BifrOSt

Latest change 3e3f91931c8d1bafb564ea5973cc99e04b19dfc4 - Prepare BifrOSt 0.2.1 release by Ólafur Búi Ólafsson

name: Publish final release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: Existing signed annotated tag (must equal vVERSION)
        required: true
        type: string
      source_revision:
        description: Exact 40-hex commit referenced by the tag
        required: true
        type: string
      artifact_run_id:
        description: Workflow run ID that produced the signed release assets
        required: true
        type: string
      artifact_name:
        description: Name of the release evidence artifact
        required: true
        default: bifrost-final-release
        type: string
      qemu_run_id:
        description: Successful QEMU qualification workflow run ID for the exact ISO
        required: true
        type: string
      qemu_artifact_name:
        description: QEMU qualification evidence artifact name
        required: true
        type: string
      signer_fingerprint:
        description: Full public signing-key fingerprint
        required: true
        type: string
      release_notes:
        description: Final release notes
        required: true
        type: string

permissions:
  actions: read
  contents: write

concurrency:
  group: publish-final-release-${{ inputs.tag }}
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment: release
    steps:
      - name: Reject symbolic or abbreviated identities
        env:
          RELEASE_TAG: ${{ inputs.tag }}
          SOURCE_REVISION: ${{ inputs.source_revision }}
          SIGNER_FINGERPRINT: ${{ inputs.signer_fingerprint }}
        run: |
          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?$ ]]
          [[ "$SOURCE_REVISION" =~ ^[0-9a-fA-F]{40}$ ]]
          [[ "$SIGNER_FINGERPRINT" =~ ^([0-9a-fA-F]{40}|[0-9a-fA-F]{64})$ ]]
      - name: Check out the exact source revision and tags
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.source_revision }}
          fetch-depth: 0
          fetch-tags: true
          persist-credentials: false
      - name: Download signed candidate without modifying it
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          github-token: ${{ github.token }}
          repository: ${{ github.repository }}
          run-id: ${{ inputs.artifact_run_id }}
          name: ${{ inputs.artifact_name }}
          path: candidate
      - name: Download exact-ISO QEMU qualification evidence
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          github-token: ${{ github.token }}
          repository: ${{ github.repository }}
          run-id: ${{ inputs.qemu_run_id }}
          name: ${{ inputs.qemu_artifact_name }}
          path: qualification
      - name: Import only the tracked declared public verification key
        env:
          SIGNER_FINGERPRINT: ${{ inputs.signer_fingerprint }}
        run: |
          gpg --batch --import ./keys/bifrost-release-key.asc
          resolved="$(gpg --batch --with-colons --fingerprint "$SIGNER_FINGERPRINT" | sed -n 's/^fpr:::::::::\([^:]*\):$/\1/p' | head -n 1)"
          [[ "${resolved,,}" == "${SIGNER_FINGERPRINT,,}" ]]
      - name: Materialize operator-supplied release notes
        env:
          RELEASE_NOTES: ${{ inputs.release_notes }}
        run: printf '%s\n' "$RELEASE_NOTES" > "$RUNNER_TEMP/bifrost-release-notes.txt"
      - name: Verify identity, provenance, signatures, and publish once
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          python3 ./publish-release.py \
            --repository "$GITHUB_REPOSITORY" \
            --tag "${{ inputs.tag }}" \
            --source-revision "${{ inputs.source_revision }}" \
            --signer-fingerprint "${{ inputs.signer_fingerprint }}" \
            --asset-dir candidate \
            --qemu-evidence-dir qualification \
            --notes-file "$RUNNER_TEMP/bifrost-release-notes.txt"