release-rc.yml

# Copyright 2021 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: release-rc

on:
  workflow_dispatch:
    inputs:
      releaseType:
        description: "Release types: (M - major); (m - minor); (p - patch)"
        required: true

permissions: read-all
jobs:
  ReleaseRC:
    permissions:
      contents: write
      packages: write
      issues:   write
    runs-on: ubuntu-latest
    env:
      COSIGN_KEY_LOCATION: "/tmp/cosign.key" #private key used to sing the artefacts and images location.
      COSIGN_PWD: ${{ secrets.COSIGN_PWD }}
    if: contains('["wiliansilvazup","matheusalcantarazup","lucasbrunozup","nathanmartinszup","iancardosozup","oliveirafelipezup"]', github.actor)
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
          token: ${{ secrets.HORUSEC_PUSH_TOKEN }}

      - name: Set up Go
        uses: actions/setup-go@v3
        with:
          go-version: 1.17

      - name: Set up nodejs
        uses: actions/setup-node@v3
        with:
          node-version: 12

      - name: Docker Login
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Install Mage
        run: go install github.com/magefile/mage@v1.11

      # Set the default GitHub config with the user:horusec and email:horusec@zup.com.br.
      - name: Git config
        run: mage DefaultGitConfig

      - name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@v4
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSWORD }}
          git_user_signingkey: true
          git_commit_gpgsign: true

      - name: Cosign Installer
        uses: sigstore/cosign-installer@main
        with:
          cosign-release: "v1.2.0"

      # This step creates a file containing the private key used to sing the release artefacts and images.
      - name: Install cosign private key
        run: mage WriteCosignKeyToFile
        env:
          COSIGN_KEY: ${{secrets.COSIGN_KEY}}

      # Run a script contained in the devkit repository that gets the latest release version and create an output
      # containing the next versions.
      - name: Version increment
        id: updated-version
        run: mage UpVersions ${{ github.event.inputs.releaseType }}
        env:
          HORUSEC_REPOSITORY_ORG: ${{ github.repository_owner }}
          HORUSEC_REPOSITORY_NAME: ${{ github.event.repository.name }}

      - name: Checkout Release Branch
        run: mage CheckoutReleaseBranch ${{ steps.updated-version.outputs.nextReleaseBranchName }}

      # Creates a tag with the next version created during the last step
      - name: Create and push tag
        run: mage -v createAndPushTag ${{ steps.updated-version.outputs.nextRCVersion }}

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v2
        with:
          distribution: goreleaser
          version: latest
          args: release --rm-dist
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          COSIGN_PWD: ${{ secrets.COSIGN_PWD }}
          GORELEASER_CURRENT_TAG: ${{ steps.updated-version.outputs.nextRCVersion }}
          GORELEASER_PREVIOUS_TAG: ${{ steps.updated-version.outputs.actualRCVersion }}

      # Publish the release and tag using mage
      - name: Push All
        if: ${{ success() }}
        run: mage -v gitPushAll

      - name: Remove updates
        if: ${{ !success() }}
        run: mage -v removeTag ${{ steps.updated-version.outputs.nextRCVersion }}