headlamp.yaml

name: Headlamp Plugin CI/CD

on:
  push:
    branches: [main]
    tags:
      - 'v*'
  pull_request:
    branches: [main]

jobs:
  test:
    name: Lint, Format, Test & Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: 24
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npx @kinvolk/headlamp-plugin lint . || npm run lint --if-present

      - name: Format check
        run: npx @kinvolk/headlamp-plugin format --check . || npm run format -- --check --if-present

      - name: Type check
        run: npx @kinvolk/headlamp-plugin tsc . || npm run tsc --if-present || echo "No type check configured"

      - name: Test
        run: npx @kinvolk/headlamp-plugin test . || npm test --if-present

      - name: Build
        run: npx @kinvolk/headlamp-plugin build . || npm run build

  release:
    name: Release to GitHub + Docker + Artifact Hub
    if: startsWith(github.ref, 'refs/tags/v')
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      id-token: write
      attestations: write
      artifact-metadata: write

    env:
      REGISTRY: ghcr.io
      IMAGE_NAME: ${{ github.repository_owner }}/${{ github.event.repository.name }}

    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: 24
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Extract version from tag
        id: version
        run: |
          TAG="${{ github.ref_name }}"
          VERSION="${TAG#v}"
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Build & Package
        id: package
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          npm version "$VERSION" --no-git-tag-version --allow-same-version
          npm run build
          npm run package
          TARBALL=$(ls -1 *.tar.gz | head -n1)
          echo "tarball=$TARBALL" >> "$GITHUB_OUTPUT"
          if [ -f "$TARBALL" ]; then
            CHECKSUM=$(sha256sum "$TARBALL" | awk '{print $1}')
            echo "checksum=$CHECKSUM" >> "$GITHUB_OUTPUT"
            echo "✅ Tarball: $TARBALL"
            echo "✅ Checksum: sha256:$CHECKSUM"
          else
            echo "❌ No tarball found!"
            exit 1
          fi

      - name: Create GitHub Release + upload asset
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          files: '*.tar.gz'
          tag_name: ${{ steps.version.outputs.tag }}
          name: Release ${{ steps.version.outputs.tag }}
          generate_release_notes: true

      - name: Publish Artifact Hub metadata branch
        run: |
          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
          sudo chmod +x /usr/local/bin/yq

          export VERSION="${{ steps.version.outputs.version }}"
          export TAG="${{ steps.version.outputs.tag }}"
          export TARBALL="${{ steps.package.outputs.tarball }}"
          export CHECKSUM="${{ steps.package.outputs.checksum }}"
          export ARCHIVE_URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/${TARBALL}"
          export CREATED_AT="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"

          WORKDIR="$(mktemp -d)"

          git clone --depth 1 --branch artifacthub \
            "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git" \
            "$WORKDIR"

          cd "$WORKDIR"

          PACKAGE_DIR="capsule"
          TEMPLATE_PKG=""
          if [ -f package.template ]; then
            TEMPLATE_PKG="package.template"
          fi

          if [ -z "$TEMPLATE_PKG" ] && [ -f "$PACKAGE_DIR/package.template" ]; then
            TEMPLATE_PKG="$PACKAGE_DIR/package.template"
          fi

          if [ -z "$TEMPLATE_PKG" ]; then
            TEMPLATE_PKG="$(find "$PACKAGE_DIR" -mindepth 2 -maxdepth 2 -name artifacthub-pkg.yml | sort -V | tail -n1)"
          fi

          test -n "$TEMPLATE_PKG" || {
            echo "❌ No artifacthub-pkg.yml template found on artifacthub branch"
            exit 1
          }

          PACKAGE_VERSION_DIR="$PACKAGE_DIR/$VERSION"
          mkdir -p "$PACKAGE_VERSION_DIR"
          cp "$TEMPLATE_PKG" "$PACKAGE_VERSION_DIR/artifacthub-pkg.yml"
          cp "$GITHUB_WORKSPACE/README.md" "$PACKAGE_VERSION_DIR/README.md"

          yq -i '.version = strenv(VERSION)' "$PACKAGE_VERSION_DIR/artifacthub-pkg.yml"
          yq -i '.createdAt = strenv(CREATED_AT)' "$PACKAGE_VERSION_DIR/artifacthub-pkg.yml"
          yq -i '.annotations."headlamp/plugin/archive-url" = strenv(ARCHIVE_URL)' "$PACKAGE_VERSION_DIR/artifacthub-pkg.yml"
          yq -i '.annotations."headlamp/plugin/archive-checksum" = "sha256:" + strenv(CHECKSUM)' "$PACKAGE_VERSION_DIR/artifacthub-pkg.yml"
          rm -f artifacthub-pkg.yml
          rm -f "$PACKAGE_DIR/artifacthub-pkg.yml"

          echo "✅ Artifact Hub metadata published:"
          echo "   version: $VERSION"
          echo "   path: $PACKAGE_VERSION_DIR/artifacthub-pkg.yml"
          echo "   archive-url: $ARCHIVE_URL"
          echo "   checksum: sha256:$CHECKSUM"

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          git add -A
          git commit -m "chore(release): publish Artifact Hub metadata for $TAG" || echo "No changes to commit"
          git push origin artifacthub

      - name: Login to GitHub Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Build & push Docker image
        id: docker-build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest

      - name: Sign container image
        env:
          DIGEST: ${{ steps.docker-build.outputs.digest }}
          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          cosign sign --yes \
            "${IMAGE}:${TAG}@${DIGEST}" \
            "${IMAGE}:latest@${DIGEST}"

      - name: Generate and push container image attestation
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.docker-build.outputs.digest }}
          push-to-registry: true