release.yaml

name: release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: write      # create GitHub Release
  packages: write      # push to ghcr.io
  id-token: write      # cosign keyless + build provenance
  attestations: write  # build provenance attestation

env:
  REGISTRY: ghcr.io

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # OCI references must be lowercase; ${{ github.repository }} preserves
      # case (e.g. "Varashi/..."). docker CLI tolerates this silently, but
      # syft and other strict parsers reject it. Normalize once here.
      - name: Normalize names
        run: |
          echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
          echo "CHART_REPO=ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/charts" >> "$GITHUB_ENV"

      - name: Resolve version
        id: ver
        run: |
          tag="${GITHUB_REF_NAME}"
          version="${tag#v}"
          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
          echo "version=${version}" >> "$GITHUB_OUTPUT"

      - name: Extract CHANGELOG section
        id: changelog
        run: |
          version="${{ steps.ver.outputs.version }}"
          awk -v v="$version" '
            $0 ~ "^## \\[" v "\\]" { flag=1; next }
            flag && $0 ~ "^## \\[" { exit }
            flag { print }
          ' CHANGELOG.md > RELEASE_BODY.md
          if [ ! -s RELEASE_BODY.md ]; then
            echo "See [CHANGELOG.md](./CHANGELOG.md)." > RELEASE_BODY.md
          fi

      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3

      - name: Log in to ghcr.io
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest

      - name: Build and push (multi-arch)
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: true
          # SBOM is produced downstream by anchore/sbom-action and attached
          # as a cosign attestation, so skip the buildx-embedded SBOM to
          # avoid two different SBOMs against the same digest.
          sbom: false
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Cosign keyless sign
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        # All tags point at the same digest; sign the digest once rather
        # than re-signing it per tag.
        run: cosign sign --yes "${IMAGE}@${DIGEST}"

      - name: Generate SBOM (SPDX)
        uses: anchore/sbom-action@v0
        with:
          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
          format: spdx-json
          output-file: sbom.spdx.json
          upload-release-assets: false
          upload-artifact: false

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v2
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

      - name: Attach SBOM to image
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        run: |
          cosign attest --yes --predicate sbom.spdx.json \
            --type spdxjson \
            "${IMAGE}@${DIGEST}"

      - uses: azure/setup-helm@v4
        with:
          version: v3.16.3

      - name: Package Helm chart
        run: |
          version="${{ steps.ver.outputs.version }}"
          helm package chart/ \
            --version "${version}" \
            --app-version "${version}" \
            --destination .

      - name: Helm registry login
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" \
            | helm registry login ${{ env.REGISTRY }} \
                --username ${{ github.actor }} --password-stdin

      - name: Push Helm chart (OCI)
        id: chart_push
        run: |
          version="${{ steps.ver.outputs.version }}"
          # helm push prints "Digest: sha256:..." to stderr; tee to capture.
          helm push "gpu-node-vsphere-maintenance-controller-${version}.tgz" \
            "oci://${{ env.CHART_REPO }}" 2>&1 | tee push.log
          digest=$(awk '/^Digest: /{print $2}' push.log)
          if [ -z "$digest" ]; then
            echo "Failed to capture chart digest" >&2
            exit 1
          fi
          echo "digest=${digest}" >> "$GITHUB_OUTPUT"

      - name: Cosign keyless sign (chart)
        env:
          DIGEST: ${{ steps.chart_push.outputs.digest }}
          CHART_REF: ${{ env.CHART_REPO }}/gpu-node-vsphere-maintenance-controller
        run: cosign sign --yes "${CHART_REF}@${DIGEST}"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.ver.outputs.tag }}
          name: ${{ steps.ver.outputs.tag }}
          body_path: RELEASE_BODY.md
          draft: false
          prerelease: false
          files: |
            sbom.spdx.json
            gpu-node-vsphere-maintenance-controller-${{ steps.ver.outputs.version }}.tgz