django-DefectDojo/.github/workflows/release-2-tag-docker-push.yml at 7b32cda9b9b358ec7a0be305a2c221dbd27863a2 · DefectDojo/django-DefectDojo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
name: "Release-2: Tag, Release, Push"

env:
  GIT_USERNAME: "DefectDojo release bot"
  GIT_EMAIL: "dojo-release-bot@users.noreply.github.com"

on:
  workflow_dispatch:
    inputs:
      # the actual branch that can be chosen on the UI is made irrelevant by further steps
      # because someone will forget one day to change it.
      release_number:
        type: string
        description: 'Release version (x.y.z format)'
        required: true

jobs:
  tag:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
        with:
          ref: master

      - name: Configure git
        run: |
          git config --global user.name "${{ env.GIT_USERNAME }}"
          git config --global user.email "${{ env.GIT_EMAIL }}"

      - name: Create new tag ${{ inputs.release_number }}
        # at this point, the PR from the 1st workflow is merged into master.
        run: |
          git tag -a ${{ inputs.release_number }} -m "[bot] release ${{ inputs.release_number }}"
          git push origin ${{ inputs.release_number }}

  publish-docker-containers:
    needs: tag
    strategy:
      matrix:
          platform: ['linux/amd64', 'linux/arm64']
      fail-fast: false
    uses: ./.github/workflows/release-x-manual-docker-containers.yml
    with:
      release_number: ${{ inputs.release_number }}
      platform: ${{ matrix.platform }}
    secrets: inherit

  publish-container-digests:
    needs: publish-docker-containers
    uses: ./.github/workflows/release-x-manual-merge-container-digests.yml
    with:
      release_number: ${{ inputs.release_number }}
    secrets: inherit

  # for releases we need to tag the images with the latest tag
  # this could be parametrized in the merge-container-digests workflow
  # but it's simpler to just add a explicit workflow for this here
  tag-as-latest:
    needs: publish-container-digests
    uses: ./.github/workflows/release-x-manual-tag-as-latest.yml
    with:
      release_number: ${{ inputs.release_number }}
    secrets: inherit

  release-helm-chart:
    needs: publish-container-digests
    uses: ./.github/workflows/release-x-manual-helm-chart.yml
    with:
      release_number: ${{ inputs.release_number }}
    secrets: inherit

  release-drafter:
    needs: publish-container-digests
    uses: ./.github/workflows/release-drafter.yml
    with:
      version: ${{ inputs.release_number }}
    secrets: inherit