release.yml

name: Release Management

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version (e.g., v2.1.0)'
        required: false
        default: ''
      create_draft:
        description: 'Create as draft release'
        required: false
        type: boolean
        default: false
      prerelease:
        description: 'Mark as prerelease'
        required: false
        type: boolean
        default: false
env:
  REGISTRY: ghcr.io/grammatonic
  IMAGE_NAME: github-runner
jobs:
  validate-release:
    name: Validate Release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      is_prerelease: ${{ steps.version.outputs.is_prerelease }}
    steps:
      - name: Extract version from tag
        id: version
        run: |
          ref=${GITHUB_REF#refs/tags/}
          version="$ref"
          is_prerelease="false"
          if [[ "$version" == *-* ]]; then
            is_prerelease="true"
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "is_prerelease=$is_prerelease" >> "$GITHUB_OUTPUT"
          echo "Version: $version"
          echo "Is prerelease: $is_prerelease"
  build-standard-artifacts:
    name: Build Standard Artifacts
    runs-on: ubuntu-latest
    needs: [validate-release]
    permissions:
      contents: write
      packages: write
    outputs:
      image-digest: ${{ steps.build.outputs.digest }}
      image-tags: ${{ steps.meta.outputs.tags }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
      - name: Set up QEMU for multi-platform builds
        uses: docker/setup-qemu-action@v4
        with:
          platforms: linux/amd64,linux/arm64
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Log in to Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}},value=${{ needs.validate-release.outputs.version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ needs.validate-release.outputs.version }}
            type=semver,pattern={{major}},value=${{ needs.validate-release.outputs.version }}
            type=raw,value=latest,enable={{is_default_branch}}
      - name: Build and push runner image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: ./docker
          file: ./docker/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: |
            type=gha
            type=gha,scope=normal-runner
            type=gha,scope=buildcache
          cache-to: |
            type=gha,mode=max,scope=normal-runner
            type=gha,mode=max,scope=buildcache
          platforms: linux/amd64,linux/arm64
      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
          format: spdx-json
          output-file: sbom.spdx.json
      - name: Upload SBOM as artifact
        uses: actions/upload-artifact@v7
        with:
          name: sbom
          path: sbom.spdx.json
  build-chrome-artifacts:
    name: Build Chrome Artifacts
    runs-on: ubuntu-latest
    needs: [validate-release]
    permissions:
      contents: write
      packages: write
    outputs:
      image-digest: ${{ steps.build.outputs.digest }}
      image-tags: ${{ steps.meta.outputs.tags }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
      - name: Set up QEMU for multi-platform builds
        uses: docker/setup-qemu-action@v4
        with:
          platforms: linux/amd64
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Log in to Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/github-runner-chrome
          tags: |
            type=semver,pattern={{version}},value=${{ needs.validate-release.outputs.version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ needs.validate-release.outputs.version }}
            type=semver,pattern={{major}},value=${{ needs.validate-release.outputs.version }}
      - name: Build and push Chrome runner image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: ./docker
          file: ./docker/Dockerfile.chrome
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: |
            type=gha
            type=gha,scope=chrome-runner
            type=gha,scope=buildcache
          cache-to: |
            type=gha,mode=max,scope=chrome-runner
            type=gha,mode=max,scope=buildcache
          platforms: linux/amd64
      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ${{ env.REGISTRY }}/github-runner-chrome@${{ steps.build.outputs.digest }}
          format: spdx-json
          output-file: sbom-chrome.spdx.json
      - name: Upload SBOM as artifact
        uses: actions/upload-artifact@v7
        with:
          name: sbom-chrome
          path: sbom-chrome.spdx.json
  build-chrome-go-artifacts:
    name: Build Chrome-Go Runner Artifacts
    runs-on: ubuntu-latest
    needs: validate-release
    permissions:
      contents: write
      packages: write
    outputs:
      image-digest: ${{ steps.build.outputs.digest }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Log in to Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/github-runner-chrome-go
          tags: |
            type=semver,pattern={{version}},value=${{ needs.validate-release.outputs.version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ needs.validate-release.outputs.version }}
            type=semver,pattern={{major}},value=${{ needs.validate-release.outputs.version }}
      - name: Build and push Chrome-Go runner image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: ./docker
          file: ./docker/Dockerfile.chrome-go
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: |
            type=gha
            type=gha,scope=chrome-go-runner
            type=gha,scope=buildcache
          cache-to: |
            type=gha,mode=max,scope=chrome-go-runner
            type=gha,mode=max,scope=buildcache
          platforms: linux/amd64
      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ${{ env.REGISTRY }}/github-runner-chrome-go@${{ steps.build.outputs.digest }}
          format: spdx-json
          output-file: sbom-chrome-go.spdx.json
      - name: Upload SBOM as artifact
        uses: actions/upload-artifact@v7
        with:
          name: sbom-chrome-go
