release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:
    inputs:
      release_tag:
        description: Existing annotated pure numeric release tag to resume
        required: true
        type: string

permissions:
  contents: write
  packages: write
  id-token: write
  attestations: write

concurrency:
  group: network-plugin-manager-release-${{ inputs.release_tag || github.ref }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    env:
      SERVICE_NAME: ghcr.io/pasturestack/network-plugin-manager
      TRIVY_IMAGE: ghcr.io/aquasecurity/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
      RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}
    steps:
      - name: Check out immutable tag
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.release_tag || github.ref }}
          fetch-depth: 0
          persist-credentials: false

      - name: Resolve pure numeric release identity
        id: release_meta
        shell: bash
        run: |
          set -euo pipefail
          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
          test "$(git cat-file -t "refs/tags/$RELEASE_TAG")" = tag
          test "$(git rev-parse HEAD)" = "$(git rev-list -n 1 "$RELEASE_TAG")"
          version="${RELEASE_TAG#v}"
          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
          if [ "$GITHUB_EVENT_NAME" = push ]; then
            previous_version="$(
              git tag --list 'v*' \
                | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
                | grep -Fvx "$RELEASE_TAG" \
                | sed 's/^v//' \
                | sort -V \
                | tail -n 1
            )"
            if [ -n "$previous_version" ]; then
              test "$version" != "$previous_version"
              test "$(printf '%s\n%s\n' "$previous_version" "$version" | sort -V | tail -n 1)" = "$version"
            fi
          fi
          printf 'tag=%s\n' "$RELEASE_TAG" >> "$GITHUB_OUTPUT"
          printf 'version=%s\n' "$version" >> "$GITHUB_OUTPUT"
          printf 'service_image=%s:%s\n' "$SERVICE_NAME" "$RELEASE_TAG" >> "$GITHUB_OUTPUT"

      - name: Install checksum-pinned Go toolchain
        shell: bash
        run: |
          set -euo pipefail
          archive="$RUNNER_TEMP/go1.27.0.linux-amd64.tar.gz"
          curl --fail --silent --show-error --location --output "$archive" \
            'https://go.dev/dl/go1.27.0.linux-amd64.tar.gz'
          printf '%s  %s\n' \
            '675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685' \
            "$archive" | sha256sum --check
          tar -C "$RUNNER_TEMP" -xzf "$archive"
          printf '%s\n' "$RUNNER_TEMP/go/bin" >> "$GITHUB_PATH"
          printf 'GOROOT=%s\n' "$RUNNER_TEMP/go" >> "$GITHUB_ENV"

      - name: Test, build, and package the release
        shell: bash
        env:
          VERSION_OVERRIDE: ${{ steps.release_meta.outputs.tag }}
          SERVICE_IMAGE: ${{ steps.release_meta.outputs.service_image }}
        run: |
          set -euo pipefail
          ./scripts/test
          ./scripts/validate
          source_epoch="$(git show -s --format=%ct HEAD)"
          ./scripts/build
          first_sha="$(sha256sum bin/network-plugin-manager | awk '{print $1}')"
          rm -f bin/network-plugin-manager
          ./scripts/build
          test "$(sha256sum bin/network-plugin-manager | awk '{print $1}')" = "$first_sha"
          ARCH=amd64 TAG="$RELEASE_TAG" REPO=ghcr.io/pasturestack \
            SOURCE_DATE_EPOCH="$source_epoch" ./scripts/package
          test "$(wc -l < dist/images)" -eq 1
          grep -Fxq "$SERVICE_IMAGE" dist/images
          docker run --rm --entrypoint /usr/bin/network-plugin-manager "$SERVICE_IMAGE" --version \
            | grep -Fq "$RELEASE_TAG"

      - name: Scan release source, binary, and image
        shell: bash
        env:
          SERVICE_IMAGE: ${{ steps.release_meta.outputs.service_image }}
          VERSION: ${{ steps.release_meta.outputs.version }}
        run: |
          set -euo pipefail
          release_dir="dist/release"
          release_root="$release_dir/network-plugin-manager-${VERSION}-linux-amd64"
          mkdir -p "$release_root"
          cp bin/network-plugin-manager LICENSE ORIGIN.md SECURITY.md THIRD_PARTY_NOTICES.md "$release_root/"
          cp -R LICENSES "$release_root/third-party-licenses"

