git.stella-ops.org/.gitea/workflows/release.yml

# .gitea/workflows/release.yml
# Deterministic release pipeline producing signed images, SBOMs, provenance, and manifest

name: Release Bundle

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version (overrides tag, e.g. 2025.10.0-edge)'
        required: false
        type: string
      channel:
        description: 'Release channel (edge|stable|lts)'
        required: false
        default: 'edge'
        type: choice
        options:
          - edge
          - stable
          - lts
      calendar:
        description: 'Calendar tag (YYYY.MM) - optional override'
        required: false
        type: string
      push_images:
        description: 'Push container images to registry'
        required: false
        default: true
        type: boolean

jobs:
  build-release:
    runs-on: ubuntu-22.04
    env:
      DOTNET_VERSION: '10.0.100-rc.1.25451.107'
      REGISTRY: registry.stella-ops.org
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Set up Node.js 20
        uses: actions/setup-node@v4
        with:
          node-version: '20.14.0'

      - name: Set up .NET SDK
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}
          include-prerelease: true

      - name: Install Helm 3.16.0
        run: |
          curl -fsSL https://get.helm.sh/helm-v3.16.0-linux-amd64.tar.gz -o /tmp/helm.tgz
          tar -xzf /tmp/helm.tgz -C /tmp
          sudo install -m 0755 /tmp/linux-amd64/helm /usr/local/bin/helm

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3.4.0

      - name: Determine release metadata
        id: meta
        run: |
          set -euo pipefail
          RAW_VERSION="${{ github.ref_name }}"
          if [[ "${{ github.event_name }}" != "push" ]]; then
            RAW_VERSION="${{ github.event.inputs.version }}"
          fi
          if [[ -z "$RAW_VERSION" ]]; then
            echo "::error::Release version not provided" >&2
            exit 1
          fi
          VERSION="${RAW_VERSION#v}"
          CHANNEL="${{ github.event.inputs.channel || '' }}"
          if [[ -z "$CHANNEL" ]]; then
            CHANNEL="edge"
          fi
          CALENDAR_INPUT="${{ github.event.inputs.calendar || '' }}"
          if [[ -z "$CALENDAR_INPUT" ]]; then
            YEAR=$(echo "$VERSION" | awk -F'.' '{print $1}')
            MONTH=$(echo "$VERSION" | awk -F'.' '{print $2}')
            if [[ -n "$YEAR" && -n "$MONTH" ]]; then
              CALENDAR_INPUT="$YEAR.$MONTH"
            else
              CALENDAR_INPUT=$(date -u +'%Y.%m')
            fi
          fi
          PUSH_INPUT="${{ github.event.inputs.push_images || '' }}"
          if [[ "${{ github.event_name }}" == "push" ]]; then
            PUSH_INPUT="true"
          elif [[ -z "$PUSH_INPUT" ]]; then
            PUSH_INPUT="true"
          fi
          if [[ "$PUSH_INPUT" == "false" || "$PUSH_INPUT" == "0" ]]; then
            PUSH_FLAG="false"
          else
            PUSH_FLAG="true"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "channel=$CHANNEL" >> "$GITHUB_OUTPUT"
          echo "calendar=$CALENDAR_INPUT" >> "$GITHUB_OUTPUT"
          echo "push=$PUSH_FLAG" >> "$GITHUB_OUTPUT"

      - name: Log in to registry
        if: steps.meta.outputs.push == 'true'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Prepare release output directory
        run: |
          rm -rf out/release
          mkdir -p out/release

      - name: Build release bundle
        env:
          COSIGN_KEY_REF: ${{ secrets.COSIGN_KEY_REF }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
          COSIGN_IDENTITY_TOKEN: ${{ secrets.COSIGN_IDENTITY_TOKEN }}
        run: |
          set -euo pipefail
          EXTRA_ARGS=()
          if [[ "${{ steps.meta.outputs.push }}" != "true" ]]; then
            EXTRA_ARGS+=("--no-push")
          fi
          ./ops/devops/release/build_release.py \
            --version "${{ steps.meta.outputs.version }}" \
            --channel "${{ steps.meta.outputs.channel }}" \
            --calendar "${{ steps.meta.outputs.calendar }}" \
            --git-sha "${{ github.sha }}" \
            "${EXTRA_ARGS[@]}"

      - name: Upload release artefacts
        uses: actions/upload-artifact@v4
        with:
          name: stellaops-release-${{ steps.meta.outputs.version }}
          path: out/release
          if-no-files-found: error