release.yml

name: Release

# Reusable release builder: publishes plugin binaries and GHCR images for a
# given tag and attaches the assets to the GitHub Release.
#
# Called automatically by release-please.yml when a release is cut (the tag
# is pushed by GITHUB_TOKEN, which cannot trigger workflows itself), and also
# runnable manually or on a direct tag push.
on:
  workflow_call:
    inputs:
      tag:
        description: "Release tag to build (e.g. v1.0.0)"
        required: true
        type: string
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag to build (e.g. v1.0.0)"
        required: true
        type: string
  push:
    tags: ["v*"]

permissions:
  contents: write
  packages: write

env:
  REGISTRY: ghcr.io

jobs:
  release:
    name: Build and publish release assets
    runs-on: ubuntu-latest
    steps:
      - name: Resolve tag
        id: meta
        run: |
          if [ -n "${{ inputs.tag }}" ]; then
            TAG="${{ inputs.tag }}"
          else
            TAG="${GITHUB_REF_NAME}"
          fi
          case "$TAG" in
            v*) VERSION="${TAG#v}" ;;
            *)  VERSION="$TAG" ;;
          esac
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - uses: actions/checkout@v4
        with:
          ref: ${{ steps.meta.outputs.tag }}

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push operator image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ github.repository }}:${{ steps.meta.outputs.tag }}
            ${{ env.REGISTRY }}/${{ github.repository }}:latest
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.version=${{ steps.meta.outputs.version }}

      - name: Build and push deployer image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: deployer.Dockerfile
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ github.repository }}-deployer:${{ steps.meta.outputs.tag }}
            ${{ env.REGISTRY }}/${{ github.repository }}-deployer:latest

      - name: Build plugin for all platforms
        run: |
          mkdir -p dist
          for target in \
            linux/amd64 linux/arm64 \
            darwin/amd64 darwin/arm64; do
            os="${target%/*}"; arch="${target#*/}"
            CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" \
              go build -trimpath -ldflags "-s -w -X github.com/anthaathi/celld-deploy/internal/cli.version=${{ steps.meta.outputs.version }}" \
              -o "dist/kubectl-celld_${os}_${arch}" \
              ./cmd/kubectl-celld
            (cd dist && sha256sum "kubectl-celld_${os}_${arch}" > "kubectl-celld_${os}_${arch}.sha256")
          done
          ls -la dist/

      - name: Generate versioned install manifest
        run: |
          VERSION="${{ steps.meta.outputs.tag }}"
          sed "s|image: celld-operator:poc|image: ${REGISTRY}/${GITHUB_REPOSITORY}:${VERSION}|" \
            config/manager/manager.yaml > dist/install-operator.yaml.example
          grep -q "image: " dist/install-operator.yaml.example

      - name: Attach assets to GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ steps.meta.outputs.tag }}
        run: |
          set -euo pipefail
          # Asset uploads go to uploads.github.com, not the regular API host.
          RELEASE_JSON=$(gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}")
          RELEASE_ID=$(jq -r '.id' <<<"$RELEASE_JSON")
          UPLOAD_URL=$(jq -r '.upload_url' <<<"$RELEASE_JSON" | sed 's/{?name,label}//')
          echo "attaching to release ${RELEASE_ID} (${TAG})"
          for f in dist/*; do
            name=$(basename "$f")
            # Replace any asset with the same name so re-runs stay idempotent.
            asset_id=$(gh api "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}/assets" \
              --jq ".[] | select(.name == \"${name}\") | .id" || true)
            [ -z "$asset_id" ] || gh api -X DELETE "repos/${GITHUB_REPOSITORY}/releases/assets/${asset_id}" || true
            curl -fsS -X POST \
              -H "Authorization: Bearer ${GH_TOKEN}" \
              -H "Content-Type: application/octet-stream" \
              --data-binary "@${f}" \
              "${UPLOAD_URL}?name=${name}" >/dev/null
          done
          gh api "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}/assets" --jq '.[].name'