create-release.yml

name: Create release
on:
  pull_request:
    branches:
      - master
      - release-**-**
    types: [ closed ]

permissions:
  contents: write
  packages: write
  actions: read
  pull-requests: read

env:
  REGISTRY: ghcr.io
  # Common versions
  GO_VERSION: '1.22'

jobs:
  check-tag:
    if: github.event.pull_request.merged == true && contains(github.event.pull_request.title, 'update manifest and helm charts')
    runs-on: ubuntu-latest
    outputs:
      release-tag: ${{ steps.set-tags.outputs.release-tag }}
      init-tag: ${{ steps.set-tags.outputs.init-tag }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          fetch-depth: 0

      - id: set-tags
        name: set-tags
        run: |
          echo "release-tag=$(echo ${{ github.event.pull_request.head.ref }} | tr '-' '\n' | grep 'v[0-9]\.[0-9]\.[0-9]' | head -n 1)" >> $GITHUB_OUTPUT
          echo "init-tag=$(echo ${{ github.event.pull_request.head.ref }} | tr '-' '\n' | grep -E '^[0-9]\.[0-9]\.[0-9]$' | head -n 1)" >> $GITHUB_OUTPUT

      - id: check-tag
        name: Check for Tag
        run: |
          if git show-ref --tags --verify --quiet "refs/tags/${{ steps.set-tags.outputs.release-tag }}"; then
            echo "create_tag=$(echo 'false' )" >> $GITHUB_OUTPUT
          else
            echo "create_tag=$(echo 'true' )" >> $GITHUB_OUTPUT
          fi

      - name: 'Create tag'
        if:  steps.check-tag.outputs.create_tag == 'true'
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.git.createRef({
              owner: context.repo.owner,
              repo: context.repo.repo,
              ref: 'refs/tags/${{ steps.set-tags.outputs.release-tag }}',
              sha: context.sha
            })

  create-release:
    runs-on: ubuntu-latest
    needs:
      - check-tag
    steps:
      - name: Set up Go ${{ env.GO_VERSION }}
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION  }}

      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: true
          fetch-depth: 0
          ref: ${{ needs.check-tag.outputs.release-tag }}

      - name: Goreleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          version: latest
          args: release --clean --timeout 60m --verbose
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GORELEASER_CURRENT_TAG:  ${{ needs.check-tag.outputs.release-tag }}

  export-registry:
    runs-on: ubuntu-latest
    outputs:
      registry: ${{ steps.export.outputs.registry }}
    steps:
      - id: export
        run: |
          # registry must be in lowercase
          echo "::set-output name=registry::$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr [:upper:] [:lower:])"

  publish-image:
    needs:
      - check-tag
      - export-registry
    uses: ./.github/workflows/publish-image.yml
    with:
      registry: ${{ needs.export-registry.outputs.registry }}
      release_version: ${{ needs.check-tag.outputs.release-tag }}

  publish-init-validation-image:
    needs:
      - check-tag
      - export-registry
    uses: ./.github/workflows/publish-init-container-image.yml
    with:
      registry: ${{ needs.export-registry.outputs.registry }}
      release_version: ${{ needs.check-tag.outputs.release-tag }}
      init_container_version: ${{ needs.check-tag.outputs.init-tag }}