k3k/.github/workflows/release.yml

name: Release

on:
  push:
    tags:
    - "v*"
  workflow_dispatch:
    inputs:
      commit:
        type: string
        description: Checkout a specific commit

permissions:
    contents: write
    packages: write
    id-token: write

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      with:
        fetch-depth: 0
        fetch-tags: true
    
    - name: Checkout code at the specific commit
      if: inputs.commit != ''
      run: git checkout ${{ inputs.commit }}

    - name: Set up Go
      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
      with:
        go-version-file: go.mod

    - name: Set up QEMU
      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
      with:
        image: tonistiigi/binfmt:qemu-v10.0.4-56

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
      with:
        version: v0.30.1

    - name: "Read secrets"
      uses: rancher-eio/read-vault-secrets@0da85151ad1f19ed7986c41587e45aac1ace74b6 # v3
      if: github.repository_owner == 'rancher'
      with:
        secrets: |
          secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials username | DOCKER_USERNAME ;
          secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | DOCKER_PASSWORD ;

    # Manually dispatched workflows (or forks) will use ghcr.io
    - name: Setup ghcr.io
      if: github.event_name == 'workflow_dispatch' || github.repository_owner != 'rancher'
      run: |
        echo "REGISTRY=ghcr.io"                     >> $GITHUB_ENV
        echo "DOCKER_USERNAME=${{ github.actor }}"  >> $GITHUB_ENV
        echo "DOCKER_PASSWORD=${{ github.token }}"  >> $GITHUB_ENV

    - name: Login to container registry
      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ env.DOCKER_USERNAME }}
        password: ${{ env.DOCKER_PASSWORD }}
    
    # If the tag does not exists the workflow was manually triggered.
    # That means we are creating temporary nightly builds, with a "fake" local tag
    - name: Check release tag
      id: release-tag
      run: |
        CURRENT_TAG=$(git describe --tag --always --match="v[0-9]*")

        if git show-ref --tags ${CURRENT_TAG} --quiet; then
          echo "tag ${CURRENT_TAG} already exists";
        else
          echo "tag ${CURRENT_TAG} does not exist"
          git tag ${CURRENT_TAG}
        fi

        echo "CURRENT_TAG=${CURRENT_TAG}" >> "$GITHUB_OUTPUT"

    - name: Run GoReleaser
      uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7
      with:
        distribution: goreleaser
        version: v2
        args: --clean
      env:
        GITHUB_TOKEN: ${{ github.token }}
        GORELEASER_CURRENT_TAG: ${{ steps.release-tag.outputs.CURRENT_TAG }}
        REGISTRY: ${{ env.REGISTRY }}
        REPO: ${{ github.repository }}