release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      environment:
        description: "Environment"
        required: true
        default: "staging"
        type: choice
        options:
          - staging
          - production
      version:
        description: "Version number (production only)"
        required: false
        type: string

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: ${{ inputs.environment }}
    steps:
      - name: Clone repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Log in to image registry (Production)
        if: ${{ inputs.environment == 'production' }}
        run: |
          echo '${{ secrets.DOCKER_PASSWORD }}' | docker login registry.anvil.rcac.purdue.edu \
            -u '${{ secrets.DOCKER_USERNAME }}' --password-stdin

      - name: Log in to chart project (Production)
        if: ${{ inputs.environment == 'production' }}
        run: |
          mkdir -p "$RUNNER_TEMP/helm"
          echo '${{ secrets.CHART_PROJECT_PASSWORD }}' | helm registry login registry.anvil.rcac.purdue.edu \
            -u '${{ secrets.CHART_PROJECT_USERNAME }}' --password-stdin --registry-config "$RUNNER_TEMP/helm/registry-config.json"

      - name: Log in to image registry (Staging)
        if: ${{ inputs.environment == 'staging' }}
        run: |
          echo '${{ secrets.DOCKER_PASSWORD_STAGING }}' | docker login registry.anvil.rcac.purdue.edu \
            -u '${{ secrets.DOCKER_USERNAME_STAGING }}' --password-stdin

      - name: Log in to chart project (Staging)
        if: ${{ inputs.environment == 'staging' }}
        run: |
          mkdir -p "$RUNNER_TEMP/helm"
          echo '${{ secrets.CHART_PROJECT_PASSWORD_STAGING }}' | helm registry login registry.anvil.rcac.purdue.edu \
            -u '${{ secrets.CHART_PROJECT_USERNAME_STAGING }}' --password-stdin --registry-config "$RUNNER_TEMP/helm/registry-config.json"

      - name: Set up Git (Production)
        if: ${{ inputs.environment == 'production' }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

        # This step is necessary because our script uses the destination OCI registry as a layer cache, which isn't supported by Docker out of the box.
        # See https://docs.docker.com/build/cache/backends/registry/ and https://docs.docker.com/build/builders/drivers/ for more info.
      - name: Set up buildx builder
        run: |
          docker buildx create --use
          docker buildx inspect --bootstrap

      - name: Release
        run: ./.github/workflows/release/release-${{ inputs.environment }}.sh "${{ inputs.version }}"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TEMPLATE_REG_CONFIG: ${{ runner.temp }}/helm/registry-config.json

      - name: Log out of container registry
        if: always()
        run: docker logout registry.anvil.rcac.purdue.edu