release.yml

name: release

on:
  push:
    tags:
    - 'v*.*.*'

jobs:
  build_and_push_images:
    name: Build and Release image to Docker Hub
    runs-on: ubuntu-22.04
    strategy:
      matrix:
        id: [ "manager", "proxy-init", "ingress-pipy" ]
    steps:
    - name: Install Cosign
      uses: sigstore/cosign-installer@main

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v2.2.0

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v2.9.0

    - name: Login to DockerHub
      uses: docker/login-action@v2.2.0
      with:
        username: ${{ secrets.FLOMESH_DOCKERHUB_USERNAME }}
        password: ${{ secrets.FLOMESH_DOCKERHUB_PASSWORD }}

    - name: Checkout
      uses: actions/checkout@v3
      with:
        fetch-depth: 0

    - name: Package Helm Charts
      run: make charts-tgz-rel

    - name: Docker meta - ${{ matrix.id }}
      id: docker_meta
      uses: crazy-max/ghaction-docker-meta@v4.6.0
      with:
        images: flomesh/erie-canal-${{ matrix.id }}
        tags: |
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern={{major}}.{{minor}}.{{patch}}
          type=sha,format=long
        flavor: |
          latest=auto

    - name: Build and Push - ${{ matrix.id }}
      id: docker_build_push
      uses: docker/build-push-action@v4.1.1
      with:
        context: .
        file: ./dockerfiles/${{ matrix.id }}/Dockerfile
        platforms: linux/amd64,linux/arm64
        push: ${{ (github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == format('refs/heads/{0}', github.event.repository.default_branch) )) }}
        tags: ${{ steps.docker_meta.outputs.tags }}
        labels: ${{ steps.docker_meta.outputs.labels }}
        build-args: |
          DISTROLESS_TAG=nonroot

    - name: Sign image with a key - ${{ matrix.id }}
      run: |
        cosign sign --yes --key env://COSIGN_PRIVATE_KEY flomesh/erie-canal-${{ matrix.id }}@${IMAGE_DIGEST}
      env:
        TAGS: ${{ steps.docker_meta.outputs.tags }}
        IMAGE_DIGEST: ${{ steps.docker_build_push.outputs.digest }}
        COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
        COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}

  release_project:
    name: Create Github Release
    runs-on: ubuntu-22.04
    needs:
    - build_and_push_images
    steps:
    - name: Checkout
      uses: actions/checkout@v3
      with:
        fetch-depth: 0

    - name: Fetch all tags
      run: git fetch --force --tags

    - name: Setup Go
      uses: actions/setup-go@v4
      with:
        go-version-file: 'go.mod'
        check-latest: true
        cache: true

    - name: Install packages
      run: sudo apt-get install -y git make

    - name: Import GPG key
      id: import_gpg
      uses: crazy-max/ghaction-import-gpg@v5
      with:
        gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
        passphrase: ${{ secrets.GPG_PASSPHRASE }}
        git_user_signingkey: true
        git_commit_gpgsign: true
        git_tag_gpgsign: true
        git_push_gpgsign: true

    - name: Run GoReleaser
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
      run: make gh-release