          path: sbom-chrome-go.spdx.json
  security-scan-release:
    name: Security Scan Release
    runs-on: ubuntu-latest
    needs: [build-standard-artifacts, build-chrome-artifacts, build-chrome-go-artifacts]
    permissions:
      contents: read
      security-events: write
    strategy:
      matrix:
        scan: [standard, chrome, chrome-go]
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
      - name: Install Trivy
        uses: ./.github/actions/install-trivy
      - name: Run Trivy vulnerability scanner (standard)
        if: matrix.scan == 'standard'
        uses: aquasecurity/trivy-action@0.35.0
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-standard-artifacts.outputs.image-digest }}
          format: "sarif"
          output: "release-security-scan.sarif"
          skip-setup-trivy: true
      - name: Run Trivy vulnerability scanner (chrome)
        if: matrix.scan == 'chrome'
        uses: aquasecurity/trivy-action@0.35.0
        with:
          image-ref: ${{ env.REGISTRY }}/github-runner-chrome@${{ needs.build-chrome-artifacts.outputs.image-digest }}
          format: "sarif"
          output: "release-chrome-security-scan.sarif"
          skip-setup-trivy: true
      - name: Run Trivy vulnerability scanner (chrome-go)
        if: matrix.scan == 'chrome-go'
        uses: aquasecurity/trivy-action@0.35.0
        with:
          image-ref: ${{ env.REGISTRY }}/github-runner-chrome-go@${{ needs.build-chrome-go-artifacts.outputs.image-digest }}
          format: "sarif"
          output: "release-chrome-go-security-scan.sarif"
          skip-setup-trivy: true
      - name: Upload security scan results (standard)
        if: matrix.scan == 'standard'
        uses: github/codeql-action/upload-sarif@v4
        continue-on-error: true
        with:
          sarif_file: "release-security-scan.sarif"
          category: "release-container-scan-standard"
      - name: Upload security scan results (chrome)
        if: matrix.scan == 'chrome'
        uses: github/codeql-action/upload-sarif@v4
        continue-on-error: true
        with:
          sarif_file: "release-chrome-security-scan.sarif"
          category: "release-container-scan-chrome"
      - name: Upload security scan results (chrome-go)
        if: matrix.scan == 'chrome-go'
        uses: github/codeql-action/upload-sarif@v4
        continue-on-error: true
        with:
          sarif_file: "release-chrome-go-security-scan.sarif"
          category: "release-container-scan-chrome-go"
      - name: Check for critical vulnerabilities (standard)
        if: matrix.scan == 'standard'
        run: |
          critical_count=$(jq '[.runs[].results[] | select(.level == "error")] | length' release-security-scan.sarif 2>/dev/null || echo "0")
          if [[ $critical_count -gt 0 ]]; then
            echo "::error::Critical vulnerabilities found in standard release image!"
            echo "::error::Cannot proceed with release. Please fix vulnerabilities first."
            exit 1
          fi
          echo "✅ No critical vulnerabilities found in standard image"
      - name: Check for critical vulnerabilities (chrome)
        if: matrix.scan == 'chrome'
        run: |
          critical_count=$(jq '[.runs[].results[] | select(.level == "error")] | length' release-chrome-security-scan.sarif 2>/dev/null || echo "0")
          if [[ $critical_count -gt 0 ]]; then
            echo "::error::Critical vulnerabilities found in Chrome release image!"
            echo "::error::Cannot proceed with release. Please fix vulnerabilities first."
            exit 1
          fi
          echo "✅ No critical vulnerabilities found in Chrome image"
      - name: Check for critical vulnerabilities (chrome-go)
        if: matrix.scan == 'chrome-go'
        run: |
          critical_count=$(jq '[.runs[].results[] | select(.level == "error")] | length' release-chrome-go-security-scan.sarif 2>/dev/null || echo "0")
          if [[ $critical_count -gt 0 ]]; then
            echo "::error::Critical vulnerabilities found in Chrome-Go release image!"
            echo "::error::Cannot proceed with release. Please fix vulnerabilities first."
            exit 1
          fi
          echo "✅ No critical vulnerabilities found in Chrome-Go image"
  create-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs: [validate-release, security-scan-release, build-standard-artifacts, build-chrome-artifacts, build-chrome-go-artifacts]
    permissions:
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Generate changelog
        id: changelog
        run: |
          version="${{ needs.validate-release.outputs.version }}"
          # Try to extract changelog for this version
          if [[ -f "CHANGELOG.md" ]]; then
            # Extract section for this version
            changelog_content=$(sed -n "/## $version/,/## /p" CHANGELOG.md | sed '$d' | tail -n +2)
          fi
          # If no specific changelog found, generate from commits
          if [[ -z "$changelog_content" ]]; then
            echo "Generating changelog from commits..."
            # Get the latest tag before this one
            previous_tag=$(git tag --sort=-version:refname | grep -v "$version" | head -n 1)
            if [[ -n "$previous_tag" ]]; then
              range="$previous_tag..HEAD"
            else
              range="HEAD"
            fi
            changelog_content="## Changes in $version\n\n"
            changelog_content+=$(git log $range --pretty=format:"- %s (%h)" --no-merges)
          fi
          # Save changelog to file
          echo -e "$changelog_content" > release-changelog.md
          echo "Generated changelog:"
          cat release-changelog.md
      - name: Create release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ needs.validate-release.outputs.version }}
          release_name: Release ${{ needs.validate-release.outputs.version }}
          body_path: release-changelog.md
          draft: false
          prerelease: ${{ needs.validate-release.outputs.is_prerelease }}