release.yml

name: Release

on:
  push:
    tags:
      - '*'


env:
  VERSION: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}


jobs:
  markdown-lint:
    name: Markdown Lint
    runs-on: ubuntu-latest
    steps:
      - name: Clone the code
        uses: actions/checkout@v6

      - name: Run markdownlint
        uses: DavidAnson/markdownlint-cli2-action@v23
        with:
          globs: |
            README.*.md
            docs/*.md


  golang-lint:
    name: golang-lint
    runs-on: ubuntu-latest
    steps:
      - name: Clone the code
        uses: actions/checkout@v6

      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Run linter
        uses: golangci/golangci-lint-action@v9
        with:
          # Pin the linter version so a new upstream release cannot break the
          # pipeline without a code change. Keep in sync with the Makefile's
          # GOLANGCI_LINT_VERSION.
          version: v2.12.1


  golang-test:
    name: Golang Test
    runs-on: ubuntu-latest
    steps:
      - name: Clone the code
        uses: actions/checkout@v6

      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Running Tests
        run: |
          go mod tidy
          make test


  chainsaw-e2e:
    name: Chainsaw Test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        k8s-version: [
          '1.33.7',
          '1.34.3',
          '1.35.0'
        ]
        product-version: ['2.6.1','2.6.2']
    steps:
      - name: Clone the code
        uses: actions/checkout@v6

      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Create KinD cluster
        env:
          KIND_K8S_VERSION: ${{ matrix.k8s-version}}
          CHAINSAW_KUBECONFIG: kind-kubeconfig-${{ matrix.k8s-version }}
        run: make setup-chainsaw-cluster

      - name: Setup Chainsaw
        env:
          KIND_K8S_VERSION: ${{ matrix.k8s-version }}
          CHAINSAW_KUBECONFIG: kind-kubeconfig-${{ matrix.k8s-version }}
        run: make setup-chainsaw-e2e

      - name: Run chainsaw-e2e
        env:
          KIND_K8S_VERSION: ${{ matrix.k8s-version }}
          CHAINSAW_KUBECONFIG: kind-kubeconfig-${{ matrix.k8s-version }}
          PRODUCT_VERSION: ${{ matrix.product-version }}
        run: make chainsaw-e2e


  release-image:
    name: Release Image
    if: ${{ github.repository_owner == 'zncdatadev' }}
    runs-on: ubuntu-latest
    permissions:
      id-token: write # required for OIDC for cosign to automatically use
    needs:
      - markdown-lint
      - golang-lint
      - golang-test
      - chainsaw-e2e
    steps:
      - name: Clone the code
        uses: actions/checkout@v6

      - name: Setup Cosign
        uses: sigstore/cosign-installer@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        with:
          platforms: linux/amd64,linux/arm64

      - name: Login to quay.io
        uses: docker/login-action@v4
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}

      - name: Build and push operator
        run: |
          make docker-buildx

      - name: Sign operator image
        uses: ./.github/actions/sign-image


  check-crds-sync:
    runs-on: ubuntu-latest
    steps:
      - name: Clone the code
        uses: actions/checkout@v6

      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Check CRDs sync
        run: |
          # Use `make manifests` to generate the CRDs
          make manifests
          # Check if the CRDs are in sync with the manifests.
          # Stage everything first so newly generated (untracked) files are
          # detected too; plain `git diff` ignores untracked files.
          git add -A
          if ! git diff --cached --exit-code; then
            echo "CRDs are not in sync with the manifests."
            echo "Please run 'make manifests' to update the CRDs."
            exit 1
          fi


  chart-linter-artifacthub:
    runs-on: ubuntu-latest
    needs:
      - check-crds-sync
    container:
      image: public.ecr.aws/artifacthub/ah:v1.14.0
      options: --user 1001
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Run ah lint
        working-directory: deploy/helm
        run: ah lint


  chart-lint-helm:
    runs-on: ubuntu-latest
    needs:
      - check-crds-sync
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Helm
        uses: azure/setup-helm@v5

