release.yml

name: Vagrant HashiCorp Release
on:
  repository_dispatch:
    types:
      - hashicorp-release

jobs:
  vagrant-artifacts:
    if: github.repository == 'hashicorp/vagrant-builders'
    name: Build Core Vagrant Artifacts
    permissions:
      contents: write
    uses: ./.github/workflows/vagrant-artifacts.yml
    with:
      vagrant-commit-id: ${{ github.event.client_payload.commit_id }}
  info:
    if: github.repository == 'hashicorp/vagrant-builders'
    name: Validate Release Tag
    runs-on: ubuntu-latest
    outputs:
      vagrant-tag: ${{ steps.validate.outputs.vagrant-tag }}
      release-exists: ${{ steps.validate.outputs.release-exists }}
    steps:
      - name: Code Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Validate
        id: validate
        run: |
          . ./.ci/load-ci.sh
          if ! valid_release_version "${VAGRANT_TAG}"; then
            failure "Invalid Vagrant release tag value (%s)" "${VAGRANT_TAG}"
          fi
          printf "vagrant-tag=%s\n" "${VAGRANT_TAG}" >> "${GITHUB_OUTPUT}"
          if hashicorp_releases_exists "vagrant" "${VAGRANT_TAG#v}"; then
            printf "release-exists=true\n" >> "${GITHUB_OUTPUT}"
          fi
        env:
          VAGRANT_TAG: ${{ github.event.client_payload.tag }}
  build-appimage-package:
    if: github.repository == 'hashicorp/vagrant-builders'
    name: Build appimage package
    needs: [info, vagrant-artifacts]
    permissions:
      contents: write
      id-token: write
    uses: ./.github/workflows/build-appimage.yml
    with:
      vagrant-artifacts-name: ${{ needs.vagrant-artifacts.outputs.artifacts-name }}
      vagrant-artifacts-path: ${{ needs.vagrant-artifacts.outputs.artifacts-path }}
      vagrant-gem-name: ${{ needs.vagrant-artifacts.outputs.gem-name }}
      vagrant-gem-path: ${{ needs.vagrant-artifacts.outputs.gem-path }}
      vagrant-licenses-name: ${{ needs.vagrant-artifacts.outputs.licenses-name }}
      vagrant-licenses-path: ${{ needs.vagrant-artifacts.outputs.licenses-path }}
      vagrant-version: ${{ needs.vagrant-artifacts.outputs.vagrant-version }}
      vagrant-shasum: ${{ needs.vagrant-artifacts.outputs.vagrant-shasum }}
    secrets: inherit
  build-archlinux-package:
    if: github.repository == 'hashicorp/vagrant-builders'
    name: Build Arch Linux Package
    needs: [info, vagrant-artifacts]
    permissions:
      contents: write
      id-token: write
    uses: ./.github/workflows/build-arch.yml
    with:
      vagrant-artifacts-name: ${{ needs.vagrant-artifacts.outputs.artifacts-name }}
      vagrant-artifacts-path: ${{ needs.vagrant-artifacts.outputs.artifacts-path }}
      vagrant-gem-name: ${{ needs.vagrant-artifacts.outputs.gem-name }}
      vagrant-gem-path: ${{ needs.vagrant-artifacts.outputs.gem-path }}
      vagrant-version: ${{ needs.vagrant-artifacts.outputs.vagrant-version }}
      vagrant-shasum: ${{ needs.vagrant-artifacts.outputs.vagrant-shasum }}
    secrets: inherit
  build-deb-packages:
    if: github.repository == 'hashicorp/vagrant-builders'
    name: Build deb packages
    needs: [info, vagrant-artifacts]
    permissions:
      contents: write
      id-token: write
    uses: ./.github/workflows/build-debs.yml
    with:
      vagrant-artifacts-name: ${{ needs.vagrant-artifacts.outputs.artifacts-name }}
      vagrant-artifacts-path: ${{ needs.vagrant-artifacts.outputs.artifacts-path }}
      vagrant-gem-name: ${{ needs.vagrant-artifacts.outputs.gem-name }}
      vagrant-gem-path: ${{ needs.vagrant-artifacts.outputs.gem-path }}
      vagrant-version: ${{ needs.vagrant-artifacts.outputs.vagrant-version }}
      vagrant-shasum: ${{ needs.vagrant-artifacts.outputs.vagrant-shasum }}
    secrets: inherit
  build-macos-package:
    if: github.repository == 'hashicorp/vagrant-builders'
    name: Build macOS package
    needs: [info, vagrant-artifacts]
    permissions:
      contents: write
      id-token: write
    uses: ./.github/workflows/build-macos.yml
    with:
