name: 02-create_release
permissions: read-all
on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
  workflow_dispatch:
    inputs:
      skip_publish:
        description: "Skip publishing artifacts"
        required: false
        default: true
        type: boolean
jobs:
  release:
    permissions:
      actions: read
      checks: read
      contents: write
      deployments: read
      discussions: read
      id-token: write
      issues: read
      models: read
      packages: write
      pages: read
      pull-requests: read
      repository-projects: read
      statuses: read
      security-events: read
      attestations: read
      artifact-metadata: read
    runs-on: ubuntu-large
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-go@v5
        with:
          go-version: "1.25"

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.9"

      - name: Install system dependencies for system-tests
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libpq5 \
            libpq-dev \
            gcc \
            python3-dev
          sudo rm -rf /var/lib/apt/lists/*

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3.5.0

      - name: Create Cosign Key
        run: echo "${{ secrets.COSIGN_PRIVATE_KEY_V1 }}" > cosign.key

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Quay.io
        uses: docker/login-action@v3
        with:
          registry: quay.io
          username: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
          password: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}

      - uses: anchore/sbom-action/download-syft@v0
        name: Setup Syft

      - name: Create k8s Kind Cluster
        uses: helm/kind-action@v1.10.0
        with:
          cluster_name: kubescape-e2e

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser
          version: latest
          args: release --clean ${{ inputs.skip_publish == true && '--skip=publish' || '' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
          COSIGN_PWD: ${{ secrets.COSIGN_PRIVATE_KEY_V1_PASSWORD }}
          RELEASE: ${{ github.ref_name }}
          CLIENT: release
          RUN_E2E: "true"
          KUBESCAPE_SKIP_UPDATE_CHECK: "true"
          CUSTOMER: ${{ secrets.CUSTOMER }}
          USERNAME: ${{ secrets.USERNAME }}
          PASSWORD: ${{ secrets.PASSWORD }}
          CLIENT_ID: ${{ secrets.CLIENT_ID_PROD }}
          SECRET_KEY: ${{ secrets.SECRET_KEY_PROD }}
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}

      - name: List collected system-test results (debug)
        if: always()
        run: |
          echo "Listing test-results/system-tests (if any):"
          ls -laR test-results/system-tests || true

      - name: System Tests Report
        uses: mikepenz/action-junit-report@v5
        if: always()
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          report_paths: "test-results/system-tests/**/results_xml_format/**.xml"
          annotate_only: true
          job_summary: true