release.yaml

name: Release

on:
  release:
    types:
      - released

permissions:
  contents: read

jobs:
  image:
    runs-on: ubuntu-24.04
    name: Build release image
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    environment:
      name: dockerhub
      url: https://hub.docker.com/r/danielflook/terraform-github-actions/tags?name=${{ github.event.release.tag_name }}
    outputs:
      digest: ${{ steps.image_build.outputs.digest }}
      base-digest: ${{ steps.image_build.outputs.base-digest }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Check action documentation is up-to-date
        run: |
          PYTHONPATH=docs-gen python3 docs-gen/generate.py
          git diff --exit-code

      - name: Registry login
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
        run: |
          echo "$GITHUB_TOKEN" | docker login ghcr.io --username dflook --password-stdin
          echo "$DOCKER_TOKEN" | docker login --username danielflook --password-stdin

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Build action image
        id: image_build
        env:
          RELEASE_TAG: "${{ github.event.release.tag_name }}"
          GH_TOKEN: ${{ github.token }}
        run: |
          BASE_TAG=$(docker buildx imagetools inspect danielflook/terraform-github-actions-base:latest --format '{{json .}}' | jq -r '.manifest.annotations."ref.tag"')
          BASE_DIGEST=$(docker buildx imagetools inspect "danielflook/terraform-github-actions-base:$BASE_TAG" --format '{{json .}}' | jq -r '.manifest.digest')

          gh attestation verify --repo dflook/terraform-github-actions "oci://index.docker.io/danielflook/terraform-github-actions-base@$BASE_DIGEST"

          sed -i "s|FROM danielflook/terraform-github-actions-base:latest|FROM danielflook/terraform-github-actions-base@$BASE_DIGEST|" "image/Dockerfile"

          docker buildx build \
            --build-arg FETCH_CHECKSUMS=yes \
            --build-arg VERSION="${RELEASE_TAG:1}" \
            --tag "danielflook/terraform-github-actions:$RELEASE_TAG" \
            --tag "ghcr.io/dflook/terraform-github-actions:$RELEASE_TAG" \
            --platform linux/amd64,linux/arm64 \
            --attest "type=provenance,mode=max,builder-id=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
            --annotation "index,manifest:org.opencontainers.image.created=$(date '+%Y-%m-%dT%H:%M:%S%z')" \
            --annotation "index,manifest:org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
            --annotation "index,manifest:org.opencontainers.image.revision=${{ github.sha }}" \
            --annotation "index,manifest:org.opencontainers.image.version=$RELEASE_TAG" \
            --annotation "index,manifest:org.opencontainers.image.title=terraform-github-actions" \
            --annotation "index,manifest:org.opencontainers.image.description=GitHub actions for terraform" \
            --annotation "index:org.opencontainers.image.ref.name=docker.io/danielflook/terraform-github-actions:$RELEASE_TAG" \
            --annotation "index,manifest:builder-id=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
            --annotation "index,manifest:ref.tag=$RELEASE_TAG" \
            --annotation "index,manifest:org.opencontainers.image.base.name=docker.io/danielflook/terraform-github-actions-base" \
            --annotation "index,manifest:base.manifest.digest=$BASE_DIGEST" \
            --annotation "index:org.opencontainers.image.base.ref=$BASE_TAG" \
            --push \
            --iidfile manifest-list-digest.txt \
            image

          echo "digest=$(<manifest-list-digest.txt)" >> "$GITHUB_OUTPUT"
          echo "base-digest=$BASE_DIGEST" >> "$GITHUB_OUTPUT"

      - name: Dockerhub ref attestation
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-name: index.docker.io/danielflook/terraform-github-actions
          subject-digest: ${{ steps.image_build.outputs.digest }}

      - name: GHCR ref attestation
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-name: ghcr.io/dflook/terraform-github-actions
          subject-digest: ${{ steps.image_build.outputs.digest }}

  actions:
    runs-on: ubuntu-24.04
    name: Release Actions
    needs:
      - image
    environment:
      name: release
      url: https://github.com/dflook/terraform-github-actions/releases/tag/${{ github.event.release.tag_name }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Configure git
        env:
          GPG_KEY: ${{ secrets.RELEASE_GPG_KEY }}
        run: |
          echo "$GPG_KEY" | gpg --import
          git config --global user.name "Daniel Flook"
          git config --global user.email "daniel@flook.org"
          git config --global user.signingkey "26AAA6B35318E5B7CF0823170FDD1CF4BEE12274"
          git config --global commit.gpgSign true
          git config --global tag.gpgSign true

