constellation/.github/workflows/release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to release (e.g. v1.2.3)"
        required: true
      kind:
        description: "Release kind"
        type: choice
        options: [minor, patch]
        required: true
        default: "minor"

jobs:
  verify-inputs:
    name: Verify inputs
    runs-on: ubuntu-22.04
    env:
      FULL_VERSION: ${{ inputs.version }}
    outputs:
      WITHOUT_V: ${{ steps.version-info.outputs.WITHOUT_V }}
      PART_MAJOR: ${{ steps.version-info.outputs.PART_MAJOR }}
      PART_MINOR: ${{ steps.version-info.outputs.PART_MINOR }}
      PART_PATCH: ${{ steps.version-info.outputs.PART_PATCH }}
      MAJOR: ${{ steps.version-info.outputs.MAJOR }}
      MAJOR_MINOR: ${{ steps.version-info.outputs.MAJOR_MINOR }}
      MAJOR_MINOR_PATCH: ${{ steps.version-info.outputs.MAJOR_MINOR_PATCH }}
      RELEASE_BRANCH: ${{ steps.version-info.outputs.RELEASE_BRANCH }}
    steps:
      - name: Verify version
        run: |
          if [[ ! "${FULL_VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Version must be in the form of vX.Y.Z"
            exit 1
          fi

      - name: Extract version info
        id: version-info
        run: |
          WITHOUT_V=${FULL_VERSION#v}
          PART_MAJOR=${WITHOUT_V%%.*}
          PART_MINOR=${WITHOUT_V#*.}
          PART_MINOR=${PART_MINOR%%.*}
          PART_PATCH=${WITHOUT_V##*.}
          {
            echo "WITHOUT_V=${WITHOUT_V}"
            echo "PART_MAJOR=${PART_MAJOR}"
            echo "PART_MINOR=${PART_MINOR}"
            echo "PART_PATCH=${PART_PATCH}"
            echo "MAJOR=${PART_MAJOR}"
            echo "MAJOR_MINOR=${PART_MAJOR}.${PART_MINOR}"
            echo "MAJOR_MINOR_PATCH=${PART_MAJOR}.${PART_MINOR}.${PART_PATCH}"
            echo "RELEASE_BRANCH=release/v${PART_MAJOR}.${PART_MINOR}"
          } | tee -a "$GITHUB_OUTPUT"

  docs:
    name: Create docs release
    runs-on: ubuntu-22.04
    if: inputs.kind == 'minor'
    needs: verify-inputs
    permissions:
      contents: write
      pull-requests: write
    env:
      VERSION: ${{ inputs.version }}
      MAJOR_MINOR: ${{ needs.verify-inputs.outputs.MAJOR_MINOR }}
      BRANCH: docs/${{ needs.verify-inputs.outputs.MAJOR_MINOR }}
    steps:
      - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
        with:
          ref: ${{ github.head_ref }}

      - name: Create docs release
        working-directory: docs
        run: |
          npm install
          npm run docusaurus docs:version "${MAJOR_MINOR}"

      - name: Create docs pull request
        uses: peter-evans/create-pull-request@38e0b6e68b4c852a5500a94740f0e535e0d7ba54 # v4.2.4
        with:
          branch: ${{ env.BRANCH }}
          base: main
          title: "docs: add release ${{ env.VERSION }}"
          body: |
            :robot: *This is an automated PR.* :robot:

            The PR is triggered as part of the automated release process of version ${{ env.VERSION }}.
            It releases a new version of the documentation.
          commit-message: "docs: add release ${{ env.VERSION }}"
          committer: edgelessci <edgelessci@users.noreply.github.com>
          labels: no changelog
          # We need to push changes using a token, otherwise triggers like on:push and on:pull_request won't work.
          token: ${{ !github.event.pull_request.head.repo.fork && secrets.CI_COMMIT_PUSH_PR || '' }}

  prepare-release-branch:
    name: Prepare release branch
    runs-on: ubuntu-22.04
    needs: verify-inputs
    permissions:
      contents: write
    env:
      BRANCH: ${{ needs.verify-inputs.outputs.RELEASE_BRANCH }}
    steps:
      - name: Checkout
        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
        with:
          ref: ${{ github.head_ref }}

