release.yaml

# Copyright 2024 Chainguard, Inc.
# SPDX-License-Identifier: Apache-2.0

name: Cut Release

on:
  workflow_dispatch:

permissions: {}

env:
  VERSION_FILE: "pkg/release/version.go"

jobs:
  tag:
    if: ${{ github.repository == 'chainguard-dev/malcontent' }}
    runs-on: ubuntu-24.04-arm
    permissions:
      id-token: write
      contents: write
    steps:
      - uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: block
          allowed-endpoints: >
            *.blob.core.windows.net:443
            *.githubapp.com:443
            api.github.com:443
            github.com:443
            octo-sts.dev:443
            release-assets.githubusercontent.com:443
      - uses: chainguard-dev/actions/setup-gitsign@c69a264ec2a5934c3186c618f368fc1c86f16cff # main
      - name: Set up Octo-STS
        uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
        id: octo-sts
        with:
          scope: chainguard-dev/malcontent
          identity: release
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        # zizmor: ignore[artipacked] - credentials needed for gh release create
        with:
          token: ${{ steps.octo-sts.outputs.token }}
      - name: Get Version
        id: get-version
        run: |
          VERSION=$(awk -F'"' '/ID string =/ {print $2}' "${VERSION_FILE}")
          if [[ ! "${VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Error: VERSION is not a valid semver"
            exit 1
          fi
          echo "VERSION=${VERSION}" >> "${GITHUB_OUTPUT}"
      - name: Create Release
        env:
          GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
          VERSION: ${{ steps.get-version.outputs.VERSION }}
        if: ${{ steps.get-version.outputs.VERSION != '' }}
        run: |
          if [[ ! "${VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Error: VERSION is not a valid semver"
            exit 1
          fi
          git config --global tag.gpgsign true
          gh release create "${VERSION}" --title "${VERSION}" --notes "Release ${VERSION}" --draft