release.yml

name: Release

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+*'

permissions:
  contents: read

env:
  WAYBILL_VERSION: v0.2.0
  WAYBILL_SHA256: 5f946e48de62f44d205ef92a21864f55fc49a7da4f71619aec0c1e4cd1c617bb

jobs:
  verify:
    name: Build, Test & Verify dist
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: package.json
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Build, lint & test
        run: |
          npm run build
          npm run lint
          npm test

      - name: Verify committed dist/ matches source
        run: |
          npm run pack
          if [ -n "$(git status --porcelain dist/)" ]; then
            echo "::error::dist/ is out of date. Run 'npm run pack' and commit the result before tagging."
            git --no-pager diff --stat dist/
            exit 1
          fi

  image:
    name: Publish container image
    runs-on: ubuntu-latest
    needs: verify
    permissions:
      contents: read
      packages: write
      id-token: write # cosign keyless signing
      attestations: write # GitHub artifact attestations
    outputs:
      digest: ${{ steps.build.outputs.digest }}
      latest: ${{ steps.order.outputs.latest }}
      major: ${{ steps.order.outputs.major }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      # a backport (v3.3.2 tagged after v3.4.0) must not move a floating tag back: each one moves only
      # when this tag is the highest stable release it covers; a pre-release (a '-') is never the highest
      - name: Compare with the released tags
        id: order
        run: |
          highest() { git tag --list "$1" --sort=-v:refname | grep -v -- '-' | head -1; }
          is() { if [ "$GITHUB_REF_NAME" = "$1" ]; then echo true; else echo false; fi; }
          {
            echo "latest=$(is "$(highest 'v*.*.*')")"
            echo "major=$(is "$(highest "${GITHUB_REF_NAME%%.*}.*.*")")"
            echo "minor=$(is "$(highest "${GITHUB_REF_NAME%.*}.*")")"
          } | tee -a "$GITHUB_OUTPUT"

      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
        with:
          platforms: linux/amd64,linux/arm64

      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # v3.4.0 → 3.4.0, 3.4, 3 and latest; a pre-release (anything with a '-') gets only its own version,
      # and a backport only the floating tags it is the highest stable release of
      - id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}},enable=${{ steps.order.outputs.minor == 'true' }}
            type=semver,pattern={{major}},enable=${{ steps.order.outputs.major == 'true' }}
            type=raw,value=latest,enable=${{ steps.order.outputs.latest == 'true' }}

      - id: build
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      # the multi-arch index digest, not a per-platform one
      - name: Sign image
        run: cosign sign --yes "ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}"

      - name: Attest image provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-name: ghcr.io/${{ github.repository }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

  chart:
    name: Publish Helm chart
    runs-on: ubuntu-latest
    needs: image
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1

      - name: Extract version from tag
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"

      - name: Helm registry login
        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u "${{ github.actor }}" --password-stdin

      # helm keeps its login in its own config; cosign reads Docker's, so log in there too
      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # the chart's version and appVersion are the release; the image tag defaults to appVersion
      - name: Package and push chart
        id: push
        run: |
          helm package charts/prow-github-app --version "$VERSION" --app-version "$VERSION" --destination .
          out=$(helm push "prow-github-app-${VERSION}.tgz" "oci://ghcr.io/${{ github.repository }}/charts" 2>&1)
          echo "$out"
          echo "digest=$(echo "$out" | grep -oE 'sha256:[a-f0-9]{64}')" >> "$GITHUB_OUTPUT"

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Sign chart
        run: cosign sign --yes "ghcr.io/${{ github.repository }}/charts/prow-github-app@${{ steps.push.outputs.digest }}"

      - name: Attest chart provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-name: ghcr.io/${{ github.repository }}/charts/prow-github-app
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true

  github-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs: [verify, image, chart]
    permissions:
      contents: write
      id-token: write # For cosign keyless signing
      attestations: write # For GitHub artifact attestations
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Extract version from tag
        run: |
          echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
          echo "MAJOR=${GITHUB_REF_NAME%%.*}" >> "$GITHUB_ENV"

