name: Release

# Only release when a new GH tag is added
on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      dockerhub_image_name: docker.io/bitnami/sealed-secrets-controller
      ghcr_image_name: ghcr.io/bitnami-labs/sealed-secrets-controller
    steps:
      # Checkout and set env
      - name: Checkout
        uses: actions/checkout@v2
      - name: Set up Go
        uses: actions/setup-go@v2
        with:
          go-version: 1.18.3
      - name: Setup kubecfg
        run: |
          mkdir -p ~/bin
          curl -sLf https://github.com/kubecfg/kubecfg/releases/download/v0.25.0/kubecfg_Linux_X64 >~/bin/kubecfg
          chmod +x ~/bin/kubecfg

      # Run tests
      - name: Tests
        run: make test

      # Generate K8s manifests
      - name: K8s manifests
        run: |
          export PATH=~/bin:$PATH
          make CONTROLLER_IMAGE=${{ env.dockerhub_image_name }}:${{ github.ref_name }} controller.yaml controller-norbac.yaml

      # Setup env for multi-arch builds
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1
        with:
          image: tonistiigi/binfmt:latest
          platforms: arm64,arm
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1

      # Setup Cosign
      - name: Install Cosign
        uses: sigstore/cosign-installer@v2.3.0
      - name: Write Cosign key
        run: echo "$COSIGN_KEY" > /tmp/cosign.key
        env:
          COSIGN_KEY: ${{ secrets.COSIGN_KEY }}

      # Build & Release binaries
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v2
        if: success() && startsWith(github.ref, 'refs/tags/')
        with:
          version: v1.7.0
          args: release --rm-dist
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}

      # Build & Publish multi-arch image
      - name: Login to Docker Hub
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}
      - name: Login to GHRC
        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
        with:
          images: |
            ${{ env.dockerhub_image_name }}
            ${{ env.ghcr_image_name }}
      - name: Build and push
        id: docker_build
        uses: docker/build-push-action@v2
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/arm
          push: true
          tags: ${{ steps.meta.outputs.tags }}
      - name: Sign image with a key in GHCR
        run: |
          echo -n "$COSIGN_PASSWORD" | cosign sign --key /tmp/cosign.key $TAG_CURRENT
        env:
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
          TAG_CURRENT: ${{ steps.meta.outputs.tags }}
          COSIGN_REPOSITORY: ${{ env.ghcr_image_name }}/signs
