release.yml

name: 'New Release'
run-name: 'Release ${{ inputs.version_number }}'

on:
  workflow_dispatch:
    inputs:
      version_number:
          description: 'Version number (e.g. v1.0.0, v1.0.0-pre, v1.0.0-pre1)'
          required: true

jobs:

  validate-inputs:
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - name: Validation of version format
        run: echo "${{ inputs.version_number }}" | grep -P '^v\d+\.\d+\.\d+(-pre[A-Za-z0-9-]*)?$'

  create-tag:
    needs: validate-inputs
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps: 
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
      - name: Get the latest commit SHA
        id: get-sha
        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"  
      - name: Create release tag
        uses: rickstaa/action-create-tag@a1c7777fcb2fee4f19b0f283ba888afa11678b72
        with:
          tag: ${{ inputs.version_number }}
          commit_sha: ${{ steps.get-sha.outputs.sha }}
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg_passphrase: ${{ secrets.PASSPHRASE }}

  release:
    needs: create-tag
    runs-on: ubuntu-latest
    permissions: 
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
            ref: ${{ inputs.version_number }}
            fetch-depth: 0
      - name: Generate manifest files
        env:
          GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}
          GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
          VERSION: ${{ inputs.version_number }}
        run: make generate-all-manifests
      - name: Log in to MongoDB Docker registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
        with:
          registry: ${{ secrets.ARTIFACTORY_REGISTRY }}
          username: ${{ secrets.ARTIFACTORY_USER }}
          password: ${{ secrets.ARTIFACTORY_PASSWORD }}
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@e24998b8b67b290c2fa8b7c14fcfa7de2c5c9b8c
        with:
          args: release --clean        
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          AUTHENTICODE_KEY_NAME: ${{ secrets.AUTHENTICODE_KEY_NAME }}
          ARTIFACTORY_REGISTRY: ${{ secrets.ARTIFACTORY_REGISTRY }}
          ARTIFACTORY_SIGN_USER: ${{ secrets.ARTIFACTORY_SIGN_USER }}
          ARTIFACTORY_SIGN_PASSWORD: ${{ secrets.ARTIFACTORY_SIGN_PASSWORD }}
  compliance:
    needs: release
    runs-on: ubuntu-latest
    env:
      SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
            ref: ${{ inputs.version_number }}
      - name: Generate PURLs and SBOM
        run: make gen-purls gen-sbom
      - name: Upload SBOM to Kondukto
        run: make upload-sbom
        env:
          KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }}
          KONDUKTO_REPO: ${{ vars.KONDUKTO_REPO }}
          KONDUKTO_BRANCH_PREFIX: ${{ vars.KONDUKTO_BRANCH_PREFIX }}
      - name: Upload SBOM as release artifact
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda
        with:
          files: compliance/sbom.json
          tag_name: ${{ inputs.version_number }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  generate-ssdlc-report:
    needs: compliance
    runs-on: ubuntu-latest
    steps:
      - name: terraform-provider-mongodbatlas-checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          repository: mongodb/terraform-provider-mongodbatlas
          ref: master
      - uses: mongodb/terraform-provider-mongodbatlas/.github/templates/run-script-and-commit@master
        with:
          script_call: |
            TAG="${{ inputs.version_number }}"
            VERSION="${TAG#v}"
            AUTHOR="${{ github.actor }}"
            export AUTHOR VERSION
            ./scripts/compliance/gen-ssdlc-report.sh
          file_to_commit: 'compliance/v*/ssdlc-compliance-*.md'
          commit_message: "chore: Update SSDLC report for ${{ inputs.version_number }}"
          apix_bot_pat: ${{ secrets.APIX_BOT_PAT }}
          remote: https://svc-apix-bot:${{ secrets.APIX_BOT_PAT }}@github.com/${{ github.repository }}
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.PASSPHRASE }}