      - name: Create release branch
        if: inputs.kind == 'minor'
        run: |
          git fetch
          git pull
          git checkout "${BRANCH}" || git checkout -B "${BRANCH}"
          git push origin "${BRANCH}"

      - name: Write version to version.txt
        run: |
          echo "${{ inputs.version }}" > version.txt
          git config --global user.name "edgelessci"
          git config --global user.email "edgelessci@users.noreply.github.com"
          git add version.txt
          git diff --staged --quiet || git commit -m "chore: update version.txt to ${{ inputs.version }}"
          git push origin "${BRANCH}"

  update-versions:
    name: Update container image versions
    needs: [verify-inputs, prepare-release-branch]
    runs-on: ubuntu-22.04
    permissions:
      contents: write
      packages: read
    env:
      VERSION: ${{ inputs.version }}
      WITHOUT_V: ${{ needs.verify-inputs.outputs.WITHOUT_V }}
    steps:
      - name: Checkout
        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
        with:
          ref: ${{ needs.verify-inputs.outputs.RELEASE_BRANCH }}

      - name: Update enterprise image version
        run: |
          sed -i "s/defaultImage = \"v[0-9]\+\.[0-9]\+\.[0-9]\+\"/defaultImage = \"${VERSION}\"/" internal/config/images_enterprise.go
          git add internal/config/images_enterprise.go

      - name: Commit
        run: |
          git config --global user.name "edgelessci"
          git config --global user.email "edgelessci@users.noreply.github.com"
          git commit -m "deps: update images to ${VERSION}"
          git push

  os-image:
    name: Build OS image
    needs: [verify-inputs, update-versions]
    uses: ./.github/workflows/build-os-image.yml
    permissions:
      id-token: write
      contents: read
      packages: read
    secrets: inherit
    with:
      imageVersion: ${{ inputs.version }}
      isRelease: true
      stream: "stable"
      ref: ${{ needs.verify-inputs.outputs.RELEASE_BRANCH }}

  update-hardcoded-measurements:
    name: Update hardcoded measurements (in the CLI)
    needs: [verify-inputs, os-image]
    permissions:
      contents: write
    runs-on: ubuntu-22.04
    env:
      VERSION: ${{ inputs.version }}
      WITHOUT_V: ${{ needs.verify-inputs.outputs.WITHOUT_V }}
    steps:
      - name: Checkout
        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
        with:
          ref: ${{ needs.verify-inputs.outputs.RELEASE_BRANCH }}

      - name: Setup Go environment
        uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
        with:
          go-version: "1.20.3"
          cache: true

      - name: Build generateMeasurements tool
        working-directory: internal/attestation/measurements/measurement-generator
        run: go build -o generate -tags=enterprise .

      - name: Update hardcoded measurements
        working-directory: internal/attestation/measurements
        run: |
          ./measurement-generator/generate
          git add measurements_enterprise.go

      - name: Commit
        run: |
          git config --global user.name "edgelessci"
          git config --global user.email "edgelessci@users.noreply.github.com"
          git commit -m "attestation: hardcode measurements for ${VERSION}"
          git push

  tag-release:
    name: Tag release
    needs: [verify-inputs, update-hardcoded-measurements]
    runs-on: ubuntu-22.04
    permissions:
      contents: write
    env:
      VERSION: ${{ inputs.version }}
    steps:
      - name: Checkout
        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
        with:
          ref: ${{ needs.verify-inputs.outputs.RELEASE_BRANCH }}

      - name: Tag release
        run: |
          git config --global user.name "edgelessci"
          git config --global user.email "edgelessci@users.noreply.github.com"
          git tag -a "${VERSION}" -m "Release ${VERSION}"
          git push origin "refs/tags/${VERSION}"

  draft-release-cli:
    name: Draft release (CLI)
    needs: [verify-inputs, tag-release]
    uses: ./.github/workflows/release-cli.yml
    permissions:
      actions: read
      contents: write
      id-token: write
      packages: write
    secrets: inherit
    with:
      ref: "refs/tags/${{ inputs.version }}"