release.yml

on:
  push:
    branches:
      - main
      - "release/**"
    tags:
      - "v*" # Push events to matching v*, i.e. v1.0, v20.15.10
  pull_request:
    branches:
      - main
      - "release/**"

name: Release

env:
  GO_VERSION: "1.23.3"

permissions: # added using https://github.com/step-security/secure-workflows
  contents: read

jobs:
  check:
    name: Check Signed Tag
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      stringver: ${{ steps.contentrel.outputs.stringver }}

    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ github.ref }}
          path: src/github.com/containerd/containerd

      - name: Check signature
        run: |
          releasever=${{ github.ref }}
          releasever="${releasever#refs/tags/}"
          TAGCHECK=$(git tag -v ${releasever} 2>&1 >/dev/null) ||
          echo "${TAGCHECK}" | grep -q "error" && {
              echo "::error::tag ${releasever} is not a signed tag. Failing release process."
              exit 1
          } || {
              echo "Tag ${releasever} is signed."
              exit 0
          }
        working-directory: src/github.com/containerd/containerd

      - name: Release content
        id: contentrel
        run: |
          RELEASEVER=${{ github.ref }}
          echo "stringver=${RELEASEVER#refs/tags/v}" >> $GITHUB_OUTPUT
          git tag -l ${RELEASEVER#refs/tags/} -n20000 | tail -n +3 | cut -c 5- >release-notes.md
        working-directory: src/github.com/containerd/containerd

      - name: Save release notes
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: containerd-release-notes
          path: src/github.com/containerd/containerd/release-notes.md

  build:
    name: Build Release Binaries
    runs-on: ubuntu-20.04
    timeout-minutes: 30
    strategy:
      matrix:
        include:
          # Ubuntu 22.04 can't be used until we drop support for binary compatibility with dynamically-linked glibc 2.17 (CentOS 7).
          # https://github.com/containerd/containerd/issues/7255
          # https://github.com/containerd/containerd/issues/7961
          - dockerfile-ubuntu: 20.04
            dockerfile-platform: linux/amd64
          - dockerfile-ubuntu: 20.04
            dockerfile-platform: linux/arm64
          - dockerfile-ubuntu: 20.04
            dockerfile-platform: linux/ppc64le
          - dockerfile-ubuntu: 20.04
            dockerfile-platform: linux/s390x
          - dockerfile-ubuntu: 20.04
            dockerfile-platform: linux/riscv64
          - dockerfile-ubuntu: 20.04
            dockerfile-platform: windows/amd64
    steps:
      - name: Set RELEASE_VER
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
        shell: bash
        run: |
          releasever=${{ github.ref }}
          releasever="${releasever#refs/tags/}"
          echo "RELEASE_VER=${releasever}" >> $GITHUB_ENV
      - name: Checkout containerd
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          # Intentionally use github.repository instead of containerd/containerd to
          # make this action runnable on forks.
          # See https://github.com/containerd/containerd/issues/5098 for the context.
          repository: ${{ github.repository }}
          ref: ${{ github.ref }}
          path: src/github.com/containerd/containerd

      - name: Setup buildx instance
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
        with:
          use: true
      - uses: crazy-max/ghaction-github-runtime@b3a9207c0e1ef41f4cf215303c976869d0c2c1c4 # v3.0.0
      - name: Make
        shell: bash
        run: |
          cache="--cache-from=type=gha,scope=containerd-release --cache-to=type=gha,scope=containerd-release"
          if [[ "${PLATFORM}" =~ "windows" ]]; then
            # For Windows the cni build script generates a config but shells out to powershell (and also assume it is running on windows) to get a gateway and subnet.
            # The values provided here are taken from packages that we previously generated.
            export GATEWAY=172.21.16.1
            export PREFIX_LEN=12
            BUILD_ARGS="--build-arg GATEWAY --build-arg PREFIX_LEN"
          fi
          docker buildx build ${cache} --build-arg RELEASE_VER --build-arg UBUNTU_VERSION=${{ matrix.dockerfile-ubuntu }} --build-arg GO_VERSION ${BUILD_ARGS} -f .github/workflows/release/Dockerfile --platform=${PLATFORM} -o releases/ .
          echo PLATFORM_CLEAN=${PLATFORM/\//-} >> $GITHUB_ENV

          # Remove symlinks since we don't want these in the release Artifacts (if any)
          find ./releases/ -maxdepth 1 -type l | xargs rm -f
        working-directory: src/github.com/containerd/containerd
        env:
          PLATFORM: ${{ matrix.dockerfile-platform }}
      - name: Save Artifacts
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: release-tars-${{env.PLATFORM_CLEAN}}
          path: src/github.com/containerd/containerd/releases/*.tar.gz*

  sbom:
    name: Create SBOM
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    needs: [check]
    steps:
      - name: Checkout containerd
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          # Intentionally use github.repository instead of containerd/containerd to
          # make this action runnable on forks.
          # See https://github.com/containerd/containerd/issues/5098 for the context.
          repository: containerd/containerd
          ref: v2.0.0
          path: src/github.com/containerd/containerd
      - name: Create SBOM
        run: |
          gh ext install advanced-security/gh-sbom
          gh sbom | jq > sbom.json
        working-directory: src/github.com/containerd/containerd
        env:
          GH_TOKEN: ${{ github.token }}
      - name: Save Artifacts
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: containerd-${{ needs.check.outputs.stringver }}-sbom.spdx.json
          path: src/github.com/containerd/containerd/sbom.json

  release:
    name: Create containerd Release
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: write
      id-token: write
      attestations: write
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    needs: [build, check, sbom]
    steps:
      - name: Download builds and release notes
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          path: builds
      - name: Attest Artifacts
        id: attest
        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
        with:
          subject-path: ./builds/release-tars-**/*.tar.gz
      - name: Rename attestation artifact
        run: mv ${{ steps.attest.outputs.bundle-path }} containerd-${{ needs.check.outputs.stringver }}-attestation.intoto.jsonl
      - name: Attest SBOM
        uses: actions/attest-sbom@5026d3663739160db546203eeaffa6aa1c51a4d6 # v1.4.1
        with:
          subject-path: ./builds/release-tars-**/*
          sbom-path: ./builds/containerd-${{ needs.check.outputs.stringver }}-sbom.spdx.json
      - name: Create Release
        uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          fail_on_unmatched_files: true
          name: containerd ${{ needs.check.outputs.stringver }}
          draft: false
          prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'rc') }}
          body_path: ./builds/containerd-release-notes/release-notes.md
          files: |
            builds/release-tars-**/*
            containerd-*-attestation.intoto.jsonl
            containerd-*-sbom.spdx.json
          make_latest: false