release.yml

name: Release

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"

permissions:
  contents: read

jobs:
  validate:
    name: Release metadata
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Check tag and synchronized versions
        run: |
          scripts/check-version.sh
          version="${GITHUB_REF_NAME#v}"
          chart_version="$(awk '/^version:/ {print $2; exit}' charts/devboxes/Chart.yaml)"
          test "$version" = "$chart_version"
          grep -Fq "## [$version]" CHANGELOG.md

  create-release:
    name: Create GitHub release
    needs: validate
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: taiki-e/create-gh-release-action@eba8ea96c86cca8a37f1b56e94b4d13301fba651 # v1
        with:
          changelog: CHANGELOG.md

  cli:
    name: CLI ${{ matrix.target }}
    needs: create-release
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            build-tool: cargo
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            build-tool: cross
          - target: x86_64-apple-darwin
            os: macos-latest
            build-tool: cargo
          - target: aarch64-apple-darwin
            os: macos-latest
            build-tool: cargo
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: taiki-e/upload-rust-binary-action@f0d45ae91ee7b8ee928de7a9d04d893a08bcbec6 # v1
        with:
          bin: devbox
          package: devbox-cli
          manifest-path: cli/Cargo.toml
          target: ${{ matrix.target }}
          build-tool: ${{ matrix.build-tool }}
          locked: true
          checksum: sha256

  images:
    name: ${{ matrix.component }} image
    needs: validate
    strategy:
      fail-fast: false
      matrix:
        component: [controller, workspace]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Resolve version
        id: version
        run: echo "value=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
      - name: Build and push
        id: push
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: ${{ matrix.component }}
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ghcr.io/${{ github.repository_owner }}/devboxes-${{ matrix.component }}:${{ steps.version.outputs.value }}
            ghcr.io/${{ github.repository_owner }}/devboxes-${{ matrix.component }}:latest
          labels: |
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ steps.version.outputs.value }}
            org.opencontainers.image.licenses=Apache-2.0
          cache-from: type=gha,scope=${{ matrix.component }}
          cache-to: type=gha,mode=max,scope=${{ matrix.component }}
          provenance: mode=max
          sbom: true
      - name: Attest image provenance
        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
        with:
          subject-name: ghcr.io/${{ github.repository_owner }}/devboxes-${{ matrix.component }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true

  helm:
    name: Helm chart
    needs: validate
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
        with:
          version: v4.2.2
      - name: Check chart version
        run: |
          tag_version="${GITHUB_REF_NAME#v}"
          chart_version="$(helm show chart charts/devboxes | awk '/^version:/ {print $2}')"
          test "$tag_version" = "$chart_version"
      - name: Log in to GHCR
        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io --username "${{ github.actor }}" --password-stdin
      - name: Package and publish chart
        run: |
          helm package charts/devboxes --destination /tmp
          helm push "/tmp/devboxes-${GITHUB_REF_NAME#v}.tgz" oci://ghcr.io/${{ github.repository_owner }}/charts

  published-images:
    name: Published images
    needs: images
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
      attestations: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Verify anonymous pulls, platforms, SBOMs, and provenance
        env:
          DEVBOXES_VERSION: ${{ github.ref_name }}
          GH_TOKEN: ${{ github.token }}
        run: |
          DEVBOXES_VERSION="${DEVBOXES_VERSION#v}" scripts/verify-published-images.sh

  published-chart:
    name: Published chart (Helm ${{ matrix.major }})
    needs: helm
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - major: 3
            version: v3.21.3
          - major: 4
            version: v4.2.2
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
        with:
          version: ${{ matrix.version }}
      - name: Pull and render the public OCI chart
        env:
          DEVBOXES_VERSION: ${{ github.ref_name }}
        run: |
          version="${DEVBOXES_VERSION#v}"
          helm pull oci://ghcr.io/${{ github.repository_owner }}/charts/devboxes \
            --version "$version" \
            --destination /tmp
          helm template devboxes "/tmp/devboxes-$version.tgz" \
            --namespace devboxes \
            --set workspace.sshService.type=NodePort \
            --set workspace.sshService.host=192.0.2.10 \
            --set ingress.enabled=true \
            --set ingress.className=nginx \
            --set ingress.tls.enabled=true \
            --set ingress.tls.secretName=devboxes-tls \
            --set controller.externalUrl=https://devboxes.example.com \
            --set controller.cookieSecure=true \
            --set podDisruptionBudget.enabled=true \
            > /tmp/devboxes-published.yaml
          grep -Fq "ghcr.io/${{ github.repository_owner }}/devboxes-controller:$version" /tmp/devboxes-published.yaml
          grep -Fq "ghcr.io/${{ github.repository_owner }}/devboxes-workspace:$version" /tmp/devboxes-published.yaml
      - name: Strictly validate published Kubernetes resources
        run: >-
          docker run --rm -i ghcr.io/yannh/kubeconform:v0.7.0
          -strict -summary
          < /tmp/devboxes-published.yaml

  published-e2e:
    name: Published clean-cluster lifecycle
    needs: [cli, published-images, published-chart]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      packages: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
        with:
          version: v4.2.2
      - name: Install kind
        run: |
          go install sigs.k8s.io/kind@v0.31.0
          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
      - name: Run lifecycle through released CLI, chart, and images
        env:
          DEVBOXES_VERSION: ${{ github.ref_name }}
        run: |
          DEVBOXES_VERSION="${DEVBOXES_VERSION#v}" scripts/published-e2e.sh

  release-gate:
    name: Release gate
    needs: published-e2e
    runs-on: ubuntu-latest
    steps:
      - run: echo "Published release artifacts passed every release gate."