release.yaml

name: Build and Release

on:
  push:
    # run only against version tags
    tags:
      - 'v*'

jobs:
  build:
    name: Release
    runs-on: ubuntu-22.04
    permissions:
      id-token: write
      contents: write
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Validate version
        env:
          TAG_NAME: ${{ github.head_ref || github.ref_name }} 
        run: |
          # Remove leading 'v' from version
          export VERSION=$(echo -n ${TAG_NAME} | cut -c 2-)
          grep "version: ${VERSION}" manifest.yaml || (echo "value of 'dist.version' in manifest.yaml does not match tag version ${VERSION}, please update it" && exit 1)
      - uses: actions/setup-go@v5
        with:
          go-version: "~1.22.6"
      - uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64
      - uses: docker/setup-buildx-action@v3
      - uses: anchore/sbom-action/download-syft@v0.17.0
      - name: Cache tools
        uses: actions/cache@v4
        with:
          path: .tools
          key: release-tools-${{ runner.os }}-${{ hashFiles('internal/tools/go.sum') }}
      - name: Touch tools
        run: |
          mkdir -p .tools
          touch .tools/*
      - name: Login to GitHub Package Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure aws credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          aws-region: us-east-1

      - name: Login to Amazon ECR
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public

      - name: Create release for version tag
        run: make release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}