trivy/.github/workflows/release.yaml

name: Release
on:
  push:
    tags:
      - "v*"

jobs:
  release:
    name: Release
    uses: ./.github/workflows/reusable-release.yaml
    with:
      goreleaser_config: goreleaser.yml
      goreleaser_options: '--clean --timeout 90m'
    secrets: inherit

  deploy-packages:
    name: Deploy rpm/dep packages
    needs: release # run this job after 'release' job completes
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0

      - name: Restore Trivy binaries from cache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: dist/
          key: ${{ runner.os }}-bins-${{github.workflow}}-${{github.sha}}

      - name: Install dependencies
        run: |
          sudo apt-get -y update
          sudo apt-get -y install rpm reprepro createrepo-c distro-info

      - name: Checkout trivy-repo
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          repository: ${{ github.repository_owner }}/trivy-repo
          path: trivy-repo
          token: ${{ secrets.ORG_REPO_TOKEN }}

      - name: Setup git settings
        run: |
          git config --global user.email "knqyf263@gmail.com"
          git config --global user.name "Teppei Fukuda"

      - name: Create rpm repository
        run: ci/deploy-rpm.sh

      - name: Import GPG key
        run: echo -e "${{ secrets.GPG_KEY }}" | gpg --import

      - name: Create deb repository
        run: ci/deploy-deb.sh

  # `update-chart-version` creates a new PR for updating the helm chart
  update-chart-version:
    needs: deploy-packages
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0

      - name: Set up Git user
        run: |
          git config --global user.email "actions@github.com"
          git config --global user.name "GitHub Actions"

      - name: Set up Go
        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          go-version-file: go.mod
          check-latest: true # Ensure we use the latest Go patch version
          cache: false

      - name: Install Go tools
        run: go install tool # GOBIN is added to the PATH by the setup-go action

      - name: Create a PR with Trivy version
        run: mage helm:updateVersion
        env:
          # Use ORG_REPO_TOKEN instead of GITHUB_TOKEN
          # This allows the created PR to trigger tests and other workflows
          GITHUB_TOKEN: ${{ secrets.ORG_REPO_TOKEN }}

  # `trigger-version-update` triggers the `update_version` workflow in the `trivy-telemetry` repository
  # and the trivy-downloads repository.
  trigger-version-update:
    needs: deploy-packages
    runs-on: ubuntu-22.04
    steps:
      - name: Trigger update_version workflow in trivy-telemetry
        env:
          # Use ORG_REPO_TOKEN instead of GITHUB_TOKEN
          # This allows triggering workflows in other repositories
          GH_TOKEN: ${{ secrets.ORG_REPO_TOKEN }}
        run: |
          gh workflow run update_version.yml \
            --repo ${{ github.repository_owner }}/trivy-telemetry \
            --ref main \
            --field version=${{ github.ref_name }}

      - name: Trigger update_version workflow in trivy-downloads
        env:
          # Use ORG_REPO_TOKEN instead of GITHUB_TOKEN
          # This allows triggering workflows in other repositories
          GH_TOKEN: ${{ secrets.ORG_REPO_TOKEN }}
        run: |
          gh workflow run update_version.yml \
            --repo ${{ github.repository_owner }}/trivy-downloads \
            --ref main \
            --field version=${{ github.ref_name }} \
            --field artifact=trivy

      - name: Trigger version update and release workflow in trivy-chocolatey
        env:
          # Use ORG_REPO_TOKEN instead of GITHUB_TOKEN
          # This allows triggering workflows in other repositories
          GH_TOKEN: ${{ secrets.ORG_REPO_TOKEN }}
        run: |
          gh workflow run release.yml \
            --repo ${{ github.repository_owner }}/trivy-chocolatey \
            --ref main \
            --field version=${{ github.ref_name }}