constellation/.github/workflows/on-release.yml

name: Make updated OS images available on release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: "Semantic version tag of the release (vX.Y.Z)."
        required: true
      latest:
        description: "Whether to update the latest tag."
        type: boolean
        default: false

jobs:
  complete-release-branch-transaction:
    runs-on: ubuntu-22.04
    permissions:
      id-token: write
      contents: write
    env:
      FULL_VERSION: ${{ github.event.release.tag_name }}${{ github.event.inputs.tag }}
    outputs:
      RELEASE_BRANCH: ${{ env.RELEASE_BRANCH }}
      WORKING_BRANCH: ${{ env.WORKING_BRANCH }}
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          fetch-depth: 0 # fetch all history

      - name: Determine branch names
        run: |
          RELEASE_BRANCH="release/${FULL_VERSION%.*}"
          WORKING_BRANCH="tmp/${FULL_VERSION}"
          echo "RELEASE_BRANCH=${RELEASE_BRANCH}" | tee -a "$GITHUB_ENV"
          echo "WORKING_BRANCH=${WORKING_BRANCH}" | tee -a "$GITHUB_ENV"

      - name: Create or update release branch
        run: |
          git fetch
          git checkout "${WORKING_BRANCH}" # ensure branch exists locally
          git push origin "${WORKING_BRANCH}":"${RELEASE_BRANCH}"

  update:
    runs-on: ubuntu-22.04
    outputs:
      latest: ${{ steps.input-passthrough.outputs.latest }}${{ steps.check-last-release.outputs.latest }}
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Override latest
        if: github.event.inputs.latest == 'true'
        id: input-passthrough
        run: echo "latest=true" | tee -a "$GITHUB_OUTPUT"

      - name: Check if should mark latest
        if: github.event.inputs.latest != 'true'
        id: check-last-release
        env:
          REPO: edgelesssys/constellation
          GH_TOKEN: ${{ github.token }}
        run: |
          latest_release_tag=$(
            gh api \
              -H "Accept: application/vnd.github+json" \
              "/repos/${REPO}/releases/latest" \
            | jq -r '.tag_name'
          )

          current_tag=${{ github.event.release.tag_name }}${{ github.event.inputs.tag }}
          echo "Latest release tag: ${latest_release_tag}"
          echo "Current tag: ${current_tag}"

          if [[ "${latest_release_tag}" == "${current_tag}" ]]; then
            echo "latest=true" | tee -a "$GITHUB_OUTPUT"
          else
            echo "latest=false" | tee -a "$GITHUB_OUTPUT"
          fi

  add-image-version-to-versionsapi:
    needs: [update]
    name: "Add image version to versionsapi"
    permissions:
      contents: read
      id-token: write
    uses: ./.github/workflows/versionsapi.yml
    with:
      command: add
      add_release: true
      stream: stable
      version: ${{ github.event.release.tag_name }}${{ github.event.inputs.tag }}
      kind: image
      add_latest: ${{ needs.update.outputs.latest == 'true' }}

  add-cli-version-to-versionsapi:
    needs: [update, add-image-version-to-versionsapi] # run workflow calls after each other
    name: "Add CLI version to versionsapi"
    permissions:
      contents: read
      id-token: write
    uses: ./.github/workflows/versionsapi.yml
    with:
      command: add
      add_release: true
      stream: stable
      version: ${{ github.event.release.tag_name }}${{ github.event.inputs.tag }}
      kind: cli
      add_latest: ${{ needs.update.outputs.latest == 'true' }}

  remove-temporary-branch:
    needs:
      [
        complete-release-branch-transaction,
        add-image-version-to-versionsapi,
        add-cli-version-to-versionsapi,
      ]
    runs-on: ubuntu-22.04
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Remove temporary branch
        env:
          WORKING_BRANCH: ${{needs.complete-release-branch-transaction.outputs.WORKING_BRANCH}}
        run: git push origin --delete "${WORKING_BRANCH}"