prerelease-check.yml

name: Pre-release check

on:
  workflow_dispatch:
    inputs:
      version:
        description: "The version tag to release, (e.g. v1.2.3)"
        required: true
        type: string
      commit:
        description: "The commit hash to release"
        required: true
        type: string

# Restrict jobs in this workflow to have no permissions by default; permissions
# should be granted per job as needed using a dedicated `permissions` block
permissions: {}

jobs:
  osv-scan:
    permissions:
      contents: read # to fetch code (actions/checkout)
      security-events: write # for uploading SARIF files
      actions: read
    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@main
    with:
      # Only scan the top level go.mod file without recursively scanning directories since
      # this is pipeline is about releasing the go module and binary
      scan-args: |-
        --skip-git
        ./

  format:
    permissions:
      contents: read # to fetch code (actions/checkout)
    name: prettier
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - name: Run lint action
        uses: ./.github/workflows/format-action
  lint:
    permissions:
      contents: read # to fetch code (actions/checkout)
    name: golangci-lint
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          ref: ${{ inputs.commit }}
      - name: Set up Go
        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
        with:
          go-version: stable
          check-latest: true
      - name: Run lint action
        uses: ./.github/workflows/lint-action
  prepare_test_image_fixtures:
    permissions:
      contents: read # to fetch code (actions/checkout)
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - run: scripts/build_test_images.sh
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: image-fixtures-${{ github.run_number }}-${{ github.run_attempt }}
          path: internal/image/fixtures/*.tar
          retention-days: 1
  tests:
    permissions:
      contents: read # to fetch code (actions/checkout)
    name: Run unit tests
    needs:
      - prepare_test_image_fixtures
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          ref: ${{ inputs.commit }}
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: image-fixtures-${{ github.run_number }}-${{ github.run_attempt }}
          path: internal/image/fixtures/
      - name: Set up Go
        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
        with:
          go-version: stable
          check-latest: true
      - name: Run test action
        uses: ./.github/workflows/test-action
        with:
          codecov_token: ${{ secrets.CODECOV_TOKEN }}
  generators:
    permissions:
      contents: read # to fetch code (actions/checkout)
    name: (re)generate code
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          ref: ${{ inputs.commit }}
      - name: Set up Go
        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
        with:
          go-version: stable
          check-latest: true
      - name: Run generators
        run: go generate ./...
      - run: |
          git diff --name-only \
            | xargs -I '{}' bash -c \
              'echo "::error file={}::This needs to be regenerated by running \`go generate ./...\`" && false'
  release-helper:
    permissions:
      contents: read # to fetch code (actions/checkout)
    runs-on: ubuntu-latest
    needs:
      - format
      - lint
      - tests
      - osv-scan
    steps:
      - name: Print Scripts
        env:
          OUTPUT: |
            git fetch upstream &&
            git tag ${{ inputs.version }} ${{ inputs.commit }} &&
            git push upstream ${{ inputs.version }}
        shell: bash
        run: |
          echo $OUTPUT