release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

permissions: {}

env:
  REGISTRY: ghcr.io
  EDGE_IMAGE: ghcr.io/${{ github.repository_owner }}/fairvisor-edge
  CLI_IMAGE: ghcr.io/${{ github.repository_owner }}/fairvisor-cli

jobs:
  preflight:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - name: Verify release tag and changelog
        run: bin/ci/verify_release_tag.sh "${GITHUB_REF_NAME}"

      - name: Setup Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: "3.12"

      - name: Install E2E dependencies
        run: pip install -r tests/e2e/requirements.txt

      - name: Build Lua test container
        run: docker build -f docker/Dockerfile.test -t fairvisor-test-release .

      - name: Run Lua quality gates
        run: docker run --rm -v "$PWD:/work" -w /work fairvisor-test-release bin/ci/run_lua_tests.sh

      - name: Run full E2E suite
        run: bin/ci/run_e2e_full.sh

      - name: Upload preflight artifacts
        if: always()
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
        with:
          name: release-preflight-artifacts
          path: artifacts/e2e-full
          if-no-files-found: ignore

  build-and-push:
    runs-on: ubuntu-latest
    needs: preflight
    permissions:
      contents: read
      packages: write
    outputs:
      edge_digest: ${{ steps.build_edge.outputs.digest }}
      cli_digest: ${{ steps.build_cli.outputs.digest }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4.0.0

      - name: Login to GHCR
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2  # v4.0.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push runtime image
        id: build_edge
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294  # v7.0.0
        with:
          context: .
          file: docker/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ${{ env.EDGE_IMAGE }}:${{ github.ref_name }}
            ${{ env.EDGE_IMAGE }}:sha-${{ github.sha }}
          build-args: |
            FAIRVISOR_EDGE_VERSION=${{ github.ref_name }}

      - name: Build and push CLI image
        id: build_cli
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294  # v7.0.0
        with:
          context: .
          file: docker/Dockerfile.cli
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ${{ env.CLI_IMAGE }}:${{ github.ref_name }}
            ${{ env.CLI_IMAGE }}:sha-${{ github.sha }}

  security-and-sbom:
    runs-on: ubuntu-latest
    needs: build-and-push
    permissions:
      contents: read
      packages: read
    steps:
      - name: Login to GHCR
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2  # v4.0.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Trivy
        uses: aquasecurity/setup-trivy@3fb12ec12f41e471780db15c232d5dd185dcb514  # v0.2.5

      - name: Scan pushed runtime image
        run: trivy image --severity HIGH,CRITICAL --exit-code 1 --ignore-unfixed "${EDGE_IMAGE}:${GITHUB_REF_NAME}"

      - name: Scan pushed CLI image
        run: trivy image --severity HIGH,CRITICAL --exit-code 1 --ignore-unfixed "${CLI_IMAGE}:${GITHUB_REF_NAME}"

      - name: Generate SBOM assets
        run: |
          mkdir -p artifacts/release
          trivy image --format cyclonedx --output artifacts/release/sbom-runtime.cdx.json "${EDGE_IMAGE}:${GITHUB_REF_NAME}"
          trivy image --format cyclonedx --output artifacts/release/sbom-cli.cdx.json "${CLI_IMAGE}:${GITHUB_REF_NAME}"

      - name: Upload SBOM artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
        with:
          name: release-sbom
          path: artifacts/release

  sign-and-attest:
    runs-on: ubuntu-latest
    needs: build-and-push
    permissions:
      id-token: write
      attestations: write
      packages: write
    steps:
      - name: Login to GHCR
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2  # v4.0.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22  # v4.1.0

      - name: Sign runtime image
        run: cosign sign --yes "${EDGE_IMAGE}@${{ needs.build-and-push.outputs.edge_digest }}"

      - name: Sign CLI image
        run: cosign sign --yes "${CLI_IMAGE}@${{ needs.build-and-push.outputs.cli_digest }}"

      - name: Attest runtime image
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
        with:
          subject-name: ${{ env.EDGE_IMAGE }}
          subject-digest: ${{ needs.build-and-push.outputs.edge_digest }}
          push-to-registry: true

      - name: Attest CLI image
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
        with:
          subject-name: ${{ env.CLI_IMAGE }}
          subject-digest: ${{ needs.build-and-push.outputs.cli_digest }}
          push-to-registry: true

  github-release:
    runs-on: ubuntu-latest
    needs:
      - build-and-push
      - security-and-sbom
      - sign-and-attest
    permissions:
      contents: write
    steps:
      - name: Create GitHub release
        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe  # v2
        with:
          generate_release_notes: true
          body: |
            Runtime image:
            - `${{ env.EDGE_IMAGE }}:${{ github.ref_name }}`
            - digest: `${{ needs.build-and-push.outputs.edge_digest }}`

            CLI image:
            - `${{ env.CLI_IMAGE }}:${{ github.ref_name }}`
            - digest: `${{ needs.build-and-push.outputs.cli_digest }}`