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.x'
          check-latest: true

      - name: Setup Chart Linting
        id: lint
        uses: helm/chart-testing-action@v2.8.0

      - name: Fetch all tags
        run: git fetch --tags --force

      - name: Get commit range
        id: commit-range
        run: |
          CURRENT_TAG="${{ github.ref_name }}"
          PREVIOUS_TAG=$(git tag --sort=-v:refname | grep -A1 "^${CURRENT_TAG}$" | tail -n1)
          if [[ "$PREVIOUS_TAG" == "$CURRENT_TAG" || -z "$PREVIOUS_TAG" ]]; then
            echo "First release detected - marking all charts as changed"
            echo "changed=true" >> "$GITHUB_OUTPUT"
            echo "target_branch=main" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          PREVIOUS_COMMIT=$(git rev-list -n 1 "$PREVIOUS_TAG")
          echo "Current commit for previous tag ($PREVIOUS_TAG): $PREVIOUS_COMMIT"
          PREVIOUS_BRANCHES=$(git branch -r --contains "$PREVIOUS_COMMIT" | sed 's/^[ *]*//')
          PRIORITY_BRANCH=""
          RELEASE_BRANCH=$(echo "$PREVIOUS_BRANCHES" | grep -E 'origin/release' | sort | head -n1)
          if [[ -n "$RELEASE_BRANCH" ]]; then
            PRIORITY_BRANCH="$RELEASE_BRANCH"
          else
            MAIN_BRANCH=$(echo "$PREVIOUS_BRANCHES" | grep -E '^origin/main$')
            if [[ -n "$MAIN_BRANCH" ]]; then
              PRIORITY_BRANCH="$MAIN_BRANCH"
            else
              PRIORITY_BRANCH=$(echo "$PREVIOUS_BRANCHES" | head -n1)
            fi
          fi
          PRIORITY_BRANCH=$(echo "$PRIORITY_BRANCH" | sed 's|^origin/||')
          echo "target_branch=$PRIORITY_BRANCH" >> "$GITHUB_OUTPUT"
          echo "since_commit=$PREVIOUS_COMMIT" >> "$GITHUB_OUTPUT"

      - name: Check chart changes
        id: check-changes
        run: |
          if ! changed=$(ct list-changed \
            --chart-dirs deploy/helm \
            --since "${{ steps.commit-range.outputs.since_commit }}" \
            --target-branch "${{ steps.commit-range.outputs.target_branch }}"); then
            echo "Failed to check for changes"
            exit 1
          fi
          if [[ -n "$changed" ]]; then
            echo "Changed charts detected: $changed"
            echo "changed=true" >> "$GITHUB_OUTPUT"
          else
            echo "No chart changes detected"
          fi

      - name: Run chart-testing (lint)
        if: steps.check-changes.outputs.changed == 'true'
        run: |
          ct lint \
            --since "${{ steps.commit-range.outputs.since_commit }}" \
            --target-branch "${{ steps.commit-range.outputs.target_branch }}" \
            --config ./.github/configs/ct-lint.yaml

      - name: Create kind cluster
        if: steps.check-changes.outputs.changed == 'true'
        uses: helm/kind-action@v1.14.0
        with:
          cluster_name: kind

      - name: Load images to cluster
        if: steps.check-changes.outputs.changed == 'true'
        run: |
          make docker-build
          kind load docker-image quay.io/zncdatadev/hbase-operator:$VERSION

      - name: Run chart-testing (install)
        if: steps.check-changes.outputs.changed == 'true'
        run: |
          ct install \
            --since "${{ steps.commit-range.outputs.since_commit }}" \
            --target-branch "${{ steps.commit-range.outputs.target_branch }}" \
            --config ./.github/configs/ct-install.yaml

  chart-e2e:
    runs-on: ubuntu-latest
    needs:
      - check-crds-sync
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Create KinD cluster
        env:
          CHAINSAW_KUBECONFIG: kind-kubeconfig-chart-e2e
        run: make setup-chainsaw-cluster

