release.yaml

name: release

on:
  push:
    tags:
      - v*
  workflow_dispatch:

permissions:
  contents: write

env:
  REGISTRY: docker.io
  REPO: rancher

jobs:
  build:
    name: build and package
    runs-on: ubuntu-latest
    strategy:
      matrix:
        arch:
        - amd64
        - arm64
    steps:

    - name : Checkout repository
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      # https://github.com/actions/checkout/releases/tag/v4.1.1

    - name: Setup Go
      uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
      # https://github.com/actions/setup-go/releases/tag/v5.0.0
      with:
        go-version-file: 'go.mod'

    - name: Build and package
      run: |
          ./scripts/build
          mkdir -p dist/artifacts
          cp bin/webhook dist/artifacts/webhook-linux-${{ matrix.arch }}
      env:
        ARCH: "${{ matrix.arch}}"
        GOARCH: "${{ matrix.arch}}"

    - name: Generate checksum files
      run: |
        ls -lR dist
        cd dist/artifacts
        sha256sum webhook-linux-${{ matrix.arch }} > sha256sum-${{ matrix.arch }}.txt

    - name: Upload artifacts
      # https://github.com/actions/upload-artifact/commit/65462800fd760344b1a7b4382951275a0abb4808
      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
      with:
        name: webhook-artifacts-${{ matrix.arch }}
        path: |
          dist/artifacts/webhook-linux-${{ matrix.arch }}
          dist/artifacts/sha256sum-${{ matrix.arch }}.txt
          dist/artifacts/rancher-webhook-*.tgz

  release:
    needs: build
    runs-on: ubuntu-latest
    steps:

    - name : Checkout repository
       # https://github.com/actions/checkout/releases/tag/v4.1.1
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    - name: package-helm
      run: ./scripts/package-helm

    - name: Download the amd64 artifacts
      uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
      # https://github.com/actions/download-artifact/releases/tag/v4.1.7
      with:
        name: webhook-artifacts-amd64
        path: dist/artifacts

    - name: Download the arm64 artifacts
      uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
      # https://github.com/actions/download-artifact/releases/tag/v4.1.7
      with:
        name: webhook-artifacts-arm64
        path: dist/artifacts

    - name: Get the version
      run: |
        source ./scripts/version
        echo "TAG=$(echo $TAG | sed 's/-amd64$//')" >> $GITHUB_ENV

    - name: Upload the files
      run: |
        ls -lR dist
        cd dist/artifacts
        gh --repo "${{ github.repository }}" release create ${{ github.ref_name }} --prerelease --verify-tag --generate-notes webhook-linux-* sha256sum-*.txt rancher-webhook*.tgz
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  image:
    permissions:
      contents: read
      id-token: write
    strategy:
      matrix:
        arch:
        - amd64
        - arm64
    name: Build and push Webhook images
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name : Checkout repository
        # https://github.com/actions/checkout/releases/tag/v4.1.1
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Download the artifacts
        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        # https://github.com/actions/download-artifact/releases/tag/v4.1.7
        with:
          name: webhook-artifacts-${{ matrix.arch }}
          path: dist/artifacts

      - name: Move binary to bin/
        run: |
          mkdir -p bin/
          cp -v dist/artifacts/webhook-linux-${{ matrix.arch }} bin/webhook
          chmod +x bin/webhook

      - name: "Read vault secrets"
        uses: rancher-eio/read-vault-secrets@main
        with:
          secrets: |
            secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
            secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD

      - name: Set up QEMU
        # https://github.com/docker/setup-qemu-action/releases/tag/v3.1.0
        uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25 # v3.4.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
        # https://github.com/docker/setup-buildx-action/releases/tag/v3.4.0

      - name: Log in to the Container registry
        # https://github.com/docker/login-action/releases/tag/v3.2.0
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.DOCKER_USERNAME }}
          password: ${{ env.DOCKER_PASSWORD }}

      - name: Build and push the webhook image
        id: build
        # https://github.com/docker/build-push-action/releases/tag/v6.3.0
        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
        with:
          context: .
          file: ./package/Dockerfile
          platforms: "linux/${{ matrix.arch }}"
          outputs: type=image,name=${{ env.REPO }}/rancher-webhook,push-by-digest=true,name-canonical=true,push=true

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        # https://github.com/actions/upload-artifact/releases/tag/v4.3.3
        with:
          name: digests-${{ matrix.arch }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    permissions:
      id-token: write
    runs-on: ubuntu-latest
    needs: image
    steps:
      - name: Download digests
        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        # https://github.com/actions/download-artifact/releases/tag/v4.1.7
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
        # https://github.com/docker/setup-buildx-action/releases/tag/v3.4.0

      - name: "Read vault secrets"
        uses: rancher-eio/read-vault-secrets@main
        with:
          secrets: |
            secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
            secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD

      - name: Log in to the Container registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        # https://github.com/docker/login-action/releases/tag/v3.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.DOCKER_USERNAME }}
          password: ${{ env.DOCKER_PASSWORD }}

        # setup tag name
      - if: ${{ startsWith(github.ref, 'refs/tags/') }}
        run: |
          echo TAG_NAME=$(echo $GITHUB_REF | sed -e "s|refs/tags/||") >> $GITHUB_ENV

      - name: Create manifest list and push
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create -t ${{ env.REGISTRY }}/${{ env.REPO }}/rancher-webhook:${{ env.TAG_NAME }} \
            $(printf '${{ env.REPO }}/rancher-webhook@sha256:%s ' *)