create-release.yml

name: "Create release"

on:
  workflow_dispatch:
jobs:
  generate-version:
    name: Verify release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.gen-version.outputs.VERSION }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Generate version number
        id: gen-version
        run: |
          VERSION="$(./hack/ci/get-version-from-branch.sh)"
          # push version to output environment file
          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT

  bump-sec-scanners-config:
    name: Bump sec-scanners-config.yaml
    needs: generate-version
    runs-on: ubuntu-latest
    env:
      VERSION: ${{ needs.generate-version.outputs.VERSION }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: "Setup yq" # Required for rendering the files.
        shell: bash
        run: |
          go install github.com/mikefarah/yq/v4@latest
          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH

      - name: Render sec-scanners-config.yaml
        shell: bash
        run: |
          yq --version
          ./hack/ci/render-sec-scanners-config.sh "${VERSION}"

      - name: Bump kustomize file
        shell: bash
        run: |
          ./hack/ci/bump-kustomize-file.sh "${VERSION}"

      # Check if there are changes so we can determin if all following steps can be skipped.
      - name: Check for changes
        shell: bash
        run: |
          if [ -z "$(git status --porcelain)" ]; then 
            echo "No changes found. No need to create a PR" 
          else 
            echo "Changes found. Creating a PR and waiting for it to be merged."
            echo "CREATE_PR=true" >> $GITHUB_ENV 
          fi

      - name: Print out sec-scanners-config.yaml
        if: ${{ always() }}
        shell: bash
        run: |
          FILE="sec-scanners-config.yaml"
          [ -f "${FILE}" ] && cat "${FILE}" || echo "${FILE} not found."

      - name: Print out kustomize file
        if: ${{ always() }}
        shell: bash
        run: |
          FILE="config/manager/kustomization.yaml"
          [ -f "${FILE}" ] && cat "${FILE}" || echo "${FILE} not found."

      - name: Set up git
        if: ${{ env.CREATE_PR == 'true' }}
        env:
          GH_TOKEN: ${{ secrets.BOT_PAT }}
          REPO: ${{ github.repository }}
        shell: bash
        run: |
          # set git username 
          ghusername=$(curl -s -H "Authorization: token ${GH_TOKEN}" https://api.github.com/user | jq '.login')
          git config user.name "${ghusername}"
          # set git mail address
          ghemailaddress="${ghusername}@users.noreply.github.com"
          git config user.email "${ghemailaddress}"
          # set remote url
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git"

      - name: Set all variables
        if: ${{ env.CREATE_PR == 'true' }}
        shell: bash
        run: |
          CURRENT_BRANCH="$(git rev-parse --abbrev-ref HEAD)"
          echo "current branch: ${CURRENT_BRANCH}"
          echo "CURRENT_BRANCH=${CURRENT_BRANCH}" >> $GITHUB_ENV

          PR_DATE="$(date '+%Y-%m-%d-%H-%M-%S')"
          echo "pr date: ${PR_DATE}"
          echo "PR_DATE=${PR_DATE}" >> $GITHUB_ENV

          BRANCH_NAME="sec-scanners-bump-${CURRENT_BRANCH}-${PR_DATE}"
          echo "name of the new branch: ${BRANCH_NAME}"
          echo "BRANCH_NAME=${BRANCH_NAME}" >> $GITHUB_ENV

      - name: Create a pull request
        if: ${{ env.CREATE_PR == 'true' }}
        env:
          REPO: ${{ github.repository }}
          CURRENT_BRANCH: ${{ env.CURRENT_BRANCH }}
          PR_DATE: ${{ env.PR_DATE }}
          BRANCH_NAME: ${{ env.BRANCH_NAME }}
          GH_TOKEN: ${{ secrets.BOT_PAT }}
        shell: bash
        run: |
          # Create a new branch for our changes.
          git checkout -b "${BRANCH_NAME}"