      - name: Run chart-e2e
        env:
          CHAINSAW_KUBECONFIG: kind-kubeconfig-chart-e2e
          PRODUCT_VERSION: 2.6.2
        run: make chart-e2e


  release-chart:
    name: Release Chart
    if: ${{ github.repository_owner == 'zncdatadev' }}
    runs-on: ubuntu-latest
    needs:
      - chart-linter-artifacthub
      - chart-lint-helm
      - chart-e2e
    steps:
      - name: Clone the code
        uses: actions/checkout@v6

      - name: Login to quay.io
        uses: docker/login-action@v4
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_CHART_USERNAME }}
          password: ${{ secrets.QUAY_CHART_PASSWORD }}

      - name: Build and push oci chart
        run: |
          make helm-chart-publish

      - name: Clone helm charts repository
        uses: actions/checkout@v6
        with:
          repository: zncdatadev/kubedoop-helm-charts
          ref: gh-pages
          # Use PAT for authentication, must be a repo content rw scope token
          # Subsequent commits to the repository require read and write permissions
          token: ${{ secrets.HELM_CHARTS_REPO_TOKEN }}
          path: kubedoop-helm-charts

      - name: Update helm charts index
        run: |
          OCI_REGISTRY="oci://quay.io/kubedoopcharts"

          # Ensure chart index.yaml exists
          if [ ! -f kubedoop-helm-charts/index.yaml ]; then
            echo "index.yaml not found"
            exit 1
          fi

          # Get chart package file from the target directory, ensuring exactly one exists
          CHART_PACKAGES=$(ls target/charts/*.tgz)
          if [ $(echo "$CHART_PACKAGES" | wc -l) -ne 1 ]; then
            echo "Expected exactly one chart package, found: $CHART_PACKAGES"
            exit 1
          fi
          CHART_PACKAGE=$(basename $CHART_PACKAGES)

          # Extract chart name and version from package filename
          # Examples:
          # foo-0.0.0-dev.tgz -> CHART_NAME=foo, CHART_VERSION=0.0.0-dev
          # foo-12.0.1.tgz -> CHART_NAME=foo, CHART_VERSION=12.0.1
          # my-chart-2-operator-1.0.0.tgz -> CHART_NAME=my-chart-2-operator, CHART_VERSION=1.0.0
          # Strategy: Find the last occurrence of -[digit] pattern, that's where version starts
          CHART_NAME=$(echo $CHART_PACKAGE | sed 's/-[0-9]\+\..*\.tgz$//')
          CHART_VERSION=$(echo $CHART_PACKAGE | sed "s/^$CHART_NAME-\(.*\)\.tgz$/\1/")

          # Validate extracted CHART_NAME and CHART_VERSION
          if [ -z "$CHART_NAME" ] || [ -z "$CHART_VERSION" ]; then
            echo "Failed to extract CHART_NAME or CHART_VERSION from package filename: $CHART_PACKAGE"
            exit 1
          fi

          # Regenerate the index.yaml file for the helm charts repository
          helm repo index --url $OCI_REGISTRY --merge kubedoop-helm-charts/index.yaml target/charts
          # Replace .tgz in URL with OCI tag (remove .tgz suffix)
          sed -i "s|$OCI_REGISTRY/$CHART_PACKAGE|$OCI_REGISTRY/$CHART_NAME:$CHART_VERSION|" target/charts/index.yaml

          # Copy the updated index.yaml to the kubedoop-helm-charts directory
          cp target/charts/index.yaml kubedoop-helm-charts/index.yaml

          # Push index.yaml to the kubedoop-helm-charts repository
          cd kubedoop-helm-charts
          # Configure git
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          git add index.yaml
          # Only commit and push if there are changes
          if ! git diff --cached --quiet; then
            git commit -m "Update index"
            git push origin gh-pages
          else
            echo "No changes to commit."
          fi