fission-src/.github/workflows/release.yaml

name: Create Draft release
on:
  push:
    tags:
      - v1.**
      - v2.**

env:
  KIND_VERSION: v0.23.0
  KIND_NODE_IMAGE_TAG: v1.25.16
  KIND_CLUSTER_NAME: kind


jobs:
  create-draft-release:
    outputs:
      hashes: ${{ steps.binary.outputs.hashes }}
      # image: ${{ steps.image.outputs.name }}
      # digest: ${{ steps.image.outputs.digest }}
    permissions:
      contents: write  # for goreleaser/goreleaser-action to create a GitHub release
      packages: write    # for goreleaser/goreleaser-action to upload artifacts to GitHub Packages
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          egress-policy: audit

      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Setup go
        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Get the version
        id: get_version
        run: echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_OUTPUT

      - name: Install GoReleaser
        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
        with:
          install-only: true
          version: "~> v2"

      - name: Kind Cluster
        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
        with:
          node_image: kindest/node:${{ env.KIND_NODE_IMAGE_TAG }}
          version: ${{ env.KIND_VERSION }}
          config: kind.yaml
          cluster_name: ${{ env.KIND_CLUSTER_NAME }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0

      - name: Login to ghcr.io
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to docker.io
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
        with:
          cosign-release: "v2.2.1"

      - name: Check cosign install!
        run: cosign version

      - uses: anchore/sbom-action/download-syft@v0.17.9

      - name: Write cosign signing key to disk
        run: 'echo "$KEY" > cosign.key'
        shell: bash
        env:
          KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}

      - name: Generate yaml for manifest, Minikube and Openshift installation
        run: ${GITHUB_WORKSPACE}/hack/build-yaml.sh $VERSION
        env:
          VERSION: ${{ steps.get_version.outputs.VERSION }}
        shell: bash

      - name: Run GoReleaser
        id: goreleaser
        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
        with:
          version: "~> v2"
          args: release
        env:
          COSIGN_PWD: ${{ secrets.COSIGN_PWD }}
          GORELEASER_CURRENT_TAG: ${{ steps.get_version.outputs.VERSION }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DOCKER_CLI_EXPERIMENTAL: "enabled"
      - name: Generate binary hashes
        id: binary
        env:
          ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
        run: |
          set -euo pipefail

          checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
          echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
      # - name: Image digest
      #   id: image
      #   env:
      #     ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
      #   run: |
      #     set -euo pipefail
      #     image_and_digest=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Docker Manifest") | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {name} + {digest} | join("@") | sub("^sha256:";"")')
      #     image=$(echo "${image_and_digest}" | grep ghcr.io | cut -d'@' -f1 | cut -d':' -f1)
      #     digest=$(echo "${image_and_digest}" | grep ghcr.io | cut -d'@' -f2)
      #     echo "name=$image" >> "$GITHUB_OUTPUT"
      #     echo "digest=$digest" >> "$GITHUB_OUTPUT"

  binary-provenance:
    needs: [create-draft-release]
    permissions:
      actions: read # To read the workflow path.
      id-token: write # To sign the provenance.
      contents: write # To add assets to a release.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      base64-subjects: "${{ needs.create-draft-release.outputs.hashes }}"
      provenance-name: "fission.intoto.jsonl"
      upload-assets: true # upload to a new release

  # image-provenance:
  #   needs: [create-draft-release]
  #   permissions:
  #     actions: read
  #     id-token: write
  #     packages: write
  #   uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0
  #   with:
  #     image: ${{ needs.create-draft-release.outputs.image }}
  #     digest: ${{ needs.create-draft-release.outputs.digest }}
  #     registry-username: ${{ github.actor }}
  #   secrets:
  #     registry-password: ${{ secrets.GITHUB_TOKEN }}

  # verification-with-slsa-verifier:
  #   needs: [create-draft-release, binary-provenance]
  #   runs-on: ubuntu-latest
  #   permissions: read-all
  #   steps:
  #     - name: Install the verifier
  #       uses: slsa-framework/slsa-verifier/actions/installer@v2.6.0

  #     - name: Download assets
  #       env:
  #         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  #         PROVENANCE: "${{ needs.binary-provenance.outputs.provenance-name }}"
  #       run: |
  #         set -euo pipefail
  #         gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "*.tar.gz"
  #         gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "*.zip"
  #         gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "$PROVENANCE"
  #     - name: Verify assets
  #       env:
  #         CHECKSUMS: ${{ needs.create-draft-release.outputs.hashes }}
  #         PROVENANCE: "${{ needs.binary-provenance.outputs.provenance-name }}"
  #       run: |
  #         set -euo pipefail
  #         checksums=$(echo "$CHECKSUMS" | base64 -d)
  #         while read -r line; do
  #             fn=$(echo $line | cut -d ' ' -f2)
  #             echo "Verifying $fn"
  #             slsa-verifier verify-artifact --provenance-path "$PROVENANCE" \
  #                                           --source-uri "github.com/$GITHUB_REPOSITORY" \
  #                                           --source-tag "$GITHUB_REF_NAME" \
  #                                           "$fn"
  #         done <<<"$checksums"

  # verification-with-cosign:
  #   needs: [create-draft-release, image-provenance]
  #   runs-on: ubuntu-latest
  #   permissions: read-all
  #   steps:
  #     - name: Login
  #       uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
  #       with:
  #         registry: ghcr.io
  #         username: ${{ github.actor }}
  #         password: ${{ secrets.GITHUB_TOKEN }}

  #     - name: Install Cosign
  #       uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
  #       with:
  #         cosign-release: "v2.2.1"

  #     - name: Verify image
  #       env:
  #         IMAGE: ${{ needs.create-draft-release.outputs.image }}
  #         DIGEST: ${{ needs.create-draft-release.outputs.digest }}
  #       run: |
  #         cosign verify-attestation \
  #            --type slsaprovenance \
  #            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  #            --certificate-identity-regexp '^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+$' \
  #            $IMAGE@$DIGEST