release.yml

name: policy-server release
on:
  push:
    tags:
      - "v*"

# Declare default permissions as read only.
permissions: read-all

jobs:
  ci:
    uses: ./.github/workflows/ci.yml
    permissions: read-all

  build:
    name: Build container image, sign it, and generate SBOMs
    uses: ./.github/workflows/container-build.yml
    permissions:
      id-token: write
      packages: write

  release:
    name: Create release

    needs:
      - ci
      - build

    permissions:
      contents: write

    runs-on: ubuntu-latest

    steps:
      - name: Retrieve tag name
        if: ${{ startsWith(github.ref, 'refs/tags/') }}
        run: |
          echo TAG_NAME=$(echo ${{ github.ref_name }}) >> $GITHUB_ENV

      - name: Get latest release tag
        id: get_last_release_tag
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            let release = await github.rest.repos.getLatestRelease({
               owner: context.repo.owner,
               repo: context.repo.repo,
            });

            if (release.status  === 200 ) {
              core.setOutput('old_release_tag', release.data.tag_name)
              return
            }
            core.setFailed("Cannot find latest release")

      - name: Get release ID from the release created by release drafter
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            let releases = await github.rest.repos.listReleases({
               owner: context.repo.owner,
               repo: context.repo.repo,
            });
            for (const release of releases.data) {
              if (release.draft) {
                      core.info(release)
                      core.exportVariable('RELEASE_ID', release.id)
                      return
              }
            }
            core.setFailed(`Draft release not found`)

      - name: Checkout code for kubewarden-dashboard.json
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Download SBOM artifact
        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
        with:
          pattern: sbom-*
          path: ./
          merge-multiple: true

      - name: Display structure of downloaded files
        run: ls -R

      - name: Upload release assets
        id: upload_release_assets
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            let fs = require('fs');
            let path = require('path');

            let files = [
              'policy-server-sbom-amd64.spdx',
              'policy-server-sbom-amd64.spdx.cert',
              'policy-server-sbom-amd64.spdx.sig',
              'policy-server-sbom-arm64.spdx',
              'policy-server-sbom-arm64.spdx.cert',
              'policy-server-sbom-arm64.spdx.sig',
              'kubewarden-dashboard.json']
            const {RELEASE_ID} = process.env

            for (const file of files) {
              let file_data = fs.readFileSync(file);

              let response = await github.rest.repos.uploadReleaseAsset({
                owner: context.repo.owner,
                repo: context.repo.repo,
                release_id: `${RELEASE_ID}`,
                name: path.basename(file),
                data: file_data,
              });
            }

      - name: Publish release
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            const {RELEASE_ID} = process.env
            const {TAG_NAME} = process.env
            isPreRelease = ${{ contains(github.ref_name, '-alpha') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-rc') }}
            github.rest.repos.updateRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: `${RELEASE_ID}`,
              draft: false,
              tag_name: `${TAG_NAME}`,
              name: `${TAG_NAME}`,
              prerelease: isPreRelease,
              make_latest: !isPreRelease
            });

      - name: Trigger chart update
        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
        with:
          token: ${{ secrets.WORKFLOW_PAT }}
          repository: "${{github.repository_owner}}/helm-charts"
          event-type: update-chart
          client-payload: '{"version": "${{ github.ref_name }}", "oldVersion": "${{ steps.get_last_release_tag.outputs.old_release_tag }}", "repository": "${{ github.repository }}"}'