          syft-version: v1.50.0

      - name: Import GPG key
        shell: bash
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
        run: |
          set -euo pipefail

          gpg_home="$RUNNER_TEMP/terraform-provider-uds-gnupg"

          install -d -m 0700 "$gpg_home"
          printf '%s' "$GPG_PRIVATE_KEY" |
            gpg --batch --no-tty --homedir "$gpg_home" --import

          fingerprint="$(
            gpg --batch --no-tty --homedir "$gpg_home" --with-colons --list-secret-keys |
              awk -F: '$1 == "fpr" { print $10; exit }'
          )"
          if [[ -z "$fingerprint" ]]; then
            echo "::error::Unable to determine the GPG signing key fingerprint"
            exit 1
          fi

          {
            printf 'GNUPGHOME=%s\n' "$gpg_home"
            printf 'GPG_FINGERPRINT=%s\n' "$fingerprint"
          } >> "$GITHUB_ENV"

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          args: >-
            release --clean --timeout 60m
            ${{ inputs.skip_github_release && '--skip=publish' || '' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GOTMPDIR: ${{ runner.temp }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      - name: Login to UDS Registry
        run: echo "$UDS_REGISTRY_TOKEN" | go tool oras login -u "$UDS_REGISTRY_USER" --password-stdin registry.defenseunicorns.com
        env:
          UDS_REGISTRY_USER: ${{ secrets.UDS_REGISTRY_USER }}
          UDS_REGISTRY_TOKEN: ${{ secrets.UDS_REGISTRY_TOKEN }}

      - name: Login to GHCR
        env:
          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GHCR_USER: ${{ github.actor }}
        run: echo "$GHCR_TOKEN" | go tool oras login -u "$GHCR_USER" --password-stdin ghcr.io

      # https://github.com/opentofu/opentofu/blob/main/website/docs/cli/oci_registries/provider-mirror.mdx
      - name: Publish to OCI Registries
        shell: bash
        working-directory: dist
        env:
          GHCR_NAMESPACE: ${{ github.repository_owner }}
        run: |
          set -euo pipefail

          layout="tmp-layout"

          cleanup() {
              rm -rf "$layout"
          }

          trap cleanup EXIT

          mkdir "$layout"

          index_mediatype="application/vnd.opentofu.provider"
          manifest_mediatype="application/vnd.opentofu.provider-target"
          layer_mediatype="archive/zip"

          find . -name "*.zip" -printf "%f\n" | while read -r archive; do
              entry=$(jq ".[] | select(.name == \"${archive}\")" artifacts.json)
              os_arch=$(echo "$entry" | jq -r '"\(.goos)_\(.goarch)"')

              go tool oras push \
                --artifact-type "$manifest_mediatype" \
                --oci-layout "$layout:$os_arch" \
                "$archive:$layer_mediatype"
          done

          index="$layout/index.json"
          name=$(jq -r .project_name metadata.json)
          version=$(jq -r .version metadata.json)
          index_to_tag="${name}_$version.json"

          jq --arg mediatype "$index_mediatype" '
            .artifactType = $mediatype |
            .manifests = (.manifests | map(
              if .annotations."org.opencontainers.image.ref.name" then
                . + {
                  platform: {
                    os: (.annotations."org.opencontainers.image.ref.name" | split("_")[0]),
                    architecture: (.annotations."org.opencontainers.image.ref.name" | split("_")[1])
                  }
                }
              else
                .
              end
            ))
          ' "$index" > "$index_to_tag"

          go tool oras manifest push --oci-layout "$layout:$version" "$index_to_tag"

          # Publish to UDS registry
          uds_registry_url="registry.defenseunicorns.com/ops/$name"
          go tool oras cp --from-oci-layout "$layout:$version" "$uds_registry_url:$version"

          # Publish to GHCR
          namespace="$GHCR_NAMESPACE"
          type_name="${name#terraform-provider-}"
          ghcr_url="ghcr.io/$GHCR_NAMESPACE/opentofu-providers/$namespace/$type_name"
          go tool oras cp --from-oci-layout "$layout:$version" "$ghcr_url:$version"

      - name: Upload release assets (if any failed)
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: goreleaser-dist
          path: dist/
          retention-days: 5

      - name: Remove GPG key material
        if: always()
        shell: bash
        run: |
          gpgconf --homedir "$RUNNER_TEMP/terraform-provider-uds-gnupg" --kill all || true
          rm -rf "$RUNNER_TEMP/terraform-provider-uds-gnupg"