      vagrant-artifacts-name: ${{ needs.vagrant-artifacts.outputs.artifacts-name }}
      vagrant-artifacts-path: ${{ needs.vagrant-artifacts.outputs.artifacts-path }}
      vagrant-gem-name: ${{ needs.vagrant-artifacts.outputs.gem-name }}
      vagrant-gem-path: ${{ needs.vagrant-artifacts.outputs.gem-path }}
      vagrant-licenses-name: ${{ needs.vagrant-artifacts.outputs.licenses-name }}
      vagrant-licenses-path: ${{ needs.vagrant-artifacts.outputs.licenses-path }}
      vagrant-version: ${{ needs.vagrant-artifacts.outputs.vagrant-version }}
      vagrant-shasum: ${{ needs.vagrant-artifacts.outputs.vagrant-shasum }}
    secrets: inherit
  build-rpm-packages:
    if: github.repository == 'hashicorp/vagrant-builders'
    name: Build rpm packages
    needs: [info, vagrant-artifacts]
    permissions:
      contents: write
      id-token: write
    uses: ./.github/workflows/build-rpms.yml
    with:
      vagrant-artifacts-name: ${{ needs.vagrant-artifacts.outputs.artifacts-name }}
      vagrant-artifacts-path: ${{ needs.vagrant-artifacts.outputs.artifacts-path }}
      vagrant-gem-name: ${{ needs.vagrant-artifacts.outputs.gem-name }}
      vagrant-gem-path: ${{ needs.vagrant-artifacts.outputs.gem-path }}
      vagrant-version: ${{ needs.vagrant-artifacts.outputs.vagrant-version }}
      vagrant-shasum: ${{ needs.vagrant-artifacts.outputs.vagrant-shasum }}
    secrets: inherit
  build-windows-packages:
    if: github.repository == 'hashicorp/vagrant-builders'
    name: Build Windows Packages
    needs: [info, vagrant-artifacts]
    permissions:
      contents: write
      id-token: write
    uses: ./.github/workflows/build-windows.yml
    with:
      vagrant-artifacts-name: ${{ needs.vagrant-artifacts.outputs.artifacts-name }}
      vagrant-artifacts-path: ${{ needs.vagrant-artifacts.outputs.artifacts-path }}
      vagrant-gem-name: ${{ needs.vagrant-artifacts.outputs.gem-name }}
      vagrant-gem-path: ${{ needs.vagrant-artifacts.outputs.gem-path }}
      vagrant-licenses-name: ${{ needs.vagrant-artifacts.outputs.licenses-name }}
      vagrant-licenses-path: ${{ needs.vagrant-artifacts.outputs.licenses-path }}
      vagrant-version: ${{ needs.vagrant-artifacts.outputs.vagrant-version }}
      vagrant-shasum: ${{ needs.vagrant-artifacts.outputs.vagrant-shasum }}
    secrets: inherit
  release:
    if: github.repository == 'hashicorp/vagrant-builders' && needs.info.outputs.release-exists != 'true'
    name: HashiCorp Release
    needs: [info, vagrant-artifacts, build-appimage-package, build-archlinux-package, build-deb-packages, build-macos-package, build-rpm-packages, build-windows-packages]
    runs-on: ['self-hosted', 'ondemand', 'linux', 'type=t3.small']
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Authentication
        id: vault-auth
        run: vault-auth
      - name: Secrets
        id: secrets
        uses: hashicorp/vault-action@v2
        with:
          url: ${{ steps.vault-auth.outputs.addr }}
          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
          token: ${{ steps.vault-auth.outputs.token }}
          secrets:
            kv/data/github/hashicorp/vagrant-builders hashicorp_release_github_token;
            kv/data/github/hashicorp/vagrant-builders releases_api_production_host;
            kv/data/github/hashicorp/vagrant-builders releases_api_production_key;
            kv/data/github/hashicorp/vagrant-builders releases_api_staging_host;
            kv/data/github/hashicorp/vagrant-builders releases_api_staging_key;
            kv/data/github/hashicorp/vagrant-builders signore_client_id;
            kv/data/github/hashicorp/vagrant-builders signore_client_secret;
            kv/data/github/hashicorp/vagrant-builders signore_gpg_signer;
      - name: Code Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Doormat Configuration
        uses: hashicorp/doormat-action@v1
        with:
          aws-role-arn: ${{ vars.RELEASE_ROLE_ARN }}
      - name: Fetch appimage package