          # Stage the changes to sec-scanner-config.yaml and create a commit.
          git add sec-scanners-config.yaml
          git commit -m "auto-bump sec-scanners-config: ${PR_DATE}"

          git add "config/manager/kustomization.yaml"
          git commit -m "auto-bump kustomization file: ${PR_DATE}"

          # Push the changes to origin, as defined earlier.
          git push origin "$BRANCH_NAME"

          # Create a PR.
          BODY="This is an auto-generated PR to bump the sec-scanners-config.yml and kustomization on ${REPO}."
          PR_URL=$(gh pr create --base "${CURRENT_BRANCH}" --head "${BRANCH_NAME}" --title "Bump sec-scanners-config and kustomization on ${CURRENT_BRANCH}" --body "${BODY}")
          echo "PR_URL=${PR_URL}" >> $GITHUB_ENV

      - name: USER INTERACTION REQUIRED
        if: ${{ env.CREATE_PR == 'true' }}
        shell: bash
        env:
          PR_URL: ${{ env.PR_URL }}
        run: |
          echo "please review  ${PR_URL}"

      - name: Wait for PR to be merged
        if: ${{ env.CREATE_PR == 'true' }}
        shell: bash
        env:
          PR_URL: ${{ env.PR_URL }}
          GH_TOKEN: ${{ secrets.BOT_PAT }}
        run: |
          end_time=$((SECONDS+3600)) # 1 hour

          while [ $SECONDS -lt $end_time ]; do
            pr_state=$(gh pr view ${PR_URL} --json state --jq '.state')
            if [ "$pr_state" == "CLOSED" ]; then 
              echo "ERROR! PR has been closed!"
              exit 1
            elif [ "$pr_state" == "MERGED" ]; then
              echo "PR has been merged!"
              exit 0
            fi
            sleep 10
          done

          echo "Timeout reached. PR not merged within the specified time."
          exit 1

  create-draft:
    name: Create draft release
    needs: [generate-version, bump-sec-scanners-config]
    runs-on: ubuntu-latest
    env:
      VERSION: ${{ needs.generate-version.outputs.VERSION }}
    outputs:
      release_id: ${{ steps.create-draft.outputs.release_id }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.BOT_PAT }} # creating git tag using bot token because GITHUB_TOKEN would not trigger build workflow (https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow).

      - name: Create changelog
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./hack/ci/create_changelog.sh $VERSION

      - name: Create draft release
        id: create-draft
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          RELEASE_ID=$(./hack/ci/create_draft_release.sh $VERSION)
          echo "release_id=$RELEASE_ID" >> $GITHUB_OUTPUT

      - name: Add lightweight tag to trigger release build job
        env:
          GITHUB_TOKEN: ${{ secrets.BOT_PAT }} # creating git tag using bot token because GITHUB_TOKEN would not trigger build workflow (https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow).
        run: |
          # The build job will be triggered by pushing a new tag (format: x.y.z) to the repo.
          git tag $VERSION
          git push origin $VERSION

      - name: Create and upload eventing-manager.yaml and eventing-default-cr.yaml
        env:
          PULL_BASE_REF: ${{ needs.generate-version.outputs.VERSION }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          IMG: "europe-docker.pkg.dev/kyma-project/prod/eventing-manager:${VERSION}"
          MODULE_REGISTRY: "europe-docker.pkg.dev/kyma-project/prod/unsigned"
          KUSTOMIZE_VERSION: "v4.5.6"
        run: |
          ./hack/ci/render_and_upload_manifests.sh

  wait-until-build-succeeds:
    needs: [generate-version, create-draft]
    uses: "kyma-project/eventing-tools/.github/workflows/wait-build-reusable.yml@main"
    with:
      repository: ${{ github.repository_owner }}/eventing-manager
      git_ref: ${{ needs.generate-version.outputs.VERSION }}
      git_check_run_name: "build-${{ needs.generate-version.outputs.VERSION }} / Build image"

  bump-sec-scanners-config-main:
    name: Bump sec-scanners-config.yaml on main branch
    needs: 
      - create-draft
      - generate-version
      - wait-until-build-succeeds
    runs-on: ubuntu-latest
    env:
      VERSION: ${{ needs.generate-version.outputs.VERSION }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: main

