release.yml

---
name: "Release"

on:
  push:
    tags:
      # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet
      - 'v[0-9]+.[0-9]+.[0-9]+'

env:
  python_version: "{{ cookiecutter.python_version }}"

defaults:
  run:
    shell: 'bash --noprofile --norc -Eeuo pipefail {0}'

jobs:
  distribute:
    name: Distribute
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        platform:
          - linux/amd64
          - linux/arm64
    permissions:
      contents: write
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v3
      - name: Retrieve the tag
        run: echo "TAG=${GITHUB_REF/refs\/tags\//}" >> "${GITHUB_ENV}"
      - name: Setup python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ "{{ env.python_version }}" }}
      - uses: actions/cache@v3
        with:
          path: ~/.local/share/virtualenvs
          key: ${{ "{{ runner.os }}" }}-python-${{ "{{ env.python_version }}" }}-pipenv-${{ "{{ hashFiles('Pipfile.lock') }}" }}
      - name: Install Task
        uses: arduino/setup-task@v1
      - name: Initialize the repo
        run: task -v init
      - name: Set up QEMU for cross-platform emulation
        uses: docker/setup-qemu-action@v2
      - name: Build the image(s)
        run: task -v build
      - name: Generate the SBOMs
        run: task -v sbom
        env:
          PLATFORM: ${{ "{{ matrix.platform }}" }}
      - name: Upload the SBOMs
        uses: actions/upload-artifact@v3
        with:
          name: SBOM
          path: sbom.*.json
          if-no-files-found: error
      - name: Generate vuln scan results
        run: task -v vulnscan
        env:
          PLATFORM: ${{ "{{ matrix.platform }}" }}
      - name: Upload the vuln scan results
        uses: actions/upload-artifact@v3
        with:
          name: Vulns
          path: vulns.*.json
          if-no-files-found: error
      - name: Publish the release to GitHub
        uses: softprops/action-gh-release@v1
        env:
          GITHUB_TOKEN: ${{ "{{ secrets.GITHUB_TOKEN }}" }}
        with:
          name: ${{ "{{ env.TAG }}" }}
          tag_name: ${{ "{{ env.TAG }}" }}
          generate_release_notes: true
          files: |
            vulns.*.json
            sbom.*.json
          draft: false
          prerelease: false
{%- if cookiecutter.dockerhub == 'yes' %}
      - name: Log in to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ "{{ secrets.DOCKERHUB_USERNAME }}" }}
          password: ${{ "{{ secrets.DOCKERHUB_TOKEN }}" }}
      - name: Publish the release README to Docker Hub
        uses: peter-evans/dockerhub-description@v3
        with:
          username: ${{ "{{ secrets.DOCKERHUB_USERNAME }}" }}
          password: ${{ "{{ secrets.DOCKERHUB_TOKEN }}" }}
          repository: seiso/{{ cookiecutter.project_slug }}
          short-description: {{ cookiecutter.project_short_description }}
      - name: Publish the release to Docker Hub
        run: task -v publish
        env:
          PLATFORM: all
{%- endif -%}