release.yml

name: release

on:
  push:
    tags:
      - 'v*'
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: write
  packages: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

env:
  REGISTRY: ghcr.io
  REPO: rossoctl/operator
  CHARTS_PATH: ./charts

jobs:
  # Build the two images in parallel, one matrix instance per image.
  # Each instance carries its own buildx cache scope so warm builds
  # only re-pull what changed for that image.
  build-and-push:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        image_config:
          - name: rossoctl-operator
            context: ./operator
            dockerfile: ./operator/Dockerfile
          - name: agentcard-signer
            context: ./operator
            dockerfile: ./operator/cmd/agentcard-signer/Dockerfile
    steps:
    - name: Checkout
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

    - name: Set up QEMU
      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4

    - name: Log in to ghcr.io
      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract Docker metadata
      id: meta
      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302  # v6
      with:
        images: ${{ env.REGISTRY }}/${{ github.repository }}/${{ matrix.image_config.name }}
        tags: |
          type=sha,prefix={{branch}}-,enable={{is_default_branch}}
          type=raw,value=latest,enable={{is_default_branch}}
          type=semver,pattern={{version}}

    - name: Build and push ${{ matrix.image_config.name }}
      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7
      with:
        context: ${{ matrix.image_config.context }}
        file: ${{ matrix.image_config.dockerfile }}
        push: true
        platforms: linux/amd64,linux/arm64
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        # GitHub Actions cache, scoped per image so the two parallel
        # matrix jobs don't trample each other.
        cache-from: type=gha,scope=${{ matrix.image_config.name }}
        cache-to: type=gha,mode=max,scope=${{ matrix.image_config.name }}

  # Release-only steps (helm chart packaging + GitHub Release). Runs
  # once after both image builds complete, only on tag pushes.
  release:
    needs: build-and-push
    if: github.ref_type == 'tag'
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

    - name: Set up Helm
      uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310  # v5.0.1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Install yq
      uses: mikefarah/yq@c14f446382944492701b16c1ddb48bb9dbe683e3  # v4

    - name: Log in to ghcr.io
      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Guard — injected AuthBridge images must be version-pinned (no floating tags)
      # release.yml pins the controller-manager image (below) but NOT the cortex-built
      # AuthBridge injection images; they were shipping at :latest (rossoctl/rossoctl#508).
      # Positive assertion (tighter than a deny-list, which passes untagged/:dev/etc):
      # every injection image must carry a :vX.Y.Z tag — in BOTH the chart values and
      # the compiled Go fallbacks (config/defaults.go), which loader.go overlays the
      # platform-config ConfigMap on top of, so a no-ConfigMap deploy (kustomize
      # `make deploy`, webhook.enable=false) would otherwise still inject :latest.
      # This is a release-time backstop; the same check runs per-PR in security-scans.yaml.
      run: |
        set -euo pipefail
        fail=0
        for k in envoyProxy authbridge authbridgeLite proxyInit; do
          img=$(yq ".defaults.images.$k" ${{ env.CHARTS_PATH }}/operator/values.yaml)
          if [[ ! "$img" =~ :v[0-9]+\.[0-9]+\.[0-9]+ ]]; then
            echo "::error::defaults.images.$k not version-pinned in values.yaml: $img"
            fail=1
          fi
        done
        while IFS= read -r img; do
          if [[ ! "$img" =~ :v[0-9]+\.[0-9]+\.[0-9]+ ]]; then
            echo "::error::compiled default not version-pinned in config/defaults.go: $img"
            fail=1
          fi
        done < <(grep -oE 'ghcr\.io/rossoctl/cortex/[a-z-]+:[^"]+' operator/internal/webhook/config/defaults.go)
        if [ "$fail" -ne 0 ]; then
          echo "::error::pin the flagged AuthBridge injection image(s) to a cortex release tag before releasing (rossoctl/rossoctl#508)"
          exit 1
        fi
        echo "AuthBridge injection images are version-pinned OK (values.yaml + config/defaults.go)"

    - name: Package and push Helm chart
      run: |
        chartVersion=$(echo "${{ github.ref_name }}" | cut -c 2-)
        chartPackageName="operator-chart-${chartVersion}.tgz"
        cd ${{ env.CHARTS_PATH }}/operator
        yq -i '.controllerManager.container.image.tag = strenv(chartVersion)' values.yaml
        yq -i '.controllerManager.container.image.pullPolicy = "IfNotPresent"' values.yaml
        helm package . --destination . --version "${chartVersion}" --app-version "${chartVersion}"
        helm push "./${chartPackageName}" oci://${{ env.REGISTRY }}/${{ env.REPO }}

    - name: Create GitHub Release
      run: |
        # Idempotent: the release may have been pre-created out of band
        # (e.g., a maintainer ran `gh release create` before pushing the
        # tag for custom notes). Use `gh release view` to short-circuit
        # rather than grepping stderr from `gh release create` — that
        # text is locale-dependent and a moving target across gh
        # versions.
        if gh release view "${{ github.ref_name }}" >/dev/null 2>&1; then
          echo "Release ${{ github.ref_name }} already exists; skipping create."
        else
          gh release create "${{ github.ref_name }}" --generate-notes
        fi
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  e2e-helm-install:
    needs: build-and-push
    if: github.ref_type != 'tag'
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

    - name: Create Kind cluster
      uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc  # v1

    - name: Install cert-manager
      run: |
        kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.17.2/cert-manager.yaml
        kubectl -n cert-manager rollout status deployment/cert-manager --timeout=90s
        kubectl -n cert-manager rollout status deployment/cert-manager-webhook --timeout=90s
        kubectl -n cert-manager rollout status deployment/cert-manager-cainjector --timeout=90s

    - name: Install Helm chart
      # The chart's values.yaml ships with `tag: __PLACEHOLDER__`, which
      # the release job substitutes only on tag pushes. On main pushes
      # we override to `:latest` (which the build-and-push job just
      # tagged) so the rendered Deployment can actually pull an image.
      run: |
        helm install rossoctl-operator ./charts/operator \
          --set controllerManager.container.image.tag=latest

    - name: Wait for deployment rollout
      run: |
        kubectl rollout status deployment/rossoctl-controller-manager \
          --timeout=120s

    - name: Verify operator pod is Running and Ready
      run: |
        kubectl wait pods \
          -l control-plane=controller-manager \
          --for=condition=Ready \
          --timeout=60s
        kubectl get pods -l control-plane=controller-manager