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: "Setup yq" # Required for rendering the files.
        shell: bash
        run: |
          go install github.com/mikefarah/yq/v4@latest
          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH

      - name: Render sec-scanners-config.yaml
        shell: bash
        run: |
          yq --version
          ./hack/ci/render-sec-scanners-config.sh "${VERSION}"
          FILE="sec-scanners-config.yaml"
          echo "******* ${FILE} *******"
          [ -f "${FILE}" ] && cat "${FILE}" || echo "${FILE} not found."

      # Check if there are changes, so we can determine if all following steps can be skipped.
      - name: Check for changes
        shell: bash
        run: |
          if [ -z "$(git status --porcelain)" ]; then 
            echo "No changes found. No need to create a PR" 
          else 
            echo "Changes found. Creating a PR and waiting for it to be merged."
            echo "CREATE_PR=true" >> $GITHUB_ENV 
          fi

      - name: Set up git
        if: ${{ env.CREATE_PR == 'true' }}
        env:
          GH_TOKEN: ${{ secrets.BOT_PAT }}
          REPO: ${{ github.repository }}
        shell: bash
        run: |
          # set git username 
          ghusername=$(curl -s -H "Authorization: token ${GH_TOKEN}" https://api.github.com/user | jq '.login')
          git config user.name "${ghusername}"
          # set git mail address
          ghemailaddress="${ghusername}@users.noreply.github.com"
          git config user.email "${ghemailaddress}"
          # set remote url
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git"

      - name: Set all variables
        if: ${{ env.CREATE_PR == 'true' }}
        shell: bash
        run: |
          PR_DATE="$(date '+%Y-%m-%d-%H-%M-%S')"
          echo "pr date: ${PR_DATE}"
          echo "PR_DATE=${PR_DATE}" >> $GITHUB_ENV

          BRANCH_NAME="sec-scanners-bump-main-${PR_DATE}"
          echo "name of the new branch: ${BRANCH_NAME}"
          echo "BRANCH_NAME=${BRANCH_NAME}" >> $GITHUB_ENV

      - name: Create a pull request
        if: ${{ env.CREATE_PR == 'true' }}
        env:
          REPO: ${{ github.repository }}
          PR_DATE: ${{ env.PR_DATE }}
          BRANCH_NAME: ${{ env.BRANCH_NAME }}
          GH_TOKEN: ${{ secrets.BOT_PAT }}
        shell: bash
        run: |
          # Create a new branch for our changes.
          git checkout -b "${BRANCH_NAME}"

          # Stage the changes to sec-scanner-config.yaml and create a commit.
          git add sec-scanners-config.yaml
          git commit -m "auto-bump sec-scanners-config: ${PR_DATE}"

          # Push the changes to origin, as defined earlier.
          git push origin "$BRANCH_NAME"

          # Create a PR.
          BODY="This is an auto-generated PR to bump the sec-scanners-config.yml on ${REPO}."
          PR_URL=$(gh pr create --base "main" --head "${BRANCH_NAME}" --title "chore: bump sec-scanners-config on main" --body "${BODY}")
          echo "PR_URL=${PR_URL}" >> $GITHUB_ENV

      - name: USER INTERACTION REQUIRED
        if: ${{ env.CREATE_PR == 'true' }}
        shell: bash
        timeout-minutes: 60
        env:
          PR_URL: ${{ env.PR_URL }}
          GH_TOKEN: ${{ secrets.BOT_PAT }}
        run: |
          echo "please review:  ${PR_URL}"
          ./hack/ci/await-pr-merge.sh