ci-prepare-release.yml

name: Prepare

permissions:
  # To create a draft release
  contents: write
  # To sign artifacts.
  id-token: write

on:
  workflow_call:
    inputs:
      ref:
        required: true
        description: "GitHub ref to use"
        type: string
      version:
        required: true
        description: "Version to produce"
        type: string
      project:
        required: true
        description: "Project name, e.g.: the repository name"
        type: string
      release-notes:
        required: true
        description: "Release notes"
        type: string
      prerelease:
        required: false
        default: true
        description: "Whether to create a prerelease"
        type: boolean
      draft:
        required: false
        default: true
        description: "Whether to create a draft release"
        type: boolean

env:
  PULUMI_VERSION: ${{ inputs.version }}

jobs:
  sign:
    name: sign
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ inputs.ref }}

      - name: Install rsign2
        uses: baptiste0928/cargo-install@bf6758885262d0e6f61089a9d8c8790d3ac3368f # v1.3.0
        with:
          crate: rsign2
          version: 0.6.1

      - name: Install b3sum
        uses: baptiste0928/cargo-install@bf6758885262d0e6f61089a9d8c8790d3ac3368f # v1.3.0
        with:
          crate: b3sum
          version: 1.3.0

      - name: Download all artifacts
        uses: actions/download-artifact@v2
        with:
          path: artifacts.tmp
      - uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # v2.8.1
      - name: Flatten artifact directories
        run: |
          mkdir -p ./artifacts
          mv ./artifacts.tmp/artifacts-*/* ./artifacts

        # Each of these commands strips the ./ prefix to match existing (<=3.39) formatting.
      - name: Checksums with SHA256
        working-directory: artifacts
        env:
          version: ${{ inputs.version }}
        run: sha256sum ./pulumi-*.{tar.gz,zip} | sed 's/.\///' | tee "../artifacts/pulumi-${version}-checksums.txt"

      - name: Checksums with BLAKE3
        working-directory: artifacts
        run: b3sum ./* | sed 's/.\///' | tee ../artifacts/B3SUMS

      - name: Checksums with SHA512
        working-directory: artifacts
        run: sha512sum ./* | sed 's/.\///' | tee ../artifacts/SHA512SUMS

      - name: Sign binaries and checksums
        working-directory: artifacts
        shell: bash
        env:
          version: ${{ inputs.version }}
        run: |
          ls -la
          for file in *; do
              echo "$file"
              COSIGN_EXPERIMENTAL=1 cosign sign-blob \
                --output-signature="${file}".sig  \
                --output-certificate="${file}".pem \
                "${file}"
          done

      - uses: actions/upload-artifact@v2
        with:
          name: artifacts-signatures
          retention-days: 1
          path: |
            artifacts/*.sig
          if-no-files-found: error

  publish:
    name: release
    needs: [sign]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ inputs.ref }}
      - name: Get commit hash
        id: commit-info
        run: |
          SHA=$(git rev-parse HEAD)
          ./.github/scripts/set-output sha "$SHA"
      - name: Download all artifacts
        uses: actions/download-artifact@v2
        with:
          path: artifacts.tmp
      - name: Rename SDKs
        run: |
          (
            cd artifacts.tmp/artifacts-dotnet-sdk
            for file in *.nupkg ; do
              mv -vT "$file" "sdk-dotnet-$file"
            done
          )
          (
            cd artifacts.tmp/artifacts-python-sdk
            for file in *.whl ; do
              mv -vT "$file" "sdk-python-$file"
            done
          )
          (
            cd artifacts.tmp/artifacts-nodejs-sdk
            for file in *.tgz ; do
              mv -vT "$file" "sdk-nodejs-$file"
            done
          )
      - name: Flatten artifact directories
        run: |
          mkdir -p ./artifacts
          ls -la ./artifacts.tmp
          ls -la ./artifacts.tmp/artifacts-signatures
          mv ./artifacts.tmp/artifacts-*/* ./artifacts
          ls -la ./artifacts.tmp/artifacts-signatures
      - uses: ncipollo/release-action@3d2de22e3d0beab188d8129c27f103d8e91bf13a
        with:
          token: ${{ secrets.PULUMI_BOT_TOKEN }}
          name: v${{ inputs.version }}
          tag: v${{ inputs.version }}
          commit: "${{ fromJSON(steps.commit-info.outputs.sha) }}"
          draft: ${{ inputs.draft }}
          prerelease: ${{ inputs.prerelease }}
          allowUpdates: true

          body: |
            ${{ inputs.release-notes }}

          removeArtifacts: true
          replacesArtifacts: true
          artifactErrorsFailBuild: true
          artifacts: |
            artifacts/*