release.yml

name: Cut Release

on: workflow_dispatch

jobs:

  check-requirements:
    name: Check Requirements
    runs-on: ubuntu-latest
    environment: release-check
    steps:
      - name: Verify Admin Permission
        uses: actions-cool/check-user-permission@v2
        with:
          require: admin
          username: ${{ github.triggering_actor }}

      - name: Verifying Release Workflow
        run: |
          if [ "${{ vars.RUN_RELEASE_BUILDS }}" = "1" ]; then
            MSG="Running workflow because RUN_RELEASE_BUILDS=1"
            echo "${MSG}"
            echo "${MSG}" >> "${GITHUB_STEP_SUMMARY}"
            exit 0
          fi
          echo "Trying to run the release workflow from repository ${{ github.repository }}"
          if [ "${{ github.repository }}" != "saltstack/salt-vmtools" ]; then
              MSG="Running the release workflow from the ${{ github.repository }} repository is not allowed"
              echo "${MSG}"
              echo "${MSG}" >> "${GITHUB_STEP_SUMMARY}"
              MSG="Allowed repository: saltstack/salt-vmtools"
              echo "${MSG}"
              echo "${MSG}" >> "${GITHUB_STEP_SUMMARY}"
              exit 1
          else
              MSG="Allowed to release from repository ${{ github.repository }}"
              echo "${MSG}"
              echo "${MSG}" >> "${GITHUB_STEP_SUMMARY}"
          fi

      - name: Verifying Branch
        run: |
          echo "Trying to run the release workflow from branch ${{ github.ref_name }}"
          if [ "${{ github.ref_name }}" != "main" ]; then
              echo "Running the release workflow from the ${{ github.ref_name }} branch is not allowed"
              echo "Allowed branches: main"
              exit 1
          else
              echo "Allowed to release from branch ${{ github.ref_name }}"
          fi

  update-main:
    name: Prepare Files for Release
    runs-on: ubuntu-latest
    permissions:
      contents: write  # To be able to publish the release
    environment: release
    needs:
      - check-requirements
    outputs:
      release-version: ${{ steps.update-repo.outputs.release-version }}
    steps:
      - uses: actions/checkout@v6
        with:
          ref: main
          repository: ${{ github.repository }}
          ssh-key: ${{ secrets.SALT_VMTOOLS_RELEASE_KEY }}

      - name: Install Requirements
        run: |
          python3 -m pip install -r requirements/release.txt
          pre-commit install --install-hooks

      - name: Configure Git
        shell: bash
        run: |
          git config --global --add safe.directory "$(pwd)"
          git config --global user.name "Salt Project Packaging"
          git config --global user.email saltproject.pdl@broadcom.com
          git config --global commit.gpgsign false

      - name: Update Repository
        id: update-repo
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          python3 .github/workflows/scripts/cut-release.py --repo ${{ github.repository }}

      - name: Show Changes
        run: |
          git status
          git diff

      - name: Commit Changes
        run: |
          git commit -am "Update main branch for the ${{ steps.update-repo.outputs.release-version }} release" || \
            git commit -am "Update main branch for the ${{ steps.update-repo.outputs.release-version }} release"

      - name: Push Changes
        shell: bash
        run: |
          git push origin HEAD:main

      - name: Upload Release Details
        uses: actions/upload-artifact@v7
        with:
          name: release-details
          path: |
            .cut_release_version
            .cut_release_changes
          include-hidden-files: true

  publish-release:
    name: Publish Release
    runs-on: ubuntu-latest
    needs:
      - update-main
    environment: release
    permissions:
      contents: write  # To be able to publish the release
    steps:
      - uses: actions/checkout@v6
        with:
          ref: main
          repository: ${{ github.repository }}
          ssh-key: ${{ secrets.SALT_VMTOOLS_RELEASE_KEY }}

      - name: Configure Git
        shell: bash
        run: |
          git config --global --add safe.directory "$(pwd)"
          git config --global user.name "Salt Project Packaging"
          git config --global user.email saltproject.pdl@broadcom.com
          git config --global commit.gpgsign false

      - name: Download Release Details
        uses: actions/download-artifact@v7
        with:
          name: release-details

      - name: Update Environment
        run: |
          CUT_RELEASE_VERSION=$(cat .cut_release_version)
          echo "CUT_RELEASE_VERSION=${CUT_RELEASE_VERSION}" >> "$GITHUB_ENV"

      - name: Prepare Release Artifacts
        run: |
          # Move scripts to dist directory so we don't update the source files
          mkdir -p dist
          cp linux/svtminion.sh dist/svtminion.sh
          cp windows/svtminion.ps1 dist/svtminion.ps1
          # Inject release version into artifact copies via helper script
          python3 .github/workflows/scripts/update-svtminion-versions.py "${CUT_RELEASE_VERSION}"
          # Generate checksums for the release artifacts
          (cd dist && sha256sum svtminion.sh > ../svtminion.sh.sha256)
          (cd dist && sha256sum svtminion.ps1 > ../svtminion.ps1.sha256)

      - name: Create Tag (${{ needs.update-main.outputs.release-version }})
        run: |
          git tag -f --no-sign -m "Release ${{ needs.update-main.outputs.release-version }}" -a ${{ needs.update-main.outputs.release-version }}

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v1
        with:
          name: ${{ env.CUT_RELEASE_VERSION }}
          tag_name: ${{ env.CUT_RELEASE_VERSION }}
          body_path: .cut_release_changes
          target_commitish: main
          draft: false
          prerelease: false
          generate_release_notes: false
          files: |
            dist/svtminion.sh
            dist/svtminion.ps1
            svtminion.sh.sha256
            svtminion.ps1.sha256
            LICENSE

      - name: Delete Release Details Artifact
        uses: geekyeggo/delete-artifact@v5
        with:
          name: release-details
          failOnError: false

  update-main-checksums:
    name: Update Release Checksums
    runs-on: ubuntu-latest
    needs:
      - update-main
      - publish-release
    environment: release
    permissions:
      contents: write  # For action peter-evans/create-pull-request
      pull-requests: write  # For action peter-evans/create-pull-request

    steps:
      - uses: actions/checkout@v6
        with:
          ref: main
          repository: ${{ github.repository }}
          ssh-key: ${{ secrets.SALT_VMTOOLS_RELEASE_KEY }}

      - name: Configure Git
        shell: bash
        run: |
          git config --global --add safe.directory "$(pwd)"
          git config --global user.name "Salt Project Packaging"
          git config --global user.email saltproject.pdl@broadcom.com
          git config --global commit.gpgsign false

      - name: Update Checksums in README.md
        shell: bash
        run: |
          VERSION="${{ needs.update-main.outputs['release-version'] }}"
          curl -sL "https://github.com/${{ github.repository }}/releases/download/${VERSION}/svtminion.sh" -o svtminion.sh
          SH="$(sha256sum svtminion.sh | awk '{ print $1 }')"
          python3 .github/workflows/scripts/update-release-shasum.py "$VERSION" "$SH"

      - name: Show Changes
        run: |
          git status
          git diff

      - name: Commit Changes
        shell: bash
        run: |
          VERSION="${{ needs.update-main.outputs['release-version'] }}"
          VERSION="${VERSION#v}"
          git commit --allow-empty -am "Update README.md with ${VERSION} release sha256sum"

      - name: Push Changes
        shell: bash
        run: |
          git push origin HEAD:main