release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'

permissions:
  contents: write
  packages: write
  id-token: write
  attestations: write

concurrency:
  group: load-balancer-controller-release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-24.04
    timeout-minutes: 150
    env:
      SERVICE_NAME: ghcr.io/pasturestack/load-balancer-service
      TRIVY_IMAGE: ghcr.io/aquasecurity/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
    steps:
      - name: Check out immutable tag
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Resolve release identity
        id: release_meta
        shell: bash
        run: |
          set -euo pipefail
          test "$GITHUB_REF_TYPE" = 'tag'
          test "$(git rev-parse HEAD)" = "$(git rev-list -n 1 "$GITHUB_REF_NAME")"
          version="${GITHUB_REF_NAME#v}"
          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
          printf 'version=%s\n' "$version" >> "$GITHUB_OUTPUT"
          printf 'service_image=%s:%s\n' "$SERVICE_NAME" "$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"

      - name: Install checksum-pinned Go toolchain
        shell: bash
        run: |
          set -euo pipefail
          archive="$RUNNER_TEMP/go1.27.0.linux-amd64.tar.gz"
          curl --fail --silent --show-error --location --output "$archive" \
            'https://go.dev/dl/go1.27.0.linux-amd64.tar.gz'
          printf '%s  %s\n' \
            '675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685' \
            "$archive" | sha256sum --check
          tar -C "$RUNNER_TEMP" -xzf "$archive"
          printf '%s\n' "$RUNNER_TEMP/go/bin" >> "$GITHUB_PATH"
          printf 'GOROOT=%s\n' "$RUNNER_TEMP/go" >> "$GITHUB_ENV"

      - name: Test, build, and package the release
        shell: bash
        env:
          VERSION_OVERRIDE: ${{ github.ref_name }}
          SERVICE_IMAGE: ${{ steps.release_meta.outputs.service_image }}
        run: |
          set -euo pipefail
          ./scripts/test
          ./scripts/validate
          source_epoch="$(git show -s --format=%ct HEAD)"
          scripts/build
          ARCH=amd64 TAG="$GITHUB_REF_NAME" REPO=ghcr.io/pasturestack \
            SOURCE_DATE_EPOCH="$source_epoch" scripts/package
          test "$(wc -l < dist/images)" -eq 1
          grep -Fxq "$SERVICE_IMAGE" dist/images
          docker run --rm --entrypoint /usr/bin/lb-controller "$SERVICE_IMAGE" --version \
            | grep -Fq "$GITHUB_REF_NAME"
          docker run --rm --entrypoint /usr/sbin/haproxy "$SERVICE_IMAGE" -vv \
            | grep -Fq 'HAProxy version 3.4.3'

      - name: Scan and create release SBOMs
        shell: bash
        env:
          SERVICE_IMAGE: ${{ steps.release_meta.outputs.service_image }}
          VERSION: ${{ steps.release_meta.outputs.version }}
        run: |
          set -euo pipefail
          release_dir="dist/release"
          release_root="$release_dir/load-balancer-controller-${VERSION}-linux-amd64"
          mkdir -p "$release_root"
          cp bin/lb-controller LICENSE ORIGIN.md "$release_root/"
          ./scripts/vendor-licenses "$release_root/third-party-licenses"

          docker pull "$TRIVY_IMAGE"
          cache="$RUNNER_TEMP/trivy-cache"
          mkdir -p "$cache"
          docker run --rm -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image --download-db-only
          docker run --rm -v "$PWD:/work:ro" -v "$PWD/$release_dir:/release" \
            -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" fs \
            --skip-db-update --offline-scan --scanners vuln,secret \
            --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --exit-code 1 /work
          docker run --rm -v "$PWD:/work:ro" -v "$PWD/$release_dir:/release" \
            -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" fs \
            --skip-db-update --offline-scan --format cyclonedx \
            --output "/release/load-balancer-controller-${VERSION}-source.cdx.json" /work
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
            -v "$PWD/$release_dir:/release" -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image \
            --skip-db-update --offline-scan --scanners vuln \
            --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --exit-code 1 "$SERVICE_IMAGE"
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
            -v "$PWD/$release_dir:/release" -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image \
            --skip-db-update --offline-scan --format cyclonedx \
            --output "/release/load-balancer-controller-${VERSION}-service.cdx.json" "$SERVICE_IMAGE"

          python3 - "$release_dir" "$VERSION" <<'PY'
          import json, pathlib, sys
          root = pathlib.Path(sys.argv[1])
          version = sys.argv[2]
          for scope in ('source', 'service'):
              bom = json.loads((root / f'load-balancer-controller-{version}-{scope}.cdx.json').read_text())
              assert bom.get('serialNumber')
              assert len(bom.get('components') or []) > 0
              assert len(bom.get('dependencies') or []) > 0
          PY

          source_epoch="$(git show -s --format=%ct HEAD)"
          find "$release_root" -exec touch -h -d "@${source_epoch}" {} +
          tar --sort=name --mtime="@${source_epoch}" --owner=0 --group=0 --numeric-owner \
            -C "$release_dir" -cJf "$release_dir/load-balancer-controller-${VERSION}-linux-amd64.tar.xz" \
            "load-balancer-controller-${VERSION}-linux-amd64"
          (
            cd "$release_dir"
            sha256sum \
              "load-balancer-controller-${VERSION}-linux-amd64.tar.xz" \
              "load-balancer-controller-${VERSION}-source.cdx.json" \
              "load-balancer-controller-${VERSION}-service.cdx.json" \
              > SHA256SUMS
          )

      - name: Publish immutable runtime image
        id: publish
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          SERVICE_IMAGE: ${{ steps.release_meta.outputs.service_image }}
        run: |
          set -euo pipefail
          printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
          docker push "$SERVICE_IMAGE"
          reference="$(docker image inspect --format '{{index .RepoDigests 0}}' "$SERVICE_IMAGE")"
          digest="${reference#*@}"
          [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]
          printf 'service_digest=%s\n' "$digest" >> "$GITHUB_OUTPUT"

      - name: Attest release assets
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-checksums: dist/release/SHA256SUMS

      - name: Attest runtime image
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-name: ${{ env.SERVICE_NAME }}
          subject-digest: ${{ steps.publish.outputs.service_digest }}
          push-to-registry: true

      - name: Publish GitHub release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.release_meta.outputs.version }}
        run: |
          set -euo pipefail
          gh release create "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --verify-tag \
            --title "Load Balancer Controller ${VERSION}" \
            --notes 'Maintained PastureStack HAProxy runtime with current Go modules, SBOMs, checksums, and build provenance.' \
            "dist/release/load-balancer-controller-${VERSION}-linux-amd64.tar.xz" \
            "dist/release/load-balancer-controller-${VERSION}-source.cdx.json" \
            "dist/release/load-balancer-controller-${VERSION}-service.cdx.json" \
            dist/release/SHA256SUMS

      - name: Clean runner resources
        if: always()
        shell: bash
        env:
          SERVICE_IMAGE: ${{ steps.release_meta.outputs.service_image }}
        run: |
          set +e
          docker logout ghcr.io >/dev/null 2>&1
          docker image rm -f "$SERVICE_IMAGE" "$TRIVY_IMAGE" 2>/dev/null
          docker builder prune --all --force >/dev/null 2>&1
          sudo rm -rf bin dist