k3s/.github/workflows/release.yml

name: K3s Release

on:
  release:
    types: [published]

permissions:
  contents: read
  packages: read

jobs:
  build-amd64:
    name: Build Binary (amd64)
    uses: ./.github/workflows/build-k3s.yaml
    with:
      upload-build: true

  build-arm64:
    name: Build Binary (arm64)
    uses: ./.github/workflows/build-k3s.yaml
    with:
      arch: arm64
      upload-build: true

  build-arm:
    name: Build Binary (arm)
    uses: ./.github/workflows/build-k3s.yaml
    with:
      arch: arm
      upload-build: true

  push-release-image:
    name: Build and Push Multi-Arch Image
    runs-on: ubuntu-latest
    permissions: 
      packages: write # Needed to push images to GHCR
    needs: [build-amd64, build-arm64, build-arm]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure image tags
        id: tag_config
        run: |
          TAG=${GITHUB_REF#refs/tags/}
          
          # Base configuration - always transform the main tag
          # Transforms v1.32.4-rc1+k3s1 → v1.32.4-rc1-k3s1
          BASE_CONFIG="type=raw,value=${TAG//+/-}"
          
          if [[ "${TAG,,}" == *"rc"* ]]; then
            echo "RC release detected: $TAG"
            echo "tag_spec=$BASE_CONFIG" >> $GITHUB_OUTPUT
          else
            echo "Stable release detected: $TAG"
            echo "tag_spec=$BASE_CONFIG
          type=semver,pattern=v{{major}}.{{minor}}" >> $GITHUB_OUTPUT
          fi

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/${{ github.repository_owner }}/k3s
          flavor: latest=false
          tags: ${{ steps.tag_config.outputs.tag_spec }}
      
      - name: "Download K3s build"
        uses: actions/download-artifact@v4
        with:
          pattern: k3s*
          path: ./dist/artifacts
          merge-multiple: true

      - name: Prepare build folder
        run: |
          mkdir -p ./build/out
          cp ./dist/artifacts/data-* ./build/out

      - name: Build and push K3s runtime image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./package/Dockerfile
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            DRONE_TAG=${{ github.ref_name }}

  upload-release-airgap:
    name: Build Airgap Pkg (${{ matrix.arch }})
    runs-on: ubuntu-latest # Runs on standard runner, docker pulls with --platform
    permissions: 
      contents: write  # Needed to update release with assets
    strategy:
      matrix:
        arch: [amd64, arm64, arm]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Install Dependencies
        run: sudo apt-get update -y && sudo apt-get install -y zstd pigz

      - name: Create Airgap Package (${{ matrix.arch }})
        run: |
          mkdir -p ./dist/artifacts
          ./scripts/package-airgap ${{ matrix.arch }}

      - name: Caculate Airgap sha256sum
        run: sha256sum dist/artifacts/k3s-airgap-images-${{ matrix.arch }}* | sed 's|dist/artifacts/||' > dist/artifacts/k3s-airgap-images-${{ matrix.arch }}.sha256sum

      - name: Upload Airgap sha256sum
        uses: actions/upload-artifact@v4
        with:
          name: k3s-airgap-images-${{ matrix.arch }}.sha256sum
          path: dist/artifacts/k3s-airgap-images-${{ matrix.arch }}.sha256sum
      
      - name: Upload k3s-images.txt to Release
        uses: softprops/action-gh-release@v2
        # This action is recommended by GITHUB, they don't support a first party action for releases
        # See https://github.com/actions/create-release?tab=readme-ov-file#github-action---releases-api
        if: ${{ matrix.arch == 'amd64' }}
        with:
          files: |
            dist/artifacts/k3s-images.txt
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload Airgap Assets to Release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            dist/artifacts/k3s-airgap-images*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  upload-release-assets:
    name: Prepare and Upload Release Assets
    permissions: 
      contents: write # Needed to update release with assets
    runs-on: ubuntu-latest
    needs: [build-amd64, build-arm64, build-arm, upload-release-airgap]
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: "Download Binaries and Airgap sha256sum"
      uses: actions/download-artifact@v4
      with:
        pattern: k3s*
        path: ./dist/artifacts
        merge-multiple: true
    
    - name: "Combine and format sha256sum files"
      run: |
        for arch in amd64 arm64 arm; do
          output_file="./dist/artifacts/sha256sum-${arch}.txt"
          cat ./dist/artifacts/k3s-airgap-images-$arch*.sha256sum >> "$output_file"
          rm ./dist/artifacts/k3s-airgap-images-$arch*.sha256sum
          if [[ "$arch" == "amd64" ]]; then
            cat ./dist/artifacts/k3s.sha256sum >> "$output_file"
            rm ./dist/artifacts/k3s.sha256sum # Remove the original file to avoid uploading it
          else
            cat ./dist/artifacts/k3s-${arch}.sha256sum >> "$output_file"
            rm ./dist/artifacts/k3s-${arch}.sha256sum # Remove the original file to avoid uploading it
          fi
        done    
    
    - name: Upload Assets to Release
      uses: softprops/action-gh-release@v2.2.1
      with:
        files: |
          dist/artifacts/k3s*
          dist/artifacts/sha256sum*
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}