release.yml

name: Release
run-name: Release - ${{ inputs.release_mode }}

on:
  workflow_dispatch:
    inputs:
      release_mode:
        description: "Release Mode"
        default: "Standard Release"
        type: choice
        options:
          - Standard Release
          - Dry Run

jobs:
  release:
    name: Release Helm chart
    runs-on: ubuntu-22.04
    environment: Production
    permissions:
      actions: read
      contents: write
      packages: write
    steps:
      - name: Checkout repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          ref: main

      - name: Login to Azure - CI Subscription
        uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
        with:
          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}

      - name: Retrieve secrets
        id: retrieve-secrets
        uses: bitwarden/gh-actions/get-keyvault-secrets@main
        with:
          keyvault: "bitwarden-ci"
          secrets: "github-gpg-private-key, github-gpg-private-key-passphrase"

      - name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@cb9bde2e2525e640591a934b1fd28eef1dcaf5e5 # v6.2.0
        with:
          gpg_private_key: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key }}
          passphrase: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key-passphrase }}
          git_user_signingkey: true
          git_commit_gpgsign: true

      - name: Setup git
        run: |
          git config --local user.email "106330231+bitwarden-devops-bot@users.noreply.github.com"
          git config --local user.name "bitwarden-devops-bot"

      - name: Set up Helm
        uses: Azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
        with:
          version: v3.13.1

      - name: Download Helm chart artifact - Self Host
        uses: bitwarden/gh-actions/download-artifacts@main
        with:
          branch: main
          path: .cr-release-packages
          workflow: build-self-host.yml
          workflow_conclusion: success

      - name: Download Helm chart artifact - SM Operator
        uses: bitwarden/gh-actions/download-artifacts@main
        with:
          branch: main
          path: .cr-release-packages
          workflow: build-sm-operator.yml
          workflow_conclusion: success

      - name: Release Helm chart
        if: ${{ github.event.inputs.release_mode != 'Dry Run' }}
        env:
          CR_GENERATE_RELEASE_NOTES: true
          CR_MAKE_RELEASE_LATEST: true
          CR_SKIP_EXISTING: true
          CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        uses: helm/chart-releaser-action@be16258da8010256c6e82849661221415f031968 # v1.5.0
        with:
          skip_packaging: true