release.yml

name: Release - Tagged

on:
  push:
    tags:
      - v*.*.*

permissions:
  contents: write
  packages: write
  id-token: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  GOLANG_VERSION: 1.26.5

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 90
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Ensure release tag is on main
        shell: bash
        run: |
          set -euo pipefail

          git fetch --no-tags origin main:refs/remotes/origin/main
          tag_commit="$(git rev-list -n 1 "refs/tags/${GITHUB_REF_NAME}")"

          if ! git merge-base --is-ancestor "${tag_commit}" origin/main; then
            echo "::error::Release tags must point to commits already merged to main"
            exit 1
          fi

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.GOLANG_VERSION }}
          cache: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Login to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          distribution: goreleaser
          version: latest
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DOCKER_HUB_ORG: docker.io/${{ secrets.DOCKER_HUB_ORG }}

      - name: Verify signed images
        shell: bash
        env:
          DOCKER_HUB_ORG: docker.io/${{ secrets.DOCKER_HUB_ORG }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          retry() {
            local attempts=$1
            shift
            local n=1
            until "$@"; do
              if [ "$n" -ge "$attempts" ]; then
                echo "Command failed after $attempts attempts: $*"
                return 1
              fi
              n=$((n + 1))
              sleep $((5 * n))
            done
          }

          resolve_digest() {
            local image_ref=$1
            local digest

            digest="$(docker buildx imagetools inspect "${image_ref}" | awk '/Digest:/ {print $2; exit}')"
            if [ -z "${digest}" ]; then
              echo "Unable to resolve digest for ${image_ref}" >&2
              return 1
            fi

            printf '%s\n' "${digest}"
          }

          image_tag="${RELEASE_TAG#v}"

          for component in tls api cli; do
            image="${DOCKER_HUB_ORG}/osctrl-${component}"
            for tag in "${image_tag}" latest; do
              digest="$(retry 6 resolve_digest "${image}:${tag}")"

              retry 3 cosign verify \
                --certificate-identity-regexp "https://github.com/${{ github.repository }}/.github/workflows/.*" \
                --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
                "${image}@${digest}" >/dev/null
            done
          done