loki/.github/workflows/operator-release-please.yml

name: operator-release-please

on:
  push:
    paths:
      - 'operator/**'
    branches:
      - main

permissions:
  contents: read
  pull-requests: read

jobs:
  releasePlease:
    runs-on: ubuntu-latest
    permissions:
      contents: "read"
      id-token: "write"
      pull-requests: "write"
    outputs:
      release_created: ${{ steps.release.outputs.operator--release_created }}
      release_name: ${{ steps.release.outputs.operator--tag_name }}
      release_major: ${{ steps.release.outputs.operator--major }}
      release_minor: ${{ steps.release.outputs.operator--minor }}
      release_patch: ${{ steps.release.outputs.operator--patch }}
    steps:
      - name: Retrieve GitHub App Credentials from Vault
        id: get-secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets@28361cdb22223e5f1e34358c86c20908e7248760
        with:
          repo_secrets: |
            APP_ID=loki-gh-app:app-id
            PRIVATE_KEY=loki-gh-app:private-key            
      - name: Generate GitHub App Token
        id: app-token
        uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
        with:
          # Variables generated by the previous step get-secrets
          app-id: ${{ env.APP_ID }}
          private-key: ${{ env.PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}

      - uses: googleapis/release-please-action@c2a5a2bd6a758a0937f1ddb1e8950609867ed15c # v4.3.0
        id: release
        with:
          path: operator
          config-file: operator/release-please-config.json
          token: ${{ steps.app-token.outputs.token }}
  publishImages:
    env:
      BUILD_TIMEOUT: 60
      IMAGE_PREFIX: "grafana"
    needs:
      - "releasePlease"
    if: ${{ needs.releasePlease.outputs.release_created }}
    runs-on: ubuntu-latest
    permissions:
      contents: "read"
      id-token: "write"
      pull-requests: "write"
    steps:
      - name: "Set up QEMU"
        uses: "docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392" # v3.6.0
      - name: "Set up docker buildx"
        uses: "docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435" # v3.11.1
      - name: "Login to DockerHub (from vault)"
        uses: "grafana/shared-workflows/actions/dockerhub-login@75804962c1ba608148988c1e2dc35fbb0ee21746"
      - name: "Build and push"
        timeout-minutes: "${{ fromJSON(env.BUILD_TIMEOUT) }}"
        uses: "docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83" # v6.18.0
        with:
          context: "operator"
          file: "Dockerfile"
          platforms: "linux/amd64,linux/arm64,linux/arm"
          push: true
          tags: ${{ env.IMAGE_PREFIX }}/loki-operator:${{ needs.releasePlease.outputs.release_major }}.${{ needs.releasePlease.outputs.release_minor }}.${{ needs.releasePlease.outputs.release_patch }}
  publishRelease:
    needs:
    - "releasePlease"
    - "publishImages"
    runs-on: ubuntu-latest
    permissions:
      contents: "read"
      id-token: "write"
      pull-requests: "write"
    if: ${{ needs.releasePlease.outputs.release_created }}
    steps:
      - name: Retrieve GitHub App Credentials from Vault
        id: get-secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets@28361cdb22223e5f1e34358c86c20908e7248760
        with:
          repo_secrets: |
            APP_ID=loki-gh-app:app-id
            PRIVATE_KEY=loki-gh-app:private-key            
      - name: Generate GitHub App Token
        id: app-token
        uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
        with:
          # Variables generated by the previous step get-secrets
          app-id: ${{ env.APP_ID }}
          private-key: ${{ env.PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
      - name: "pull code to release"
        uses: "actions/checkout@v5"
        with:
          persist-credentials: false
          path: "release"
      - name: "publish release"
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          RELEASE_NAME: ${{ needs.releasePlease.outputs.release_name }}
        working-directory: "release"
        run: |
                    gh release edit "$RELEASE_NAME" --draft=false --latest=false