release.yaml

name: Release Robusta

on:
  release:
    types: [published]

env:
  PROJECT_ID: ${{ secrets.GKE_PROD_PROJECT }}
  # ` ``  GKE_ZONE: us-central1-c   # TODO: update to cluster zone
  RELEASE_VER: ${{ github.event.release.tag_name }}
  # A runner release ships the chart and the runner under one version. holmes-bump.yaml ships
  # chart-only patch versions that keep an already-published RUNNER_VERSION.
  CHART_VERSION: ${{ github.event.release.tag_name }}
  RUNNER_VERSION: ${{ github.event.release.tag_name }}

jobs:
  setup-build-publish-deploy:
    name: Build images
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Get release version
        run: echo "$RELEASE_VER"

      - uses: azure/setup-helm@v4.3.1
        with:
          version: v3.16.4

      # holmes-bump.yaml publishes chart patch versions with no release tag; upload_chart.sh
      # would silently replace one.
      - name: Check the chart version is not published
        run: |
          set -euo pipefail
          published=$(helm/published_chart_versions.sh)
          if grep -qxF "$CHART_VERSION" <<<"$published"; then
            echo "::error::chart $CHART_VERSION is already published; release a version no chart uses"; exit 1
          fi

      - uses: google-github-actions/auth@v3
        with:
          project_id: ${{ secrets.GKE_PROD_PROJECT }}
          workload_identity_provider: 'projects/429189597230/locations/global/workloadIdentityPools/github/providers/robusta-repos' # prod

      - name: Set up gcloud CLI
        uses: google-github-actions/setup-gcloud@v3
        with:
          project_id: ${{ secrets.GKE_PROD_PROJECT }}

      - name: Configure Docker Registry
        run: gcloud auth configure-docker us-central1-docker.pkg.dev


      - run: |-
          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/latest/skaffold-linux-amd64
          chmod a+x skaffold

      - name: Update package version
        run: helm/stamp_versions.sh "$CHART_VERSION" "$RUNNER_VERSION"

      # Set up the buildx to run build for multiple platforms
      - name: Set up QEMU
        uses: docker/setup-qemu-action@c5ffa2a61740d9877bd1f40899a87c8ec93b0d9f

      - name: Docker Setup Buildx
        uses: docker/setup-buildx-action@bea6a01aa40b4d58b0382d47e1c4a70137af67b1
        with:
          config-inline: |
            [worker.oci]
              enabled = true
              platforms = [ "linux/amd64", "linux/arm64" ]

      # see https://github.com/GoogleContainerTools/skaffold/issues/4842
      - name: Cache skaffold image builds & config
        uses: actions/cache@v4
        with:
          path: ~/.skaffold/
          key: fixed-${{ github.sha }}
          restore-keys: |
            fixed-${{ github.sha }}
            fixed-

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build with skaffold
        run: ./skaffold build --profile release --file-output=container-ids.json --tag="$RUNNER_VERSION"

      - name: Save artifact with tags of built containers
        uses: actions/upload-artifact@v4
        with:
          name: container-ids
          path: container-ids.json

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: 3.11

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install twine

      - name: Prepare pypi dist
        run: |
          curl -sSL https://install.python-poetry.org | python3 - --version 1.4.0
          poetry config virtualenvs.create false
          poetry install --extras "all"
          poetry publish --build -u __token__ -p ${{ secrets.PYPI_PROJECT_TOKEN }}

      - name: Save artifact with helm chart
        uses: actions/upload-artifact@v4
        with:
          name: helm-chart
          path: helm/robusta/

      - name: Release Docker to Dockerhub
        run: |-
          docker buildx build \
          --build-arg BUILDKIT_INLINE_CACHE=1 \
          --platform linux/arm64,linux/amd64 \
          --cache-from us-central1-docker.pkg.dev/genuine-flight-317411/devel/robusta:cache \
          --tag "robustadev/robusta-runner:$RUNNER_VERSION" \
          --push \
          .

      - name: Upload helm chart
        run: |
          cd helm && ./upload_chart.sh

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Push Helm chart to OCI registry
        run: |
          helm package helm/robusta
          helm push "robusta-$CHART_VERSION.tgz" "oci://ghcr.io/${{ github.repository_owner }}/charts"