          docker pull "$TRIVY_IMAGE"
          cache="$RUNNER_TEMP/trivy-cache"
          mkdir -p "$cache"
          docker run --rm -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image --download-db-only
          docker run --rm -v "$PWD:/work:ro" -v "$PWD/$release_dir:/release" \
            -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" fs \
            --skip-db-update --offline-scan --scanners vuln,secret \
            --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --exit-code 1 /work
          docker run --rm -v "$PWD:/work:ro" -v "$PWD/$release_dir:/release" \
            -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" fs \
            --skip-db-update --offline-scan --format cyclonedx \
            --output "/release/network-plugin-manager-${VERSION}-source.cdx.json" /work
          docker run --rm -v "$PWD/bin:/product:ro" -v "$cache:/root/.cache/trivy" \
            "$TRIVY_IMAGE" rootfs --skip-db-update --offline-scan --scanners vuln \
            --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --exit-code 1 /product
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
            -v "$PWD/$release_dir:/release" -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image \
            --skip-db-update --offline-scan --scanners vuln,secret \
            --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --exit-code 1 "$SERVICE_IMAGE"
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
            -v "$PWD/$release_dir:/release" -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image \
            --skip-db-update --offline-scan --format cyclonedx \
            --output "/release/network-plugin-manager-${VERSION}-image.cdx.json" "$SERVICE_IMAGE"

          python3 - "$release_dir" "$VERSION" <<'PY'
          import json, pathlib, sys
          root = pathlib.Path(sys.argv[1])
          version = sys.argv[2]
          for scope in ('source', 'image'):
              bom = json.loads((root / f'network-plugin-manager-{version}-{scope}.cdx.json').read_text())
              assert bom.get('serialNumber')
              assert len(bom.get('components') or []) > 0
              assert len(bom.get('dependencies') or []) > 0
          PY

          source_epoch="$(git show -s --format=%ct HEAD)"
          find "$release_root" -exec touch -h -d "@${source_epoch}" {} +
          tar --sort=name --mtime="@${source_epoch}" --owner=0 --group=0 --numeric-owner \
            -C "$release_dir" -cJf "$release_dir/network-plugin-manager-${VERSION}-linux-amd64.tar.xz" \
            "network-plugin-manager-${VERSION}-linux-amd64"
          (
            cd "$release_dir"
            sha256sum \
              "network-plugin-manager-${VERSION}-linux-amd64.tar.xz" \
              "network-plugin-manager-${VERSION}-source.cdx.json" \
              "network-plugin-manager-${VERSION}-image.cdx.json" \
              > SHA256SUMS
          )

      - name: Publish immutable runtime image
        id: publish
        shell: bash
        env:
          GHCR_TOKEN: ${{ github.token }}
          SERVICE_IMAGE: ${{ steps.release_meta.outputs.service_image }}
        run: |
          set -euo pipefail
          printf '%s' "$GHCR_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
          docker push "$SERVICE_IMAGE"
          reference="$(docker image inspect --format '{{index .RepoDigests 0}}' "$SERVICE_IMAGE")"
          digest="${reference#*@}"
          [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]
          printf 'service_digest=%s\n' "$digest" >> "$GITHUB_OUTPUT"
          {
            printf 'image=%s\n' "$SERVICE_IMAGE"
            printf 'digest=%s\n' "$digest"
            printf 'source_commit=%s\n' "$(git rev-parse HEAD)"
          } > dist/release/published.txt
          (
            cd dist/release
            sha256sum published.txt >> SHA256SUMS
          )

      - name: Attest release assets
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-checksums: dist/release/SHA256SUMS

      - name: Attest runtime image
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-name: ${{ env.SERVICE_NAME }}
          subject-digest: ${{ steps.publish.outputs.service_digest }}
          push-to-registry: true

      - name: Publish GitHub release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.release_meta.outputs.version }}
        run: |
          set -euo pipefail
          gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --verify-tag \
            --title "Network Plugin Manager ${VERSION}" \
            --notes 'PastureStack network reconciliation runtime with current security updates, SBOMs, checksums, and build provenance.' \
            "dist/release/network-plugin-manager-${VERSION}-linux-amd64.tar.xz" \
            "dist/release/network-plugin-manager-${VERSION}-source.cdx.json" \
            "dist/release/network-plugin-manager-${VERSION}-image.cdx.json" \
            dist/release/SHA256SUMS \
            dist/release/published.txt

      - name: Clean owned runner resources
        if: always()
        shell: bash
        env:
          SERVICE_IMAGE: ${{ steps.release_meta.outputs.service_image }}
        run: |
          set +e
          docker logout ghcr.io >/dev/null 2>&1
          docker image rm -f "$SERVICE_IMAGE" "$TRIVY_IMAGE" 2>/dev/null