release.yml

name: Release CLI and Packages on Tag

permissions:
  contents: read

on:
  push:
    tags:
      - "v*"

jobs:
  build-release:
    runs-on: large-ubuntu-zarf-release
    permissions:
      id-token: write
      packages: write
    steps:
      # Checkout the repo and setup the tooling for this job
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup golang
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: Install tools
        uses: ./.github/actions/install-tools

      - name: Build CLI
        run: |
          CLI_VERSION=$GITHUB_REF_NAME make build-cli-linux-amd
          CLI_VERSION=$GITHUB_REF_NAME make build-cli-linux-arm

      - name: "Zarf Agent: Login to GHCR"
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: dummy
          password: ${{ github.token }}

      - name: "Zarf Agent: Build and Publish the Image"
        run: |
          cp build/zarf build/zarf-linux-amd64
          cp build/zarf-arm build/zarf-linux-arm64
          docker buildx build --push --platform linux/arm64/v8,linux/amd64 --tag ghcr.io/zarf-dev/zarf/agent:$GITHUB_REF_NAME .
          rm build/zarf-linux-amd64
          rm build/zarf-linux-arm64
          echo ZARF_AGENT_IMAGE_DIGEST=$(docker buildx imagetools inspect ghcr.io/zarf-dev/zarf/agent:$GITHUB_REF_NAME --format '{{ json . }}' | jq -r .manifest.digest) >> $GITHUB_ENV

      - name: Auth with AWS
        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
        with:
          role-to-assume: ${{ secrets.AWS_KMS_ROLE_ARN }}
          role-session-name: ${{ github.job || github.event.client_payload.pull_request.head.sha || github.sha }}
          aws-region: us-east-1
          role-duration-seconds: 3600

      - name: "Zarf Agent: Sign the Image"
        run: cosign sign --key awskms:///${{ secrets.COSIGN_AWS_KMS_KEY_ARN }} -a release-engineer=https://github.com/${{ github.actor }} -a version=$GITHUB_REF_NAME ghcr.io/zarf-dev/zarf/agent@$ZARF_AGENT_IMAGE_DIGEST -y
        env:
          COSIGN_EXPERIMENTAL: 1

      # Builds init packages since GoReleaser won't handle this for us
      - name: Build init-packages For Release
        run: |
          make release-init-package ARCH=amd64 AGENT_IMAGE_TAG=$GITHUB_REF_NAME
          make release-init-package ARCH=arm64 AGENT_IMAGE_TAG=$GITHUB_REF_NAME

      - name: Sign Init Packages
        run: |
          build/zarf package sign build/zarf-init-amd64-$GITHUB_REF_NAME.tar.zst \
            --keyless \
            --confirm
          build/zarf package sign build/zarf-init-arm64-$GITHUB_REF_NAME.tar.zst \
            --keyless \
            --confirm

      - name: Publish Init Package as OCI and Skeleton
        run: |
          CLI_VERSION=$GITHUB_REF_NAME make publish-init-package ARCH=amd64 REPOSITORY_URL=ghcr.io/zarf-dev/packages
          CLI_VERSION=$GITHUB_REF_NAME make publish-init-package ARCH=arm64 REPOSITORY_URL=ghcr.io/zarf-dev/packages

      # Upload the contents of the build directory for later stages to use
      - name: Upload build artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: build-artifacts
          path: build/
          retention-days: 1

  validate-release:
    runs-on: large-ubuntu-zarf-release
    needs: build-release
    steps:
      # Checkout the repo and setup the tooling for this job
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Download build artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: build-artifacts
          path: build/

      - name: Setup golang
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: Make Zarf executable
        run: |
          chmod +x build/zarf

      # Build the example packages and run the tests
      - name: Build examples and run tests
        run: |
          sudo env "PATH=$PATH" CI=true APPLIANCE_MODE=true CLI_VERSION=$GITHUB_REF_NAME make test-e2e ARCH=amd64

  create-release:
    runs-on: large-ubuntu-zarf-release
    needs: validate-release
    environment: release
    permissions:
      contents: write
    steps:
      # Checkout the repo and setup the tooling for this job
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup golang
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: Install tools
        uses: ./.github/actions/install-tools

      - name: Download build artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: build-artifacts
          path: build/

      - name: Make zarf executable and skip brew latest for pre-release tags
        run: |
          chmod +x build/zarf
          if [[ $GITHUB_REF_NAME == *"rc"* ]]; then
            echo "BREW_NAME=zarf@latest-rc" >> $GITHUB_ENV
          else
            echo "BREW_NAME=zarf" >> $GITHUB_ENV
          fi

      - name: Setup release ENV vars
        run: |
          K8S_MODULES_VER=$(go list -f '{{.Version}}' -m k8s.io/client-go | sed 's/v//; s/\./ /g')
          echo K8S_MODULES_MAJOR_VER=$(expr $(echo "$K8S_MODULES_VER" | cut -d " " -f 1) + 1) >> $GITHUB_ENV
          echo K8S_MODULES_MINOR_VER=$(echo "$K8S_MODULES_VER" | cut -d " " -f 2) >> $GITHUB_ENV
          echo K8S_MODULES_PATCH_VER=$(echo "$K8S_MODULES_VER" | cut -d " " -f 3) >> $GITHUB_ENV

          echo K9S_VERSION=$(go list -f '{{.Version}}' -m github.com/derailed/k9s) >> $GITHUB_ENV
          echo CRANE_VERSION=$(go list -f '{{.Version}}' -m github.com/google/go-containerregistry) >> $GITHUB_ENV
          echo SYFT_VERSION=$(go list -f '{{.Version}}' -m github.com/anchore/syft) >> $GITHUB_ENV
          echo ARCHIVES_VERSION=$(go list -f '{{.Version}}' -m github.com/mholt/archives) >> $GITHUB_ENV
          echo HELM_VERSION=$(go list -f '{{.Version}}' -m helm.sh/helm/v4) >> $GITHUB_ENV

      - name: Get Brew tap repo token
        id: brew-tap-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.HOMEBREW_TAP_WORKFLOW_GITHUB_APP_ID }}
          private-key: ${{ secrets.HOMEBREW_TAP_WORKFLOW_GITHUB_APP_SECRET }}
          owner: defenseunicorns
          repositories: homebrew-tap

      # Create the GitHub release notes, upload artifact backups to S3, publish homebrew recipe
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          distribution: goreleaser
          version: "v2.15.4"
          args: release --clean --verbose
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN}}
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.brew-tap-token.outputs.token }}
          GORELEASER_CURRENT_TAG: ${{ github.ref_name }}

      - name: Report disk space on failure
        if: failure()
        run: |
          echo "create-release failed, printing out available diskspace"
          lsblk -f