release.yaml

name: release

on:
  workflow_call:
    secrets:
      token:
        description: Token used to create a PR against the miracum/charts repository
        required: true

permissions: {}

jobs:
  publish-helm-chart:
    name: publish helm chart
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
      # needed for cosign
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false

      - name: Login to GitHub Container Registry
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Task
        uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Add helm repos and update deps
        run: |
          task helm-add-repos
          helm dep build charts/recruit

      # TODO: maybe replace image tags in values.yaml with digests before packaging
      - name: Package, upload, and sign Helm chart
        env:
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: |
          CHART_VERSION="$(yq .version charts/recruit/Chart.yaml)"

          helm package charts/recruit/
          helm push "recruit-${CHART_VERSION}.tgz" "oci://ghcr.io/${GITHUB_REPOSITORY}/charts"

          cp "recruit-${CHART_VERSION}.tgz" recruit-helm-chart.tgz

          cosign sign --yes "ghcr.io/${GITHUB_REPOSITORY}/charts/recruit:${CHART_VERSION}"

      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: helm-chart
          path: |
            recruit-helm-chart.tgz

  sync-helm-chart-to-central-chart-repo:
    name: sync helm chart to central chart repo
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          path: recruit
          persist-credentials: false

      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          repository: miracum/charts
          path: miracum-charts
          # required to push
          persist-credentials: true

      - name: copy local helm chart to charts repo
        run: |
          # delete the existing recruit chart first. Otherwise we wouldn't be able
          # to sync file removals.
          rm -rf miracum-charts/charts/recruit
          cp -r recruit/charts/recruit miracum-charts/charts/

      - name: get chart version
        id: chart-version
        run: |
          CHART_VERSION=$(yq .version recruit/charts/recruit/Chart.yaml)
          echo "version=${CHART_VERSION}" >> "$GITHUB_OUTPUT"

      - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
        with:
          token: ${{ secrets.token }}
          path: miracum-charts
          title: "chore(deps): updated recruit chart to ${{ steps.chart-version.outputs.version }}"
          commit-message: "chore(deps): updated recruit chart to ${{ steps.chart-version.outputs.version }}"
          branch: sync-recruit-chart-from-source-repo

  # experimental
  publish-kyverno-policies:
    name: publish kyverno policies
    runs-on: ubuntu-24.04
    container: ghcr.io/chgl/kube-powertools:v2.4.22@sha256:dd8fa52639b145f388a4a9a8529326a5d2e600e45731ce6161c989c3ec9cd8ca
    continue-on-error: true
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false

      - name: Push policy folder
        env:
          KYVERNO_EXPERIMENTAL: "1"
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: |
          VERSION=$(cat version.txt)
          kyverno oci push -i "ghcr.io/${GITHUB_REPOSITORY}/kyverno-policies:${VERSION}" --policy policies/
          cosign sign --yes "ghcr.io/${GITHUB_REPOSITORY}/kyverno-policies:${VERSION}"

  prepare-artifacts:
    name: prepare artifacts
    runs-on: ubuntu-24.04
    needs:
      - publish-helm-chart
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    permissions:
      contents: write # to upload artifacts to the release
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false

      - name: Download Helm chart
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: helm-chart
          path: /tmp

      - name: Create dist dir
        run: |
          mkdir -p dist/

      - name: Add Helm chart to dist
        run: |
          ls -lsa /tmp
          cp /tmp/recruit-helm-chart.tgz dist/

      # TODO: replace tags with digests in compose - requires waiting for ci/build to be completed
      #       turn this workflow into a reusable one and call it at the end of ci.yaml
      #       yq '(.services[].image | select(. == "ghcr.io/miracum/recruit/list:*")) += "@sha256:123456"' docker-compose/docker-compose.yaml
      - name: Build Docker Compose deployment bundle
        run: |
          cp -r docker-compose/ dist/
          tar -C dist -zcvf dist/recruit-docker-compose.tgz docker-compose/

      - name: Generate SLSA subject for release assets
        id: hash
        working-directory: dist
        run: |
          sha256sum recruit-docker-compose.tgz recruit-helm-chart.tgz > checksums.sha256
          echo "hashes=$(base64 -w0 < checksums.sha256)" >> "$GITHUB_OUTPUT"

      - name: upload assets to release
        uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
        with:
          files: |
            dist/*.tgz
            dist/*.sha256

  provenance:
    needs:
      - prepare-artifacts
    permissions:
      actions: read # To read the workflow path.
      # To sign the provenance.
      id-token: write
      contents: write # To add assets to a release.
    # can't be referenced by digest. See <https://github.com/slsa-framework/slsa-github-generator#verification-of-provenance>
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: "${{ needs.prepare-artifacts.outputs.hashes }}"
      upload-assets: true