release.yml

name: Release

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to release (must already exist, e.g. v1.4.21)"
        required: true

permissions:
  contents: read    # least-privilege at top level; write scoped per job

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  IMAGE: ghcr.io/keiailab/postgres-operator

jobs:
  preflight:
    name: Chart.yaml ↔ tag parity
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.derive.outputs.version }}
      tag: ${{ steps.derive.outputs.tag }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ github.event.inputs.tag || github.ref }}
      - id: derive
        env:
          REF_NAME: ${{ github.ref_name }}
          DISPATCH_TAG: ${{ github.event.inputs.tag }}
        run: |
          set -euo pipefail
          TAG="${DISPATCH_TAG:-$REF_NAME}"
          VERSION="${TAG#v}"
          CHART_VER=$(grep '^version:' charts/postgres-operator/Chart.yaml | awk '{print $2}' | tr -d '"')
          APP_VER=$(grep '^appVersion:' charts/postgres-operator/Chart.yaml | awk '{print $2}' | tr -d '"')
          if [ "$CHART_VER" != "$VERSION" ]; then
            echo "::error::Chart.yaml version=$CHART_VER does not match tag=$VERSION"; exit 1
          fi
          if [ "$APP_VER" != "$VERSION" ]; then
            echo "::error::Chart.yaml appVersion=$APP_VER does not match tag=$VERSION"; exit 1
          fi
          echo "tag=$TAG"           >> "$GITHUB_OUTPUT"
          echo "version=$VERSION"   >> "$GITHUB_OUTPUT"
          echo "✓ tag=$TAG / version=$VERSION / appVersion=$APP_VER all aligned"

  image:
    name: Build & push multi-arch image
    needs: preflight
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write   # push to ghcr.io
    outputs:
      digest: ${{ steps.push.outputs.digest }}
      image: ${{ env.IMAGE }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ github.event.inputs.tag || github.ref }}
      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: ${{ env.IMAGE }}
          tags: |
            type=raw,value=${{ needs.preflight.outputs.version }}
            type=raw,value=${{ needs.preflight.outputs.tag }}
            type=semver,pattern={{major}}.{{minor}}
      - id: push
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: true
          sbom: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

  sign-image:
    name: Sign image (cosign keyless)
    needs: [preflight, image]
    runs-on: ubuntu-latest
    permissions:
      packages: write
      id-token: write     # OIDC token for keyless signing
    steps:
      - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: cosign sign image (digest-pinned)
        env:
          COSIGN_EXPERIMENTAL: "1"
          IMAGE_REF: ${{ needs.image.outputs.image }}@${{ needs.image.outputs.digest }}
        run: |
          set -euo pipefail
          echo "Signing $IMAGE_REF"
          cosign sign --yes "$IMAGE_REF"

  provenance:
    # SLSA-3 provenance attached to the GHCR image via slsa-github-generator.
    # The reusable workflow runs in an isolated builder + writes a non-falsifiable
    # provenance statement signed by the GitHub OIDC identity.
    needs: [preflight, image]
    permissions:
      actions: read
      id-token: write
      packages: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0
    with:
      image: ghcr.io/keiailab/postgres-operator
      digest: ${{ needs.image.outputs.digest }}
      registry-username: ${{ github.actor }}
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}

  sbom:
    name: SBOM (syft) + signature
    needs: [preflight, image]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read      # syft reads the GHCR image manifest
      id-token: write     # cosign keyless sign-blob
    steps:
      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
        with:
          image: ${{ env.IMAGE }}:${{ needs.preflight.outputs.version }}
          format: spdx-json
          output-file: postgres-operator-${{ needs.preflight.outputs.tag }}.spdx.json
      - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
      - name: cosign sign-blob (SBOM)
        env:
          COSIGN_EXPERIMENTAL: "1"
          SBOM_FILE: postgres-operator-${{ needs.preflight.outputs.tag }}.spdx.json
        run: |
          set -euo pipefail
          cosign sign-blob --yes \
            --output-signature   "${SBOM_FILE}.sig" \
            --output-certificate "${SBOM_FILE}.pem" \
            "${SBOM_FILE}"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: sbom
          path: |
            postgres-operator-${{ needs.preflight.outputs.tag }}.spdx.json
            postgres-operator-${{ needs.preflight.outputs.tag }}.spdx.json.sig
            postgres-operator-${{ needs.preflight.outputs.tag }}.spdx.json.pem

  notes:
    name: Release notes (git-cliff)
    needs: preflight
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          ref: ${{ github.event.inputs.tag || github.ref }}
      - uses: orhun/git-cliff-action@f50e11560dce63f7c33227798f90b924471a88b5 # v4
        with:
          config: cliff.toml
          args: --strip all --tag ${{ needs.preflight.outputs.tag }} --unreleased
        env:
          OUTPUT: CHANGES.md
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: release-notes
          path: CHANGES.md

