configcenter/.github/workflows/release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_DB: configcenter_test
          POSTGRES_USER: configcenter
          POSTGRES_PASSWORD: configcenter
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U configcenter -d configcenter_test"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 20
    env:
      TEST_DATABASE_URL: postgres://configcenter:configcenter@127.0.0.1:5432/configcenter_test?sslmode=disable
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "24"
          cache: npm
          cache-dependency-path: web/package-lock.json

      - name: Set up protoc
        uses: arduino/setup-protoc@v3
        with:
          version: "25.1"
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Verify release tag and changelog
        run: sh scripts/check-release.sh "${GITHUB_REF_NAME}"

      - name: Verify repository
        run: make verify

  images:
    needs: verify
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
      actions: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - component: server
            dockerfile: Dockerfile
          - component: web
            dockerfile: web/Dockerfile
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Prepare image name
        id: image
        shell: bash
        run: echo "name=ghcr.io/${GITHUB_REPOSITORY,,}-${{ matrix.component }}" >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Capture build timestamp
        id: buildmeta
        shell: bash
        run: echo "date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_OUTPUT"

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ steps.image.outputs.name }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=sha-

      - name: Build and push multi-architecture image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}
          provenance: mode=max
          sbom: true
          build-args: |
            VERSION=${{ github.ref_name }}
            VCS_REF=${{ github.sha }}
            BUILD_DATE=${{ steps.buildmeta.outputs.date }}
          cache-from: type=gha,scope=${{ matrix.component }}
          cache-to: type=gha,mode=max,scope=${{ matrix.component }}

      - name: Scan image for HIGH/CRITICAL vulnerabilities
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          scan-type: image
          image-ref: ${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }}
          scanners: vuln
          severity: HIGH,CRITICAL
          ignore-unfixed: false
          exit-code: 1

      - name: Generate SPDX SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }}
          format: spdx-json
          artifact-name: configcenter-${{ matrix.component }}-${{ github.ref_name }}.spdx.json
          output-file: configcenter-${{ matrix.component }}-${{ github.ref_name }}.spdx.json
          registry-username: ${{ github.actor }}
          registry-password: ${{ secrets.GITHUB_TOKEN }}
          upload-release-assets: false

      - name: Install Cosign
        uses: sigstore/cosign-installer@v4.1.0

      - name: Sign image digest with GitHub OIDC
        env:
          IMAGE: ${{ steps.image.outputs.name }}
          DIGEST: ${{ steps.build.outputs.digest }}
        run: cosign sign --yes "${IMAGE}@${DIGEST}"

      - name: Verify keyless signature
        env:
          IMAGE: ${{ steps.image.outputs.name }}
          DIGEST: ${{ steps.build.outputs.digest }}
          REPOSITORY: ${{ github.repository }}
        run: >-
          cosign verify
          --certificate-identity-regexp="https://github.com/${REPOSITORY}/.github/workflows/release.yml@refs/tags/v.*"
          --certificate-oidc-issuer="https://token.actions.githubusercontent.com"
          "${IMAGE}@${DIGEST}"