release.yml

name: Release - Tagged

on:
  push:
    tags:
      - v*.*.*

permissions:
  contents: write
  packages: write
  id-token: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  GOLANG_VERSION: 1.26.1

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 90
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GOLANG_VERSION }}
          cache: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Login to Docker Hub
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

      - name: Install cosign
        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
        with:
          distribution: goreleaser
          version: latest
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DOCKER_HUB_ORG: docker.io/${{ secrets.DOCKER_HUB_ORG }}

      - name: Verify signed images
        shell: bash
        env:
          DOCKER_HUB_ORG: docker.io/${{ secrets.DOCKER_HUB_ORG }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          retry() {
            local attempts=$1
            shift
            local n=1
            until "$@"; do
              if [ "$n" -ge "$attempts" ]; then
                echo "Command failed after $attempts attempts: $*"
                return 1
              fi
              n=$((n + 1))
              sleep $((5 * n))
            done
          }

          for component in tls admin api cli; do
            image="${DOCKER_HUB_ORG}/osctrl-${component}"
            for tag in "${RELEASE_TAG}" latest; do
              digest="$(docker buildx imagetools inspect "${image}:${tag}" | awk '/Digest:/ {print $2; exit}')"
              if [ -z "${digest}" ]; then
                echo "Unable to resolve digest for ${image}:${tag}"
                exit 1
              fi

              retry 3 cosign verify \
                --certificate-identity-regexp "https://github.com/${{ github.repository }}/.github/workflows/.*" \
                --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
                "${image}@${digest}" >/dev/null
            done
          done