  chart-tgz:
    name: Package & sign helm chart
    needs: preflight
    runs-on: ubuntu-latest
    permissions:
      id-token: write     # cosign keyless sign-blob
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ github.event.inputs.tag || github.ref }}
      - uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
        with: { version: latest }
      - name: helm package
        run: |
          mkdir -p out
          helm package charts/postgres-operator -d out/
      - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
      - name: cosign sign-blob (chart .tgz)
        env:
          COSIGN_EXPERIMENTAL: "1"
          VERSION: ${{ needs.preflight.outputs.version }}
        run: |
          set -euo pipefail
          CHART_TGZ="out/postgres-operator-${VERSION}.tgz"
          cosign sign-blob --yes \
            --output-signature   "${CHART_TGZ}.sig" \
            --output-certificate "${CHART_TGZ}.pem" \
            "${CHART_TGZ}"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: chart-tgz
          path: |
            out/postgres-operator-*.tgz
            out/postgres-operator-*.tgz.sig
            out/postgres-operator-*.tgz.pem

  github-release:
    name: Create GitHub Release
    needs: [preflight, image, sign-image, provenance, sbom, notes, chart-tgz]
    runs-on: ubuntu-latest
    permissions:
      contents: write   # `gh release create`
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with: { name: sbom,           path: assets }
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with: { name: release-notes,  path: assets }
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with: { name: chart-tgz,      path: assets }
      - name: Determine prerelease flag
        id: pre
        env:
          TAG: ${{ needs.preflight.outputs.tag }}
        run: |
          case "$TAG" in
            *beta*|*rc*|*alpha*) echo "prerelease=true"  >> "$GITHUB_OUTPUT" ;;
            *)                   echo "prerelease=false" >> "$GITHUB_OUTPUT" ;;
          esac
      - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
        with:
          tag_name: ${{ needs.preflight.outputs.tag }}
          name: ${{ needs.preflight.outputs.tag }}
          body_path: assets/CHANGES.md
          prerelease: ${{ steps.pre.outputs.prerelease == 'true' }}
          files: |
            assets/postgres-operator-${{ needs.preflight.outputs.version }}.tgz
            assets/postgres-operator-${{ needs.preflight.outputs.version }}.tgz.sig
            assets/postgres-operator-${{ needs.preflight.outputs.version }}.tgz.pem
            assets/postgres-operator-${{ needs.preflight.outputs.tag }}.spdx.json
            assets/postgres-operator-${{ needs.preflight.outputs.tag }}.spdx.json.sig
            assets/postgres-operator-${{ needs.preflight.outputs.tag }}.spdx.json.pem

  # ADR-0014 community-operators sync automation (RFC 0002 §7 예외 ③).
  sync-community-operators:
    needs: [preflight, github-release]
    runs-on: ubuntu-latest
    if: success() && !contains(needs.preflight.outputs.tag, 'beta') && !contains(needs.preflight.outputs.tag, 'rc') && !contains(needs.preflight.outputs.tag, 'alpha')
    permissions:
      contents: read
    steps:
      - name: Checkout release repo
        uses: actions/checkout@v6
        with:
          repository: keiailab/postgres-operator
          ref: ${{ needs.preflight.outputs.tag }}
          path: source
      - name: Checkout community-operators fork
        uses: actions/checkout@v6
        with:
          repository: eightynine01/community-operators
          token: ${{ secrets.COMMUNITY_OPERATORS_PAT }}
          path: community-operators
          fetch-depth: 0
      - name: Sync fork main with upstream
        working-directory: community-operators
        run: |
          git remote add upstream https://github.com/k8s-operatorhub/community-operators.git
          git fetch upstream main
          git reset --hard upstream/main
          git push origin main --force
      - name: Stage bundle for new version
        working-directory: community-operators
        run: |
          V="${{ needs.preflight.outputs.version }}"
          mkdir -p "operators/postgres-operator/$V"
          cp -r ../source/bundle/manifests "operators/postgres-operator/$V/"
          cp -r ../source/bundle/metadata "operators/postgres-operator/$V/"
          cp ../source/bundle.Dockerfile "operators/postgres-operator/$V/"
      - name: Commit + push fork branch + open upstream PR
        working-directory: community-operators
        env:
          GH_TOKEN: ${{ secrets.COMMUNITY_OPERATORS_PAT }}
        run: |
          V="${{ needs.preflight.outputs.version }}"
          BR="operator-postgres-operator-$V"
          git config user.name "keiailab-bot"
          git config user.email "phil@keiailab.com"
          git checkout -b "$BR"
          git add "operators/postgres-operator/"
          git commit -s -m "operator postgres-operator ($V)"
          git push -u origin "$BR"
          gh pr create --repo k8s-operatorhub/community-operators \
            --base main --head "eightynine01:$BR" \
            --title "operator postgres-operator ($V)" \
            --body "Auto-sync from release tag ${{ needs.preflight.outputs.tag }}. Refs ADR-0014."