release.yaml

name: release

on:
  push:
    tags:
      - v5.*

permissions:
  contents: write
  packages: write

env:
  CR_INDEX_PATH: "${{ github.workspace }}/.cr-index"
  CR_TOOL_PATH: "${{ github.workspace }}/.cr-tool"

jobs:
  helm:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: source

      - name: Install Helm
        uses: azure/setup-helm@v4
        with:
          version: v3.16.2

      - name: Prepare
        run: |
          # OCI standard enforces lower-case paths
          GHCR_REPO=$(echo "ghcr.io/${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
          HELM_REPO=$(echo "oci://ghcr.io/${{ github.repository_owner }}/helm-charts" | tr '[:upper:]' '[:lower:]')
          echo "GHCR_REPO=$GHCR_REPO" >> $GITHUB_ENV
          echo "HELM_REPO=$HELM_REPO" >> $GITHUB_ENV

      - name: Publish Helm charts
        run: |
          cd source/deploy/helm
          yq -i '.image.repository = "${{ env.GHCR_REPO }}"' grafana-operator/values.yaml
          helm registry login -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }} ghcr.io
          helm package --app-version ${{ github.ref_name }} --version ${{ github.ref_name }} grafana-operator

          helm push grafana-operator-${{ github.ref_name }}.tgz ${{ env.HELM_REPO }}

      - name: Install CR tool
        run: |
          mkdir "${CR_TOOL_PATH}"
          mkdir "${CR_INDEX_PATH}"
          curl -sSLo cr.tar.gz "https://github.com/helm/chart-releaser/releases/download/v1.4.0/chart-releaser_1.4.0_linux_amd64.tar.gz"
          tar -xzf cr.tar.gz -C "${CR_TOOL_PATH}"
          rm -f cr.tar.gz

      - name: Create a GitHub App installation access token
        uses: tibdex/github-app-token@v2
        id: app-token
        with:
          app_id: ${{ secrets.GRAFANA_OPERATOR_HELM_RELEASE_APP_ID }}
          private_key: ${{ secrets.GRAFANA_OPERATOR_HELM_RELEASE_PEM_KEY }}

      - name: Set the correct token (Github App or PAT)
        run: |
          echo "AUTHTOKEN=${{ steps.app-token.outputs.token }}" >> $GITHUB_ENV
          
      - name: Make github release
        uses: softprops/action-gh-release@v2
        with:
          body: |
            Helm chart for the [grafana-operator](https://github.com/${{ github.repository }}

            Tag on source: https://github.com/${{ github.repository }}/releases/tag/${{ github.ref_name }}
          files: |
            source/deploy/helm/grafana-operator-${{ github.ref_name }}.tgz
          repository: grafana/helm-charts
          tag_name: grafana-operator-${{ github.ref_name }}
          token: ${{ env.AUTHTOKEN }}

      - name: Checkout helm-charts
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          repository: grafana/helm-charts
          path: helm-charts
          token: ${{ env.AUTHTOKEN }}

      - name: Configure Git for helm-charts
        run: |
          cd helm-charts
          git config user.name "$GITHUB_ACTOR"
          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

      - name: Update helm repo index.yaml
        run: |
          cd helm-charts
          "${CR_TOOL_PATH}/cr" index --config ../source/deploy/helm/cr.yaml --token "${{ env.AUTHTOKEN }}" --index-path "${CR_INDEX_PATH}" --package-path ../source/deploy/helm/ --push

  kustomize:
    runs-on: ubuntu-latest
    steps:
      - name: install flux
        uses: fluxcd/flux2/action@v2.5.0
      - name: Clone repo
        uses: actions/checkout@v4
      - name: Prepare
        run: |
          # OCI standard enforces lower-case paths
          KUSTOMIZE_REPO=$(echo "oci://ghcr.io/${{ github.repository_owner }}/kustomize/grafana-operator" | tr '[:upper:]' '[:lower:]')
          GHCR_REPO=$(echo "ghcr.io/${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
          echo "KUSTOMIZE_REPO=$KUSTOMIZE_REPO" >> $GITHUB_ENV
          echo "GHCR_REPO=$GHCR_REPO" >> $GITHUB_ENV
      - name: update-kustomize-image
        run: |
          # Install kustomize
          make kustomize
          # Update image to match the new image and tag
          cd deploy/kustomize/base
          kustomize edit set image ghcr.io/${{ github.repository }}=${{ env.GHCR_REPO }}:${{ github.ref_name }}
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Publish Kustomize OCI artifact to GHCR
        run: |
          flux push artifact ${{ env.KUSTOMIZE_REPO }}:${{ github.ref_name }} \
            --path="./deploy/kustomize" \
            --source="${{ github.event.repository.html_url }}" \
            --revision="${GITHUB_REF_NAME}/${GITHUB_SHA}"
      - name: update-kustomize-assert
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          for d in deploy/kustomize/overlays/*/ ; do
            kustomize build "$d" --load-restrictor LoadRestrictionsNone > kustomize-$(basename "$d").yaml
          done
          kustomize build config/crd > crds.yaml
          gh release upload "${{ github.ref_name }}" kustomize-*.yaml crds.yaml

  image:
    runs-on: ubuntu-latest
    steps:
      - name: Clone repo
        uses: actions/checkout@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Quay.io
        uses: docker/login-action@v3
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}

      - uses: actions/setup-go@v5
        with:
          go-version-file: "go.mod"
          cache: true

      - uses: ko-build/setup-ko@v0.8
        with:
          version: v0.16.0

      - name: Install cosign
        uses: sigstore/cosign-installer@v3.8.1
        with:
          cosign-release: "v2.2.2"

      - name: Prepare
        run: |
          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_ENV
          echo "REPOS"="quay.io/grafana-operator/grafana-operator" "ghcr.io/${{ github.repository }}" >> $GITHUB_ENV

      - name: Build and push
        run: |
          for i in ${{ env.REPOS }}
          do
            export KO_DOCKER_REPO=${i}
            ko build --sbom=spdx --image-refs ./image-digest-${i%.*} --bare --platform linux/arm64,linux/arm/v7,linux/amd64,linux/ppc64le -t ${{ github.ref_name }} \
            --image-label org.opencontainers.image.title=grafana-operator \
            --image-label org.opencontainers.image.description="An operator for Grafana that installs and manages Grafana instances & Dashboards & Datasources through Kubernetes/OpenShift CRs" \
            --image-label org.opencontainers.image.url=${{ github.server_url }}/${{ github.repository }} \
            --image-label org.opencontainers.image.revision=${{ github.sha }} \
            --image-label org.opencontainers.image.version=${{ github.ref_name }} \
            --image-label org.opencontainers.image.created=${{ env.BUILD_DATE }}
          done

      - name: Sign Image
        run: |
          for i in ${{ env.REPOS }}
          do
            cosign sign -d -y $(cat ./image-digest-${i%.*})
          done