release-candidate.yml

name: Release candidate

on:
  workflow_dispatch:
    inputs:
      rc_number:
        description: Positive RC sequence number
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: release-candidate-${{ github.ref }}
  cancel-in-progress: false

jobs:
  validate:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    outputs:
      version: ${{ steps.validate.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Validate release branch and RC number
        id: validate
        env:
          REF_NAME: ${{ github.ref_name }}
          RC_NUMBER: ${{ inputs.rc_number }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          [[ "$REF_NAME" =~ ^release/v([0-9]+\.[0-9]+\.[0-9]+)$ ]] || {
            echo "This workflow must run from release/vX.Y.Z." >&2
            exit 2
          }
          base_version="${BASH_REMATCH[1]}"
          [[ "$RC_NUMBER" =~ ^[1-9][0-9]*$ ]] || {
            echo "rc_number must be a positive integer." >&2
            exit 2
          }
          version="v$base_version-rc.$RC_NUMBER"
          if git ls-remote --exit-code --tags origin "refs/tags/$version" >/dev/null 2>&1; then
            echo "Tag already exists: $version" >&2
            exit 1
          fi
          if gh release view "$version" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "Release already exists: $version" >&2
            exit 1
          fi
          echo "version=$version" >>"$GITHUB_OUTPUT"

  build:
    needs: validate
    permissions:
      contents: read
      id-token: write
      attestations: write
    uses: ./.github/workflows/release-build.yml
    with:
      version: ${{ needs.validate.outputs.version }}
      release_type: rc
      content_key_id: sysarmor-rc
      release_environment: ''

  release:
    needs: build
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - name: Check out release source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.build.outputs.source_sha }}

      - name: Download release assets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.build.outputs.artifact_name }}
          path: dist/github-release

      - name: Create GitHub pre-release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.build.outputs.version }}
          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
          ASSET_DIR: ${{ github.workspace }}/dist/github-release
        run: |
          set -euo pipefail
          deployments/packages/render-github-release-notes.sh "$VERSION" "$GITHUB_REPOSITORY" rc >"$RUNNER_TEMP/release-notes.md"
          gh release create "$VERSION" "$ASSET_DIR"/* \
            --repo "$GITHUB_REPOSITORY" \
            --target "$SOURCE_SHA" \
            --title "SysArmor $VERSION" \
            --notes-file "$RUNNER_TEMP/release-notes.md" \
            --prerelease