create-release.yml

name: "Create release"

on:
  workflow_dispatch:
    inputs:
      DRY_RUN:
        type: boolean
        default: false
        description: "Dry run: setting this to `true` will skip the final step of publishing the release, leaving it as a draft-release. This can be helpful for testing and debugging. Note that the tag and release are still getting generated and the next run of this result in incremented release version. To avoid this, do not forget to delete the resulting release and tag."

jobs:
  verify-release:
    name: Verify release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.gen-version.outputs.VERSION }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Generate version number
        id: gen-version
        run: |
          # get script
          GET_VERSION=$(mktemp /tmp/get-version-from-branch.XXXXX)
          curl -L https://raw.githubusercontent.com/kyma-project/eventing-tools/main/hack/scripts/get-version-from-branch.sh -o "${GET_VERSION}"
          chmod +x "${GET_VERSION}"
          # get version via script
          VERSION="$(./hack/ci/get-version-from-branch.sh)"
          # push version to output environment file
          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT

  bump-sec-scanners-config:
    name: Bump sec-scanners-config.yaml
    needs: verify-release
    runs-on: ubuntu-latest
    env:
      VERSION: ${{ needs.verify-release.outputs.VERSION }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: "stable"

      - name: "Setup yq" # Required for rendering the sec-scanners-config.
        shell: bash
        run: |
          go install github.com/mikefarah/yq/v4@latest
          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH

      - name: Render sec-scanners-config.yaml
        env:
          VERSION: ${{ inputs.VERSION }}
        shell: bash
        # Where ever you use this workflow, the script hack/scripts/render-sec-scanners-config.sh must exist.
        run: |
          yq --version
          ./hack/ci/render-sec-scanners-config.sh "${VERSION}"

      - name: Bump kustomize file
        env:
          VERSION: ${{ inputs.VERSION }}
        shell: bash
        # Where ever you use this workflow, the script hack/scripts/render-sec-scanners-config.sh must exist.
        run: |
          yq --version
          ./hack/ci/bump-kustomize-file.sh "${VERSION}"

      # Check if there are changes so we can determin if all following steps can be skipped.
      - name: Check for changes
        shell: bash
        run: |
          if [ -z "$(git status --porcelain)" ]; then 
            echo "No changes found. No need to create a PR" 
          else 
            echo "Changes found. Creating a PR and waiting for it to be merged."
            echo "CREATE_PR=true" >> $GITHUB_ENV 
          fi

      - name: Print out sec-scanners-config.yaml
        if: ${{ always() }}
        shell: bash
        run: |
          FILE="sec-scanners-config.yaml"
          [ -f "${FILE}" ] && cat "${FILE}" || echo "${FILE} not found."

      - name: Set up git
        if: ${{ env.CREATE_PR == 'true' }}
        env:
          GH_TOKEN: ${{ secrets.BOT_PAT }}
          REPO: ${{ github.repository }}
        shell: bash
        run: |
          # set git username 
          ghusername=$(curl -s -H "Authorization: token ${GH_TOKEN}" https://api.github.com/user | jq '.login')
          git config user.name "${ghusername}"
          # set git mail address
          ghemailaddress="${ghusername}@users.noreply.github.com"
          git config user.email "${ghemailaddress}"
          # set remote url
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git"

      - name: Set all variables
        if: ${{ env.CREATE_PR == 'true' }}
        shell: bash
        run: |
          CURRENT_BRANCH="$(git rev-parse --abbrev-ref HEAD)"
          echo "current branch: ${CURRENT_BRANCH}"
          echo "CURRENT_BRANCH=${CURRENT_BRANCH}" >> $GITHUB_ENV

          PR_DATE="$(date '+%Y-%m-%d-%H-%M-%S')"
          echo "pr date: ${PR_DATE}"
          echo "PR_DATE=${PR_DATE}" >> $GITHUB_ENV

          BRANCH_NAME="sec-scanners-bump-${CURRENT_BRANCH}-${PR_DATE}"
          echo "name of the new branch: ${BRANCH_NAME}"
          echo "BRANCH_NAME=${BRANCH_NAME}" >> $GITHUB_ENV

