release.yaml

#
# Copyright (C) 2025 Red Hat, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0

name: release

permissions:
  contents: write
  packages: write
  attestations: write
  id-token: write
  pull-requests: write
  repository-projects: write

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release'
        required: true
      branch:
        description: 'Branch to use for the release'
        required: true
        default: main
env:
  GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

jobs:

  tag:
    name: Tagging
    runs-on: ubuntu-24.04
    outputs:
      githubTag: ${{ steps.TAG_UTIL.outputs.githubTag}}
      extVersion: ${{ steps.TAG_UTIL.outputs.extVersion}}
      releaseId: ${{ steps.create_release.outputs.id}}

    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.inputs.branch }}
      - name: Generate tag utilities
        id: TAG_UTIL
        run: |
            TAG_PATTERN=${{ github.event.inputs.version }}
            echo "githubTag=v$TAG_PATTERN" >> ${GITHUB_OUTPUT}
            echo "extVersion=$TAG_PATTERN" >> ${GITHUB_OUTPUT}

      - name: tag
        run: |
          git config --local user.name ${{ github.actor }}
          git config --local user.email "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"

          # Add the new version in package.json file
          sed -i  "s#version\":\ \"\(.*\)\",#version\":\ \"${{ steps.TAG_UTIL.outputs.extVersion }}\",#g" package.json
          git add package.json

          # commit the changes
          git commit -m "chore: 🥁 tagging ${{ steps.TAG_UTIL.outputs.githubTag }} 🥳"
          echo "Tagging with ${{ steps.TAG_UTIL.outputs.githubTag }}"
          git tag ${{ steps.TAG_UTIL.outputs.githubTag }}
          git push origin ${{ steps.TAG_UTIL.outputs.githubTag }}
      - name: Create Release
        id: create_release
        uses: ncipollo/release-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag: ${{ steps.TAG_UTIL.outputs.githubTag }}
          name: ${{ steps.TAG_UTIL.outputs.githubTag }}
          draft: true
          prerelease: false

      - name: Create the PR to bump the version in the main branch (only if we're tagging from main branch)
        if: ${{ github.event.inputs.branch == 'main' }}
        run: |
          git config --local user.name ${{ github.actor }}
          CURRENT_VERSION=$(echo "${{ steps.TAG_UTIL.outputs.extVersion }}")
          tmp=${CURRENT_VERSION%.*}
          minor=${tmp#*.}
          bumpedVersion=${CURRENT_VERSION%%.*}.$((minor + 1)).0
          bumpedBranchName="bump-to-${bumpedVersion}"
          git checkout -b "${bumpedBranchName}"
          sed -i  "s#version\":\ \"\(.*\)\",#version\":\ \"${bumpedVersion}-next\",#g" package.json
          git add package.json
          git commit -s --amend -m "chore: bump version to ${bumpedVersion}"
          git push origin "${bumpedBranchName}"
          echo -e "📢 Bump version to ${bumpedVersion}\n\n${{ steps.TAG_UTIL.outputs.extVersion }} has been released.\n\n Time to switch to the new ${bumpedVersion} version 🥳" > /tmp/pr-title
          pullRequestUrl=$(gh pr create --title "chore: 📢 Bump version to ${bumpedVersion}" --body-file /tmp/pr-title --head "${bumpedBranchName}" --base "main")
          echo "📢 Pull request created: ${pullRequestUrl}"
          echo "➡️ Flag the PR as being ready for review"
          gh pr ready "${pullRequestUrl}"
          echo "🔅 Mark the PR as being ok to be merged automatically"
          gh pr merge "${pullRequestUrl}" --auto --rebase
          git checkout ${{ steps.TAG_UTIL.outputs.githubTag }}
        env:
          GITHUB_TOKEN: ${{ secrets.PODMAN_DESKTOP_BOT_TOKEN }}


  builder-image:
    needs: tag
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ needs.tag.outputs.githubTag }}

      - name: Install qemu dependency
        run: |
          sudo apt-get update
          sudo apt-get install -y qemu-user-static

      - name: build builder image
        id: builder-image
        uses: redhat-actions/buildah-build@v2
        with:
          image: podman-desktop-ibmcloud-account-ext-builder
          tags: latest ${{ needs.tag.outputs.extVersion }}
          platforms: linux/amd64, linux/arm64
          containerfiles: |
            build/Containerfile.builder
          context: .
          oci: true

      - name: Log in to ghcr.io
        uses: redhat-actions/podman-login@v1
        with:
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          registry: ghcr.io

      - name: publish builder to ghcr.io
        id: push-to-ghcr
        uses: redhat-actions/push-to-registry@v2
        with:
          image: ${{ steps.builder-image.outputs.image }}
          tags: ${{ steps.builder-image.outputs.tags }}
          registry: ghcr.io/${{ github.repository_owner }}

      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: ghcr.io/${{ github.repository_owner }}/podman-desktop-ibmcloud-account-ext-builder
          subject-digest: ${{ steps.push-to-ghcr.outputs.digest }}
          push-to-registry: true


  extension-image:
    name: Build and publish extension OCI image

    runs-on: ubuntu-24.04
    needs: [builder-image, tag]

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Install qemu dependency
        run: |
          sudo apt-get update
          sudo apt-get install -y qemu-user-static

      - name: build extension image
        id: extension-image
        uses: redhat-actions/buildah-build@v2
        with:
          image: podman-desktop-ibmcloud-account-ext
          tags: latest ${{ needs.tag.outputs.extVersion }}
          archs: amd64, arm64
          containerfiles: |
            build/Containerfile
          context: .
          oci: true

      - name: Log in to ghcr.io
        uses: redhat-actions/podman-login@v1
        with:
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          registry: ghcr.io

      - name: publish extension to ghcr.io
        id: push-to-ghcr
        uses: redhat-actions/push-to-registry@v2
        with:
          image: ${{ steps.extension-image.outputs.image }}
          tags: ${{ steps.extension-image.outputs.tags }}
          registry: ghcr.io/${{ github.repository_owner }}

      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: ghcr.io/${{ github.repository_owner }}/podman-desktop-ibmcloud-account-ext
          subject-digest: ${{ steps.push-to-ghcr.outputs.digest }}
          push-to-registry: true

  release:
    needs: [tag, builder-image, extension-image]
    name: Release
    runs-on: ubuntu-24.04
    steps:
      - name: id
        run: echo the release id is ${{ needs.tag.outputs.releaseId}}

      - name: Publish release
        uses: StuYarrow/publish-release@v1.1.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          id: ${{ needs.tag.outputs.releaseId}}