release.yaml

name: release

on:
  workflow_call: {}

permissions: {}

jobs:
  publish-helm-chart:
    name: publish helm chart
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      packages: write
      # needed for cosign
      id-token: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: downgrade helm
        shell: bash
        run: |
          rm /usr/local/bin/helm
          curl -fsSL https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 > /tmp/helm.sh
          chmod +x /tmp/helm.sh
          /tmp/helm.sh --version v3.12.3
          helm version

      - name: Add helm repos and update deps
        run: |
          helm repo add miracum https://miracum.github.io/charts
          helm repo add akhq https://akhq.io/
          helm repo add hapi-fhir-jpaserver-starter https://hapifhir.github.io/hapi-fhir-jpaserver-starter

          helm dep build charts/onco-analytics-on-fhir
          helm dep build charts/prerequisites

      # TODO: maybe replace image tags in values.yaml with digests before packaging
      - name: Package, upload, and sign Helm charts
        run: |
          CHART_VERSION=$(yq .version charts/onco-analytics-on-fhir/Chart.yaml)

          # onco-analytics-on-fhir
          helm package charts/onco-analytics-on-fhir
          helm push "onco-analytics-on-fhir-${CHART_VERSION}.tgz" oci://ghcr.io/${{ github.repository }}/charts

          cp "onco-analytics-on-fhir-${CHART_VERSION}.tgz" onco-analytics-on-fhir-chart.tgz

          cosign sign --yes "ghcr.io/${{ github.repository }}/charts/onco-analytics-on-fhir:${CHART_VERSION}"

          # prerequisites
          helm package charts/prerequisites
          helm push "prerequisites-${CHART_VERSION}.tgz" oci://ghcr.io/${{ github.repository }}/charts

          cp "prerequisites-${CHART_VERSION}.tgz" prerequisites-chart.tgz

          cosign sign --yes "ghcr.io/${{ github.repository }}/charts/prerequisites:${CHART_VERSION}"

      - uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
        with:
          name: helm-charts
          path: |
            onco-analytics-on-fhir-chart.tgz
            prerequisites-chart.tgz

  build-air-gapped-installer:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - run: |
          ./build-air-gapped-installer.sh

      - name: Upload air-gapped installer artifact
        uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
        with:
          name: air-gapped-installers
          path: |
            air-gapped-installer.tgz
            air-gapped-prerequisites-installer.tgz
            compose-air-gapped-installer.tgz

  prepare-artifacts:
    name: prepare artifacts
    runs-on: ubuntu-22.04
    needs:
      - publish-helm-chart
      - build-air-gapped-installer
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    permissions:
      contents: write # to upload artifacts to the release
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Download Helm chart
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3
        with:
          name: helm-charts
          path: /tmp

      - name: Download air-gapped installers
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3
        with:
          name: air-gapped-installers
          path: /tmp

      - name: Create dist dir
        run: |
          mkdir -p dist/

      - name: Add Helm chart to dist
        run: |
          ls -lsa /tmp
          cp /tmp/onco-analytics-on-fhir-chart.tgz dist/
          cp /tmp/prerequisites-chart.tgz dist/
          # cp /tmp/air-gapped-installer.tgz dist/
          # cp /tmp/air-gapped-prerequisites-installer.tgz dist/
          cp /tmp/compose-air-gapped-installer.tgz dist/

      - name: Generate SLSA subject for release assets
        id: hash
        working-directory: dist
        run: |
          # air-gapped-installer.tgz air-gapped-prerequisites-installer.tgz
          sha256sum onco-analytics-on-fhir-chart.tgz prerequisites-chart.tgz compose-air-gapped-installer.tgz > checksums.sha256
          echo "hashes=$(base64 -w0 < checksums.sha256)" >> "$GITHUB_OUTPUT"

      - name: upload assets to release
        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # tag=v1
        with:
          files: |
            dist/*.tgz
            dist/*.sha256

  provenance:
    needs:
      - prepare-artifacts
    permissions:
      actions: read
      id-token: write
      contents: write
    # can't be referenced by digest. See <https://github.com/slsa-framework/slsa-github-generator#verification-of-provenance>
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0
    with:
      base64-subjects: "${{ needs.prepare-artifacts.outputs.hashes }}"
      compile-generator: true # Workaround for https://github.com/slsa-framework/slsa-github-generator/issues/1163
      upload-assets: true