create-release.yaml

name: create release

on:
  workflow_dispatch:
    inputs:
      name:
        description: 'Release name ( e.g. "2.1.3" )'
        default: ""
        required: true
      latest_release:
        description: 'Latest release'
        type: boolean
        default: false

permissions: # used by build images steps
  id-token: write # This is required for requesting the JWT token
  contents: write # This is required for actions/checkout

jobs:
  verify-head-status:
    name: Verify HEAD
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Verify github actions
        run: ./.github/scripts/verify-actions-status.sh ${{ github.ref_name }}

  upgrade-images:
    name: Upgrade main images
    needs: verify-head-status
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.BOT_TOKEN }}
          fetch-depth: 0
      
      - name: Bump sec-scanners-config.yaml
        run: ./.github/scripts/upgrade-sec-scanners-config.sh
        env:
          IMG_VERSION: ${{ github.event.inputs.name }}
      
      - name: Bump values.yaml
        run: |
          make replace-chart-images
        env:
          IMG_DIRECTORY: "prod"
          IMG_VERSION: ${{ github.event.inputs.name }}
      
      - name: Bump chart version
        run: ./.github/scripts/upgrade-chart-version.sh
        env:
          CHART_VERSION: ${{ github.event.inputs.name }}
      
      - name: Commit&Push
        run: |
          git config --local user.email "otter-releaser@otter-releaser.noreply.github.com"
          git config --local user.name "otter-releaser"

          git add .
          git commit --allow-empty -m "upgrade dependencies"
          git push origin ${{ github.ref_name }}

  create-tag:
    name: Create tag
    needs: upgrade-images
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.ref_name }}  # Checkout to latest branch changes

      - name: Create tag
        run: |
          git tag ${{ github.event.inputs.name }}
          git push origin ${{ github.event.inputs.name }}

  builds:
    needs: create-tag
    uses: ./.github/workflows/_build.yaml
    with:
      tag: "${{ github.event.inputs.name }}"

  create-draft:
    name: Create draft release
    needs: builds
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.ref_name }}

      - name: Create draft release
        id: create-draft
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          RELEASE_ID=$(./.github/scripts/create-draft-release.sh ${{ github.event.inputs.name }})
          echo "release_id=$RELEASE_ID" >> $GITHUB_OUTPUT

      - name: Create release assets
        id: create-assets
        env:
          PULL_BASE_REF: ${{ github.event.inputs.name }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_ID: ${{ steps.create-draft.outputs.release_id }}
        run: ./.github/scripts/release.sh

    outputs:
      release_id: ${{ steps.create-draft.outputs.release_id }}

  run-integration-test:
    needs: create-draft
    uses: ./.github/workflows/_integration-tests.yaml
    with:
      directory-version: prod
      image-version: ${{ github.event.inputs.name }}

  publish-release:
    name: Publish release
    needs: [run-integration-test, create-draft]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.inputs.name }} 
          
      - name: Publish release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./.github/scripts/publish-release.sh ${{ needs.create-draft.outputs.release_id }} ${{ github.event.inputs.latest_release }}