      - name: Release actions
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
          RELEASE_TAG: "${{ github.event.release.tag_name }}"
          IMAGE_DIGEST: ${{ needs.image.outputs.digest }}
        run: |
          major=$(echo "$RELEASE_TAG" | cut -d. -f1)
          minor=$(echo "$RELEASE_TAG" | cut -d. -f2)
          export major
          export minor

          function prepare_release() {
              rsync -r "$GITHUB_WORKSPACE/$action/" "$HOME/$action"
              rm -rf "$HOME/$action/.github"
              mkdir "$HOME/$action/.github"
              cp "$GITHUB_WORKSPACE/.github/FUNDING.yml" "$HOME/$action/.github/FUNDING.yml"
          }

          for action in $(cd "$GITHUB_WORKSPACE" && find . -name action.yaml -printf "%h\n" | sed 's/^.\///'); do

            if git clone "https://dflook:$GITHUB_TOKEN@github.com/dflook/$action.git" "$HOME/$action"; then
              echo "Releasing dflook/$action@$RELEASE_TAG"

              # git tags that use DockerHub for the image
              prepare_release
              sed -i "s|  image:.*|  image: docker://danielflook/terraform-github-actions@$IMAGE_DIGEST|" "$HOME/$action/action.yaml"

              git -C "$HOME/$action" add -A
              git -C "$HOME/$action" commit -m "$RELEASE_TAG"
              git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$RELEASE_TAG"
              git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$major"
              git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$major.$minor"
              git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$RELEASE_TAG-dockerhub"
              git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$major-dockerhub"
              git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$major.$minor-dockerhub"
              git -C "$HOME/$action" push --force
              git -C "$HOME/$action" push --force --tags

              # git tags that use GitHub Container Registry for the image
              git -C "$HOME/$action" checkout ghcr || git -C "$HOME/$action" checkout -b ghcr
              prepare_release
              sed -i "s|  image:.*|  image: docker://ghcr.io/dflook/terraform-github-actions@$IMAGE_DIGEST|" "$HOME/$action/action.yaml"

              git -C "$HOME/$action" add -A
              git -C "$HOME/$action" commit -m "$RELEASE_TAG-ghcr"
              git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$RELEASE_TAG-ghcr"
              git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$major-ghcr"
              git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$major.$minor-ghcr"
              git -C "$HOME/$action" push --set-upstream origin ghcr --force
              git -C "$HOME/$action" push --force --tags

              # Create the github release
              cat "$GITHUB_WORKSPACE/.github/release_template.md" \
               | envsubst \
               | jq --slurp --raw-input --arg RELEASE_TAG "$RELEASE_TAG" '{"tag_name": $RELEASE_TAG, "name": $RELEASE_TAG, "body": . }' \
               | curl -X POST \
                   --user "dflook:$GITHUB_TOKEN" \
                   --header "Content-Type: application/json" \
                   --data-binary @- \
                   "https://api.github.com/repos/dflook/$action/releases"

            else
              echo "Skipping dflook/$action"
            fi
          done

  tag-base-image:
    runs-on: ubuntu-24.04
    name: Tag base image with release version
    needs:
      - image
      - actions
    permissions: {}
    environment:
      name: dockerhub
      url: https://hub.docker.com/r/danielflook/terraform-github-actions-base/tags?name=${{ github.event.release.tag_name }}
    steps:
      - name: Registry login
        env:
          DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
        run: |
          echo "$DOCKER_TOKEN" | docker login --username danielflook --password-stdin

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Tag and push base image with release version
        env:
          RELEASE_TAG: "${{ github.event.release.tag_name }}"
          BASE_DIGEST: ${{ needs.image.outputs.base-digest }}
        run: |
          # Tag the base image manifest list with the release version
          docker buildx imagetools create \
            --tag "danielflook/terraform-github-actions-base:$RELEASE_TAG" \
            "danielflook/terraform-github-actions-base@$BASE_DIGEST"