        run: ./.ci/restore-cache "${CACHE_ID}" ./pkg
        env:
          CACHE_ID: ${{ needs.build-appimage-package.outputs.appimage-package-id }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Fetch Arch Linux package
        run: ./.ci/restore-cache "${CACHE_ID}" ./pkg
        env:
          CACHE_ID: ${{ needs.build-archlinux-package.outputs.arch-package-id }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Fetch deb packages
        run: ./.ci/restore-cache "${CACHE_ID}" ./pkg
        env:
          CACHE_ID: ${{ needs.build-deb-packages.outputs.deb-packages-id }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Fetch macOS DMG
        run: ./.ci/restore-cache "${CACHE_ID}" ./pkg
        env:
          CACHE_ID: ${{ needs.build-macos-package.outputs.dmg-cache-id }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Fetch rpm packages
        run: ./.ci/restore-cache "${CACHE_ID}" ./pkg
        env:
          CACHE_ID: ${{ needs.build-rpm-packages.outputs.rpm-packages-id }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Fetch 32 Bit Windows Package
        run: ./.ci/restore-cache "${CACHE_ID}" ./pkg
        env:
          CACHE_ID: ${{ needs.build-windows-packages.outputs.msi-32-signed-id }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Fetch 64 Bit Windows Package
        run: ./.ci/restore-cache "${CACHE_ID}" ./pkg
        env:
          CACHE_ID: ${{ needs.build-windows-packages.outputs.msi-64-signed-id }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Update macOS package name
        run: ./.ci/macos-rename-release ./pkg
      - name: Validate package list
        run: ./.ci/validate-package-list ./pkg
      - name: Release Packages
        run: ./.ci/publish-release "${VAGRANT_VERSION}" ./pkg
        env:
          HASHIBOT_TOKEN: ${{ steps.secrets.outputs.hashicorp_release_github_token }}
          VAGRANT_VERSION: ${{ needs.vagrant-artifacts.outputs.vagrant-version }}
          SIGNORE_SIGNER: ${{ steps.secrets.outputs.signore_gpg_signer }}
          SIGNORE_CLIENT_ID: ${{ steps.secrets.outputs.signore_client_id  }}
          SIGNORE_CLIENT_SECRET: ${{ steps.secrets.outputs.signore_client_secret }}
          RELEASE_AWS_ACCESS_KEY_ID: ${{ steps.secrets.outputs.releases_aws_access_key_id }}
          RELEASE_AWS_SECRET_ACCESS_KEY: ${{ steps.secrets.outputs.releases_aws_secret_access_key }}
          RELEASE_AWS_ASSUME_ROLE_ARN: ${{ steps.secrets.outputs.releases_aws_role_arn }}
          HC_RELEASES_PROD_SNS_TOPIC: ${{ vars.HASHICORP_RELEASES_SNS_ARN }}
          HC_RELEASES_PROD_HOST: ${{ steps.secrets.outputs.releases_api_production_host }}
          HC_RELEASES_PROD_KEY: ${{ steps.secrets.outputs.releases_api_production_key }}
          HC_RELEASES_STAGING_HOST: ${{ steps.secrets.outputs.releases_api_staging_host }}
          HC_RELEASES_STAGING_KEY: ${{ steps.secrets.outputs.releases_api_staging_key }}
          HASHICORP_PUBLIC_GPG_KEY_ID: ${{ vars.HASHICORP_GPG_SIGNING_ID }}
  post-release-github-release:
    if: github.repository == 'hashicorp/vagrant-builders' && !cancelled() && !failure()
    name: GitHub Release
    needs: [info, vagrant-artifacts, release]
    runs-on: ['self-hosted', 'ondemand', 'linux', 'type=t3.small']
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Authentication
        id: vault-auth
        run: vault-auth
      - name: Secrets
        id: secrets
        uses: hashicorp/vault-action@v2
        with:
          url: ${{ steps.vault-auth.outputs.addr }}
          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
          token: ${{ steps.vault-auth.outputs.token }}
          secrets:
            kv/data/teams/vagrant/hashibot signore_token;
            kv/data/teams/vagrant/hashibot vagrant_token;
            kv/data/github/hashicorp/vagrant-builders signore_client_id;
            kv/data/github/hashicorp/vagrant-builders signore_client_secret;
            kv/data/github/hashicorp/vagrant-builders signore_gpg_signer;
