flow-deploy-release-artifact.yaml

##
# Copyright (C) 2023-2024 Hedera Hashgraph, LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
##

name: "Deploy Release Artifact"
on:
  workflow_dispatch:
    inputs:
      dry-run-enabled:
        description: "Perform Dry Run"
        type: boolean
        required: false
        default: false

env:
  REGISTRY: ghcr.io

defaults:
  run:
    shell: bash

permissions:
  contents: write
  packages: write
  pages: write
  id-token: write
  issues: write
  pull-requests: write

jobs:
  prepare-release:
    name: Release / Prepare
    runs-on: solo-linux-medium
    outputs:
      version: ${{ steps.tag.outputs.version }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: 22

      - name: Install Semantic Release
        run: |
          npm install -g semantic-release@23.1.1 @semantic-release/git@10.0.1 @semantic-release/exec@6.0.3
          npm install -g conventional-changelog-conventionalcommits@7.0.2 @commitlint/cli@18.6.0 @commitlint/config-conventional@18.6.0
          npm install -g marked-mangle@1.1.6 marked-gfm-heading-id@3.1.2 semantic-release-conventional-commits@3.0.0

      - name: Calculate Next Version
        env:
          GITHUB_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
          GIT_AUTHOR_NAME: ${{ secrets.GIT_USER_NAME }}
          GIT_AUTHOR_EMAIL: ${{ secrets.GIT_USER_EMAIL }}
          GIT_COMMITTER_NAME: ${{ secrets.GIT_USER_NAME }}
          GIT_COMMITTER_EMAIL: ${{ secrets.GIT_USER_EMAIL }}
        run: npx semantic-release --dry-run

      - name: Extract Version
        id: tag
        run: |
          [[ "${{ github.event.inputs.dry-run-enabled }}" == true && ! -f VERSION ]] && echo -n "0.0.0-latest" > VERSION
          echo "version=$(cat VERSION | tr -d '[:space:]')" >> ${GITHUB_OUTPUT}

  publish-docker-image:
    name: Publish / Docker Image
    runs-on: solo-linux-medium
    needs:
      - prepare-release
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - name: Verify Version Variable is Populated
        run: |
          echo "version: ${{ needs.prepare-release.outputs.version }}"
          if [[ "${{ needs.prepare-release.outputs.version }}" == "" ]]; then
            echo "ERROR: version missing"
            exit 1
          fi

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Login to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Qemu
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Build Docker Image (ubi8-init-dind)
        uses: docker/build-push-action@601a80b39c9405e50806ae38af30926f9d957c47 # v6.19.1
        with:
          context: docker/ubi8-init-dind
          platforms: linux/amd64, linux/arm64
          push: ${{ github.event.inputs.dry-run-enabled != 'true' }}
          tags: ghcr.io/${{ github.repository }}/ubi8-init-dind:${{ needs.prepare-release.outputs.version }}

      - name: Build Docker Image (ubi8-init-java21)
        uses: docker/build-push-action@601a80b39c9405e50806ae38af30926f9d957c47 # v6.19.1
        with:
          context: docker/ubi8-init-java21
          platforms: linux/amd64, linux/arm64
          push: ${{ github.event.inputs.dry-run-enabled != 'true' }}
          tags: ghcr.io/${{ github.repository }}/ubi8-init-java21:${{ needs.prepare-release.outputs.version }}

      - name: Build Docker Image (ubi8-s6-java21)
        uses: docker/build-push-action@601a80b39c9405e50806ae38af30926f9d957c47 # v6.19.1
        with:
          context: docker/ubi8-s6-java21
          platforms: linux/amd64, linux/arm64
          push: ${{ github.event.inputs.dry-run-enabled != 'true' }}
          tags: ghcr.io/${{ github.repository }}/ubi8-s6-java21:${{ needs.prepare-release.outputs.version }}

      - name: Build Docker Image (ubi8-init-java25)
        uses: docker/build-push-action@601a80b39c9405e50806ae38af30926f9d957c47 # v6.19.1
        with:
          context: docker/ubi8-init-java25
          platforms: linux/amd64, linux/arm64
          push: ${{ github.event.inputs.dry-run-enabled != 'true' }}
          tags: ghcr.io/${{ github.repository }}/ubi8-init-java25:${{ needs.prepare-release.outputs.version }}

      - name: Build Docker Image (kubectl-bats)
        uses: docker/build-push-action@601a80b39c9405e50806ae38af30926f9d957c47 # v6.19.1
        with:
          context: docker/kubectl-bats
          platforms: linux/amd64, linux/arm64
          push: ${{ github.event.inputs.dry-run-enabled != 'true' }}
          tags: ghcr.io/${{ github.repository }}/kubectl-bats:${{ needs.prepare-release.outputs.version }}

      - name: Build Docker Image (backup-uploader)
        uses: docker/build-push-action@601a80b39c9405e50806ae38af30926f9d957c47 # v6.19.1
        with:
          context: docker/backup-uploader
          platforms: linux/amd64, linux/arm64
          push: ${{ github.event.inputs.dry-run-enabled != 'true' }}
          tags: ghcr.io/${{ github.repository }}/backup-uploader:${{ needs.prepare-release.outputs.version }}

  create-github-release:
    name: Github / Release
    runs-on: solo-linux-medium
    needs:
      - publish-docker-image
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
          token: ${{ secrets.GH_ACCESS_TOKEN }}

      - name: Install GnuPG Tools
        run: |
          if ! command -v gpg2 >/dev/null 2>&1; then
            echo "::group::Updating APT Repository Indices"
              sudo apt update
            echo "::endgroup::"
            echo "::group::Installing GnuPG Tools"
              sudo apt install -y gnupg2
            echo "::endgroup::"
          fi

      - name: Import GPG key
        id: gpg_key
        uses: step-security/ghaction-import-gpg@69c854a83c7f79463f8bdf46772ab09826c560cd # v6.3.1
        with:
          gpg_private_key: ${{ secrets.GPG_KEY_CONTENTS }}
          passphrase: ${{ secrets.GPG_KEY_PASSPHRASE }}
          git_config_global: true
          git_user_signingkey: true
          git_commit_gpgsign: true
          git_tag_gpgsign: false

      - name: Setup Node
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: 22

      - name: Install Semantic Release
        run: |
          npm install -g semantic-release@23.1.1 @semantic-release/git@10.0.1 @semantic-release/exec@6.0.3
          npm install -g conventional-changelog-conventionalcommits@7.0.2 @commitlint/cli@18.6.0 @commitlint/config-conventional@18.6.0
          npm install -g marked-mangle@1.1.6 marked-gfm-heading-id@3.1.2 semantic-release-conventional-commits@3.0.0

      - name: Publish Semantic Release
        env:
          GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
          GIT_AUTHOR_NAME: ${{ secrets.GIT_USER_NAME }}
          GIT_AUTHOR_EMAIL: ${{ secrets.GIT_USER_EMAIL }}
          GIT_COMMITTER_NAME: ${{ secrets.GIT_USER_NAME }}
          GIT_COMMITTER_EMAIL: ${{ secrets.GIT_USER_EMAIL }}
        if: ${{ github.event.inputs.dry-run-enabled != 'true' && !cancelled() && !failure() }}
        run: npx semantic-release --no-sign