name: 02-create_release
permissions: read-all
on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
  workflow_dispatch:
    inputs:
      skip_publish:
        description: "Skip publishing artifacts"
        required: false
        default: true
        type: boolean
jobs:
  release:
    permissions:
      actions: read
      checks: read
      contents: write
      deployments: read
      discussions: read
      id-token: write
      issues: read
      models: read
      packages: write
      pages: read
      pull-requests: read
      repository-projects: read
      statuses: read
      security-events: read
      attestations: write
      artifact-metadata: read
    runs-on: ubuntu-large
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0

      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version: "1.26"

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.9"

      - name: Install system dependencies for system-tests
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libpq5 \
            libpq-dev \
            gcc \
            python3-dev
          sudo rm -rf /var/lib/apt/lists/*

      - name: Install Cosign
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0

      - name: Create Cosign Key
        run: echo "${{ secrets.COSIGN_PRIVATE_KEY_V1 }}" > cosign.key

      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Login to Quay.io
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
          password: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}

      - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
        name: Setup Syft

      - name: Create k8s Kind Cluster
        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
        with:
          cluster_name: kubescape-e2e

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          distribution: goreleaser
          version: latest
          args: release --clean ${{ inputs.skip_publish == true && '--skip=publish' || '' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
          COSIGN_PWD: ${{ secrets.COSIGN_PRIVATE_KEY_V1_PASSWORD }}
          RELEASE: ${{ github.ref_name }}
          CLIENT: release
          RUN_E2E: "true"
          KUBESCAPE_SKIP_UPDATE_CHECK: "true"
          CUSTOMER: ${{ secrets.CUSTOMER }}
          USERNAME: ${{ secrets.USERNAME }}
          PASSWORD: ${{ secrets.PASSWORD }}
          CLIENT_ID: ${{ secrets.CLIENT_ID_PROD }}
          SECRET_KEY: ${{ secrets.SECRET_KEY_PROD }}
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Attest build provenance
        if: (github.event_name != 'workflow_dispatch' || inputs.skip_publish != true) && hashFiles('dist/**/*.tar.gz') != ''
        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
        with:
          subject-path: |
            dist/**/*.tar.gz
            dist/**/kubescape
            dist/**/kubescape.exe
            dist/**/ksserver
            dist/**/downloader

      - name: Update new version in krew-index
        if: github.event_name != 'workflow_dispatch' || inputs.skip_publish != true
        uses: rajatjindal/krew-release-bot@3d9faef30a82761d610544f62afddca00993eef9 # v0.0.47
        with:
          krew_template_file: dist/krew/kubescape.yaml

      - name: List collected system-test results (debug)
        if: always()
        run: |
          echo "Listing test-results/system-tests (if any):"
          ls -laR test-results/system-tests || true

      - name: System Tests Report
        uses: mikepenz/action-junit-report@3585e9575db828022551b4231f165eb59a0e74e3 # v5.6.2
        if: always()
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          report_paths: "test-results/system-tests/**/results_xml_format/**.xml"
          annotate_only: true
          job_summary: true
