ci: migrate to shared release and promote workflows

.github/workflows/promote.yaml

@@ -7,6 +7,8 @@ on:
       - "v*"
 
 jobs:
+  # Unchanged: builds and pushes the container image, and publishes the
+  # manifests to artifacts.scality.net, before the release is created.
   build:
     uses: ./.github/workflows/build.yaml
     secrets: inherit
@@ -17,7 +19,17 @@ jobs:
 
   create-release:
     needs: build
+    uses: scality/workflows/.github/workflows/promote.yaml@7d91dc4ebbe136b54518aa42a1ad6014f8f91526 # v2.9.1
+    permissions:
+      contents: write
+
+  # The shared promote only creates the release; re-attach the manifests that
+  # the previous inline job attached at creation time.
+  attach-artifacts:
+    needs: create-release
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -43,15 +55,8 @@ jobs:
           curl --fail -LO -u ${{ secrets.ARTIFACTS_USER }}:${{ secrets.ARTIFACTS_PASSWORD }}
           ${{ steps.artifacts.outputs.link }}/crds.yaml
 
-      - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
-        with:
-          name: Disk Management Agent ${{ github.ref_name }}
-          tag_name: ${{ github.ref_name }}
-          generate_release_notes: true
-          prerelease: ${{ contains(github.ref_name, '-') }}
-          draft: false
-          files: |
-            install.yaml
-            crds.yaml
+      - name: Attach the manifests to the release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: gh release upload "$TAG" install.yaml crds.yaml --clobber

.github/workflows/release.yaml

@@ -23,61 +23,16 @@ on:
           - "minor"
           - "major"
 
-jobs:
-  prepare-version:
-    runs-on: ubuntu-24.04
-    if: github.ref_name == 'main'
-    steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        id: app-token
-        # NOTE: This is needed otherwise it's the same user that creates the tag
-        # as the one triggering the workflow on push tag, which does not work.
-        with:
-          app-id: ${{ vars.ACTIONS_APP_ID }}
-          private-key: ${{ secrets.ACTIONS_APP_PRIVATE_KEY }}
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          fetch-depth: 0
-          token: ${{ steps.app-token.outputs.token }}
-      - name: Install semver tool
-        run: |
-          curl --fail -LO https://raw.githubusercontent.com/fsaintjacques/semver-tool/3.4.0/src/semver
-          chmod +x ./semver
-      - name: Compose release tag
-        run: |
-          last_ga_tag=$(git tag --sort=taggerdate --list "v*" | grep -v '\-' | tail -n 1)
-          if [[ -z "$last_ga_tag" ]]; then
-            last_ga_tag="0.0.0"
-          fi
-
-          new_version=$(./semver bump ${{ inputs.version-scope }} "$last_ga_tag")
-
-          if [[ "${{ inputs.version-type }}" == "alpha" ]] || [[ "${{ inputs.version-type }}" == "beta" ]]; then
-            last_pre_tag=$(git tag --sort=taggerdate --list "v$new_version-${{ inputs.version-type }}.*" | tail -n 1)
-            if [[ -z "$last_pre_tag" ]]; then
-              new_version=$new_version-${{ inputs.version-type }}.1
-            else
-              new_version=$(./semver bump prerel "$last_pre_tag")
-            fi
-          fi
-
-          if [[ "${new_version:0:1}" != "v" ]]; then
-            new_version="v$new_version"
-          fi
+# The GITHUB_TOKEN only needs to read the repository; the tag is pushed by the
+# reusable workflow with the GitHub App token.
+permissions:
+  contents: read
 
-          echo "New version: $new_version"
-          echo "RELEASE_TAG=$new_version" >> $GITHUB_ENV
-      - name: Validate release tag
-        run: ./semver validate "$RELEASE_TAG"
-
-      - name: Create and push release tag
-        run: |
-          git fsck
-          git gc
-
-          git config --global user.email ${{ github.actor }}@scality.com
-          git config --global user.name ${{ github.actor }}
-
-          git tag -a "$RELEASE_TAG" -m "Disk Management Agent $RELEASE_TAG"
-          git push origin "$RELEASE_TAG"
+jobs:
+  release:
+    uses: scality/workflows/.github/workflows/release.yaml@7d91dc4ebbe136b54518aa42a1ad6014f8f91526 # v2.9.1
+    with:
+      version-type: ${{ inputs.version-type }}
+      version-scope: ${{ inputs.version-scope }}
+      actions-app-id: ${{ vars.ACTIONS_APP_ID }}
+    secrets: inherit