      - name: Create a pull request
        if: ${{ env.CREATE_PR == 'true' }}
        env:
          REPO: ${{ github.repository }}
          CURRENT_BRANCH: ${{ env.CURRENT_BRANCH }}
          PR_DATE: ${{ env.PR_DATE }}
          BRANCH_NAME: ${{ env.BRANCH_NAME }}
          GH_TOKEN: ${{ secrets.BOT_PAT }}
        shell: bash
        run: |
          # Create a new branch for our changes.
          git checkout -b "${BRANCH_NAME}"

          # Stage the changes to sec-scanner-config.yaml and create a commit.
          git add sec-scanners-config.yaml
          git commit -m "auto-bump sec-scanners-config: ${PR_DATE}"

          # Push the changes to origin, as defined earlier.
          git push origin "$BRANCH_NAME"

          # Create a PR.
          BODY="This is an auto-generated PR to bump the sec-scanners-config.yml on ${REPO}."
          PR_URL=$(gh pr create --base "${CURRENT_BRANCH}" --head "${BRANCH_NAME}" --title "Bump sec-scanners-config on ${CURRENT_BRANCH}" --body "${BODY}")
          echo "PR_URL=${PR_URL}" >> $GITHUB_ENV

      - name: USER INTERACTION REQUIRED
        if: ${{ env.CREATE_PR == 'true' }}
        shell: bash
        env:
          PR_URL: ${{ env.PR_URL }}
        run: |
          echo "please review  ${PR_URL}"

      - name: Wait for PR to be merged
        if: ${{ env.CREATE_PR == 'true' }}
        shell: bash
        env:
          TIMEOUT: ${{ inputs.TIMEOUT }}
          PR_URL: ${{ env.PR_URL }}
          GH_TOKEN: ${{ secrets.BOT_PAT }}
        run: |
          end_time=$((SECONDS+3600)) # 1 hour

          while [ $SECONDS -lt $end_time ]; do
            pr_state=$(gh pr view ${PR_URL} --json state --jq '.state')
            if [ "$pr_state" == "CLOSED" ]; then 
              echo "ERROR! PR has been closed!"
              exit 1
            elif [ "$pr_state" == "MERGED" ]; then
              echo "PR has been merged!"
              exit 0
            fi
            sleep 10
          done

          echo "Timeout reached. PR not merged within the specified time."
          exit 1

  create-draft:
    name: Create draft release
    needs: [verify-release, bump-sec-scanners-config]
    runs-on: ubuntu-latest
    env:
      VERSION: ${{ needs.verify-release.outputs.VERSION }}
    outputs:
      release_id: ${{ steps.create-draft.outputs.release_id }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Create changelog
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./scripts/create_changelog.sh $VERSION

      - name: Create draft release
        id: create-draft
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          RELEASE_ID=$(./scripts/create_draft_release.sh $VERSION)
          echo "release_id=$RELEASE_ID" >> $GITHUB_OUTPUT

      - name: Create lightweight tag
        run: |
          git tag $VERSION
          git push origin $VERSION

      - name: Verify job status
        run: ./scripts/verify-status.sh ${{ github.ref_name }} 600 10 30

      - name: Create and upload eventing-manager.yaml and eventing-default-cr.yaml
        env:
          PULL_BASE_REF: ${{ needs.verify-release.outputs.VERSION }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          IMG: "europe-docker.pkg.dev/kyma-project/prod/eventing-manager:${VERSION}"
          MODULE_REGISTRY: "europe-docker.pkg.dev/kyma-project/prod/unsigned"
          KUSTOMIZE_VERSION: "v4.5.6"
        run: |
          ./scripts/render_and_upload_manifests.sh

  publish-release:
    name: Publish release
    if: ${{ !inputs.DRY_RUN }}
    needs: [verify-release, create-draft]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Publish release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./scripts/publish_release.sh ${{ needs.create-draft.outputs.release_id }}