      - name: Install waybill
        run: |
          curl -sSfL -o waybill.tar.gz \
            "https://github.com/kusari-oss/waybill/releases/download/${WAYBILL_VERSION}/waybill-${WAYBILL_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
          echo "${WAYBILL_SHA256}  waybill.tar.gz" | sha256sum -c -
          tar -xzf waybill.tar.gz
          sudo install -m 0755 "waybill-${WAYBILL_VERSION}-x86_64-unknown-linux-gnu/waybill" /usr/local/bin/waybill
          waybill --version

      - name: Generate SBOM (SPDX 2.3)
        run: |
          waybill sbom scan --path . \
            --exclude-path dist \
            --exclude-scope dev,build,test \
            --format spdx-2.3-json \
            --output "prow-github-actions-${VERSION}.spdx.json"

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Sign SBOM
        run: |
          cosign sign-blob --yes \
            --bundle "prow-github-actions-${VERSION}.spdx.json.bundle" \
            "prow-github-actions-${VERSION}.spdx.json"

      - name: Attest build provenance
        id: provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: |
            dist/index.js
            prow-github-actions-${{ env.VERSION }}.spdx.json

      - name: Rename provenance bundle
        env:
          BUNDLE_PATH: ${{ steps.provenance.outputs.bundle-path }}
        run: cp "$BUNDLE_PATH" "prow-github-actions-${VERSION}.intoto.jsonl"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          tag_name: ${{ github.ref_name }}
          name: prow-github-actions ${{ env.VERSION }}
          generate_release_notes: true
          files: |
            prow-github-actions-${{ env.VERSION }}.spdx.json
            prow-github-actions-${{ env.VERSION }}.spdx.json.bundle
            prow-github-actions-${{ env.VERSION }}.intoto.jsonl
          body: |
            ## Usage

            ```yaml
            - uses: ${{ github.repository }}@${{ github.ref_name }}
            ```

            ## GitHub App (beta)

            Container image and Helm chart for [running Prow as a GitHub App](https://github.com/${{ github.repository }}/blob/${{ github.ref_name }}/docs/github-app.md):
            ```bash
            docker pull ghcr.io/${{ github.repository }}@${{ needs.image.outputs.digest }}
            helm install prow oci://ghcr.io/${{ github.repository }}/charts/prow-github-app --version ${{ env.VERSION }}
            ```
            Both are signed with cosign (keyless) and carry SLSA provenance:
            ```bash
            cosign verify ghcr.io/${{ github.repository }}:${{ env.VERSION }} \
              --certificate-identity-regexp="https://github.com/${{ github.repository }}" \
              --certificate-oidc-issuer="https://token.actions.githubusercontent.com"
            gh attestation verify oci://ghcr.io/${{ github.repository }}:${{ env.VERSION }} --repo ${{ github.repository }}
            ```

            ## SBOM and provenance

            An SPDX 2.3 SBOM of the runtime dependencies, generated with
            [waybill](https://github.com/kusari-oss/waybill), is attached as
            `prow-github-actions-${{ env.VERSION }}.spdx.json` and signed with
            [cosign](https://github.com/sigstore/cosign) (keyless). SLSA build
            provenance covering both `dist/index.js` and the SBOM is attached as
            `prow-github-actions-${{ env.VERSION }}.intoto.jsonl`.

            Verify the SBOM signature:
            ```bash
            cosign verify-blob \
              --bundle prow-github-actions-${{ env.VERSION }}.spdx.json.bundle \
              --certificate-identity-regexp="https://github.com/${{ github.repository }}" \
              --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
              prow-github-actions-${{ env.VERSION }}.spdx.json
            ```

            Verify the provenance of the bundled action:
            ```bash
            gh attestation verify dist/index.js --repo ${{ github.repository }}
            ```
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}
          make_latest: ${{ needs.image.outputs.latest }}

      - name: Prepend curated release notes
        if: ${{ hashFiles(format('docs/releases/v{0}.md', env.VERSION)) != '' }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release view "$GITHUB_REF_NAME" --json body -q .body > generated-notes.md
          cat "docs/releases/v${VERSION}.md" generated-notes.md > release-notes.md
          gh release edit "$GITHUB_REF_NAME" --notes-file release-notes.md

      - name: Update floating major tag
        if: ${{ needs.image.outputs.major == 'true' }}
        run: |
          git tag -f "$MAJOR" "$GITHUB_REF_NAME"
          git push -f origin "refs/tags/$MAJOR"