release.yaml

name: Release
on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release. Must be in the CHANGELOG.md file. Example: 1.0.0'
        required: true
      sha:
        description: 'Commit SHA to release. Example: 7dec363daaca95c59f68607ac1f29a12bc0b195b'
        required: true
      overwrite:
        description: 'Overwrite the image in the container registry and the GitHub release'
        required: true
        type: boolean
      validate:
        description: 'Validate the image follows best practices'
        type: boolean
        default: true
        required: true

permissions:
  id-token: write
  contents: write

jobs:
  # print inputs so reviewers can easily validate
  print:
    runs-on: ubuntu-latest
    steps:
      - name: Generate list using Markdown
        run: |
          echo "## Inputs" >> $GITHUB_STEP_SUMMARY
          echo "${{ toJSON(github.event.inputs) }}" >> $GITHUB_STEP_SUMMARY
  # validate ensures best practices are being followed before we release
  validate:
    if: ${{ inputs.validate }}
    runs-on: ubuntu-latest
    env:
      TAG: aks-app-routing-operator-validate:${{ inputs.version }}
    steps:
      # validate image from sha input
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          ref: ${{ inputs.sha }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@16c0bc4a6e6ada2cfd8afd41d22d95379cf7c32a # v2.8.0

      - name: Build image locally
        run: docker buildx build --tag "${TAG}" --load .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@595be6a0f6560a0a8fc419ddf630567fc623531d # v0.22.0
        with:
          image-ref: ${{ env.TAG }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH,MEDIUM'
          # if we need to ignore a vulnerability we can use a .trivyignore and reference it here

  release:
    needs: [validate, print]
    if: ${{ always() && (contains(needs.validate.result, 'success') || contains(needs.validate.result, 'skipped')) }}
    environment: prod
    runs-on: ["self-hosted", "1ES.Pool=${{ vars.RUNNER_BASE_NAME }}-ubuntu"]
    steps:
      # always read the changelog in main
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          ref: 'main'

      - name: Read changelog
        id: changelog
        uses: mindsers/changelog-reader-action@b97ce03a10d9bdbb07beb491c76a5a01d78cd3ef # v2.2.2
        with:
          validation_level: warn
          version: ${{ inputs.version }}

        # build image from sha input
      - uses: actions/checkout@v3
        with:
          ref: ${{ inputs.sha }}

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@16c0bc4a6e6ada2cfd8afd41d22d95379cf7c32a # v2.8.0

      - name: Authenticate to ACR
        run: |
          az login --identity
          az acr login -n ${{ secrets.AZURE_REGISTRY_SERVER }}

      - name: Create or update release
        uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # v1.14.0
        with:
          name: ${{ steps.changelog.outputs.version }}
          tag: v${{ steps.changelog.outputs.version }}
          body: ${{ steps.changelog.outputs.changes }}
          commit: ${{ inputs.sha }}
          prerelease: false
          draft: false
          token: ${{ secrets.GITHUB_TOKEN }}
          allowUpdates: ${{ inputs.overwrite }}

        # Push happens after creating GitHub release so we don't overwrite an image.
        # Create release step doesn't allow for tag updates so we will never push
        # to an image that already exists.
      - name: Build and push image
        env:
          VERSION: ${{ inputs.version }}
        run: |
          TAG="${{ secrets.AZURE_REGISTRY_SERVER }}/public/aks/aks-app-routing-operator:$VERSION"
          docker buildx build --platform "amd64,arm64" --tag "${TAG}" --output type=registry .