release_github

Author: lantoli

.github/workflows/release.yml

@@ -85,3 +85,88 @@ jobs:
         id: extract-version
         if: ${{ failure() }}
         run: echo "VERSION=$(cat dist/version.txt)" >> "${GITHUB_OUTPUT}"
+
+
+  release_github:
+    name: Publish to GitHub Releases
+    needs: [release, release_npm]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+    steps:
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
+        with:
+          node-version: 18.x
+      - name: Download build artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
+        with:
+          name: build-artifact
+          path: dist
+      - name: Restore build artifact permissions
+        run: cd dist && setfacl --restore=permissions-backup.acl
+        continue-on-error: true
+      - name: Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_REF: ${{ github.ref }}
+        run: errout=$(mktemp); gh release create "$(cat dist/releasetag.txt)" -R "${GITHUB_REPOSITORY}" -F dist/changelog.md -t "$(cat dist/releasetag.txt)" --target "${GITHUB_REF}" 2> "$errout" && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" "$errout"; then cat "$errout"; exit $exitcode; fi
+      - name: Extract Version
+        id: extract-version
+        if: ${{ failure() }}
+        run: echo "VERSION=$(cat dist/version.txt)" >> "${GITHUB_OUTPUT}"
+      - name: Generate PURL and SBOM
+        run: |
+          ./scripts/compliance/gen-purls.sh
+          ./scripts/compliance/gen-sbom.sh
+        env:
+          SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }}
+      - name: Upload SBOM to Kondukto
+        run: ./scripts/compliance/upload-sbom.sh
+        env:
+          KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }}
+          SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }}
+          KONDUKTO_REPO: ${{ vars.KONDUKTO_REPO }}
+          KONDUKTO_BRANCH_PREFIX: ${{ vars.KONDUKTO_BRANCH_PREFIX }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      - name: Generate SSDLC report
+        run: |
+          AUTHOR="${{ github.actor }}"
+          export AUTHOR
+          VERSION="${{ steps.extract-version.outputs.VERSION }}"
+          export VERSION
+          ./scripts/compliance/gen-ssdlc-report.sh
+        env:
+          KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }}
+          SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }}
+          KONDUKTO_REPO: ${{ vars.KONDUKTO_REPO }}
+          KONDUKTO_BRANCH_PREFIX: ${{ vars.KONDUKTO_BRANCH_PREFIX }}
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec
+        with:
+          gpg_private_key: ${{ secrets.APIX_BOT_GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.APIX_BOT_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+      - name: Commit changes
+        shell: bash
+        run: |
+          if [[ $(git status --porcelain) ]]; then
+            git pull
+            git config --local user.email [email protected]
+            git config --local user.name svc-apix-bot
+            git remote set-url origin https://svc-apix-bot:${{ secrets.APIX_BOT_PAT }}@github.com/${{ github.repository }}
+            git add compliance/v*/*
+            git commit -m "chore: Update SSDLC report for ${{ steps.extract-version.outputs.VERSION }}"
+            git push origin
+          else
+            echo "No changes to commit."
+          fi
+      - name: Upload SBOM as release artifact
+        uses: softprops/action-gh-release@6cbd405e2c4e67a21c47fa9e383d020e4e28b836
+        with:
+          files: compliance/sbom.json
+          tag_name: ${{ steps.extract-version.outputs.VERSION }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}