      - name: Code Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Fetch Vagrant Build Artifacts
        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
        with:
          name: ${{ needs.vagrant-artifacts.outputs.artifacts-name }}
          path: ${{ needs.vagrant-artifacts.outputs.artifacts-path }}
      - name: Checksum and Sign Vagrant Build Artifacts
        run: ./.ci/generate-sign-build-sum "${VERSION}" "${ARTIFACT_DIR}"
        env:
          ARTIFACT_DIR: ${{ needs.vagrant-artifacts.outputs.artifacts-path }}
          VERSION: ${{ needs.vagrant-artifacts.outputs.vagrant-version }}
          GITHUB_TOKEN: ${{ steps.secrets.outputs.signore_token }}
          SIGNORE_SIGNER: ${{ steps.secrets.outputs.signore_gpg_signer }}
          SIGNORE_CLIENT_ID: ${{ steps.secrets.outputs.signore_client_id  }}
          SIGNORE_CLIENT_SECRET: ${{ steps.secrets.outputs.signore_client_secret }}
      - name: Publish GitHub Release
        run: ./.ci/publish-github-release "${TAG_NAME}" "${ARTIFACT_DIR}"
        env:
          ARTIFACT_DIR: ${{ needs.vagrant-artifacts.outputs.artifacts-path }}
          TAG_NAME: ${{ needs.info.outputs.vagrant-tag }}
          GITHUB_TOKEN: ${{ steps.secrets.outputs.vagrant_token }}
  trigger-rubygem-publish:
    if: github.repository == 'hashicorp/vagrant-builders' && !cancelled() && !failure()
    name: Trigger RubyGem Publish
    needs: [info, post-release-github-release]
    runs-on: ['self-hosted', 'ondemand', 'linux', 'type=t3.small']
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Authentication
        id: vault-auth
        run: vault-auth
      - name: Secrets
        id: secrets
        uses: hashicorp/vault-action@v2
        with:
          url: ${{ steps.vault-auth.outputs.addr }}
          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
          token: ${{ steps.vault-auth.outputs.token }}
          secrets:
            kv/data/teams/vagrant/hashibot publish_token;
      - name: Code Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Trigger Publish
        run: |
          . .ci/load-ci.sh || exit

          github_repository_dispatch "vagrant-publisher" "publish-rubygem" "repository_name=vagrant" "release_name=${RELEASE_NAME}"
        env:
          RELEASE_NAME: ${{ needs.info.outputs.vagrant-tag }}
          GITHUB_TOKEN: ${{ steps.secrets.outputs.publish_token }}
  unified-docs:
    if: github.repository == 'hashicorp/vagrant-builders' && !cancelled() && !failure()
    name: Create Unified Docs PR
    needs: [info, vagrant-artifacts, release]
    permissions:
      contents: write
      id-token: write
    uses: ./.github/workflows/unified-docs-release.yml
    with:
      release-tag: ${{ needs.info.outputs.vagrant-tag }}
      version: ${{ needs.vagrant-artifacts.outputs.vagrant-version }}
    secrets: inherit
  next-version:
    if: github.repository == 'hashicorp/vagrant-builders' && !cancelled() && !failure()
    name: Calculate next version
    runs-on: ubuntu-latest
    needs: [vagrant-artifacts]
    outputs:
      version: ${{ steps.calculate-version.outputs.version }}
    steps:
      - name: calculate-version
        env:
          current_version: ${{ needs.vagrant-artifacts.outputs.vagrant-version }}
        run: |
          major_minor="${current_version%.*}"
          patch="${current_version##*.}"
          ((patch++))
          new_version="${major_minor}.${patch}"
          printf "version=%s\n" >> "${GITHUB_OUTPUT}"
  new-unified-docs-version:
    if: github.repository == 'hashicorp/vagrant-builders' && !cancelled() && !failure()
    name: Add New Version To Docs
    needs: [vagrant-artifacts, next-version, unified-docs]
    permissions:
      contents: write
      id-token: write
    uses: ./.github/workflows/unified-docs-new-version.yml
    with:
      new-version: ${{ needs.next-version.outputs.version }}
      previous-version: ${{ needs.vagrant-artifacts.outputs.vagrant-version }}
    secrets: inherit