From 8a64c3563ea49c96ce80990a14e04b2e300fb164 Mon Sep 17 00:00:00 2001
From: Alex Rodriguez <131964409+ezekiel-alexrod@users.noreply.github.com>
Date: Mon, 13 Jul 2026 15:58:56 +0200
Subject: [PATCH] ci: migrate to shared release and promote workflows

Replace the inline tag-computation and GitHub-release logic with the
reusable workflows from scality/workflows@v2.9.1.

The local build workflow is unchanged and still gates the release
(build -> create-release), so a broken image build keeps blocking the
GitHub Release. A dedicated attach-artifacts job re-attaches
install.yaml and crds.yaml to the release, since the shared promote
workflow only creates the release itself.

The release title now defaults to the tag alone (previously prefixed
with the product name), following the shared workflow convention.
---
 .github/workflows/promote.yaml | 27 +++++++------
 .github/workflows/release.yaml | 69 ++++++----------------------------
 2 files changed, 28 insertions(+), 68 deletions(-)

diff --git a/.github/workflows/promote.yaml b/.github/workflows/promote.yaml
index 3d2675a..a44edf3 100644
--- a/.github/workflows/promote.yaml
+++ b/.github/workflows/promote.yaml
@@ -7,6 +7,8 @@ on:
       - "v*"
 
 jobs:
+  # Unchanged: builds and pushes the container image, and publishes the
+  # manifests to artifacts.scality.net, before the release is created.
   build:
     uses: ./.github/workflows/build.yaml
     secrets: inherit
@@ -17,7 +19,17 @@ jobs:
 
   create-release:
     needs: build
+    uses: scality/workflows/.github/workflows/promote.yaml@7d91dc4ebbe136b54518aa42a1ad6014f8f91526 # v2.9.1
+    permissions:
+      contents: write
+
+  # The shared promote only creates the release; re-attach the manifests that
+  # the previous inline job attached at creation time.
+  attach-artifacts:
+    needs: create-release
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -43,15 +55,8 @@ jobs:
           curl --fail -LO -u ${{ secrets.ARTIFACTS_USER }}:${{ secrets.ARTIFACTS_PASSWORD }}
           ${{ steps.artifacts.outputs.link }}/crds.yaml
 
-      - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
-        with:
-          name: Disk Management Agent ${{ github.ref_name }}
-          tag_name: ${{ github.ref_name }}
-          generate_release_notes: true
-          prerelease: ${{ contains(github.ref_name, '-') }}
-          draft: false
-          files: |
-            install.yaml
-            crds.yaml
+      - name: Attach the manifests to the release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: gh release upload "$TAG" install.yaml crds.yaml --clobber
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 6ff7f60..cb9fbbd 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -23,61 +23,16 @@ on:
           - "minor"
           - "major"
 
-jobs:
-  prepare-version:
-    runs-on: ubuntu-24.04
-    if: github.ref_name == 'main'
-    steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        id: app-token
-        # NOTE: This is needed otherwise it's the same user that creates the tag
-        # as the one triggering the workflow on push tag, which does not work.
-        with:
-          app-id: ${{ vars.ACTIONS_APP_ID }}
-          private-key: ${{ secrets.ACTIONS_APP_PRIVATE_KEY }}
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          fetch-depth: 0
-          token: ${{ steps.app-token.outputs.token }}
-      - name: Install semver tool
-        run: |
-          curl --fail -LO https://raw.githubusercontent.com/fsaintjacques/semver-tool/3.4.0/src/semver
-          chmod +x ./semver
-      - name: Compose release tag
-        run: |
-          last_ga_tag=$(git tag --sort=taggerdate --list "v*" | grep -v '\-' | tail -n 1)
-          if [[ -z "$last_ga_tag" ]]; then
-            last_ga_tag="0.0.0"
-          fi
-
-          new_version=$(./semver bump ${{ inputs.version-scope }} "$last_ga_tag")
-
-          if [[ "${{ inputs.version-type }}" == "alpha" ]] || [[ "${{ inputs.version-type }}" == "beta" ]]; then
-            last_pre_tag=$(git tag --sort=taggerdate --list "v$new_version-${{ inputs.version-type }}.*" | tail -n 1)
-            if [[ -z "$last_pre_tag" ]]; then
-              new_version=$new_version-${{ inputs.version-type }}.1
-            else
-              new_version=$(./semver bump prerel "$last_pre_tag")
-            fi
-          fi
-
-          if [[ "${new_version:0:1}" != "v" ]]; then
-            new_version="v$new_version"
-          fi
+# The GITHUB_TOKEN only needs to read the repository; the tag is pushed by the
+# reusable workflow with the GitHub App token.
+permissions:
+  contents: read
 
-          echo "New version: $new_version"
-          echo "RELEASE_TAG=$new_version" >> $GITHUB_ENV
-      - name: Validate release tag
-        run: ./semver validate "$RELEASE_TAG"
-
-      - name: Create and push release tag
-        run: |
-          git fsck
-          git gc
-
-          git config --global user.email ${{ github.actor }}@scality.com
-          git config --global user.name ${{ github.actor }}
-
-          git tag -a "$RELEASE_TAG" -m "Disk Management Agent $RELEASE_TAG"
-          git push origin "$RELEASE_TAG"
+jobs:
+  release:
+    uses: scality/workflows/.github/workflows/release.yaml@7d91dc4ebbe136b54518aa42a1ad6014f8f91526 # v2.9.1
+    with:
+      version-type: ${{ inputs.version-type }}
+      version-scope: ${{ inputs.version-scope }}
+      actions-app-id: ${{ vars.ACTIONS_APP_ID }}
+    secrets: inherit