che-operator/.github/workflows/release.yml

# This Workflow performs a full release of che-operator
name: Release Che Operator
on:
  workflow_dispatch:
    inputs:
      version:
        description: 'The version that is going to be released. Should be in format 7.y.z'
        required: true
        default: '7.y.z'
      forceRecreateTags:
        description: If true, tags will be recreated. Use with caution
        required: false
        default: 'false'
jobs:
  build:
    runs-on: ubuntu-18.04
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0
      - name: Check existing tags
        run: |
          set +e
          RECREATE_TAGS=${{ github.event.inputs.forceRecreateTags }}
          VERSION=${{ github.event.inputs.version }}
          EXISTING_TAG=$(git ls-remote --exit-code origin refs/tags/${VERSION})
          if [[ -n ${EXISTING_TAG} ]]; then
            if [[ ${RECREATE_TAGS} == "true" ]]; then
              echo "[INFO] Removing tag for ${VERSION} version. New tag will be recreated during release."
              git push origin :$VERSION
            else
              echo "[ERROR] Cannot proceed with release - tag ${EXISTING_TAG} already exists."
              exit 1
            fi
          else
            echo "[INFO] No existing tags detected for $VERSION"
          fi          
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      - name: Set up Python 3.6
        uses: actions/setup-python@v2
        with:
          python-version: 3.6
      - name: Install operator courier, yq, and base32 wrapper
        run: |
          python -m pip install --upgrade pip
          pip install operator-courier==2.1.7
          pip install yq
          pip install semver
          # get base32 util from che-release project
          wget https://raw.githubusercontent.com/eclipse/che-release/master/utils/base32
          # copy base32 python-based helper script into dir that's accessed from PATH (so it's accessible to this and other called scripts) 
          sudo cp -f $(pwd)/base32 /usr/local/bin/ 
          sudo chmod +x /usr/local/bin/base32
          #remove base32 from current directory to avoid it being commited during release
          rm $(pwd)/base32           
      - name: Release operator
        env:
          IMAGE_REGISTRY_HOST: quay.io
          IMAGE_REGISTRY_USER_NAME: eclipse
        run: |
          CHE_VERSION=${{ github.event.inputs.version }}
          echo "CHE_VERSION=${CHE_VERSION}"
          BRANCH=${CHE_VERSION%.*}.x
          echo "BRANCH=${BRANCH}"
          hub version
          git config --global user.name "Mykhailo Kuznietsov"
          git config --global user.email "mkuznets@redhat.com"
          export GITHUB_TOKEN=${{ secrets.CHE_BOT_GITHUB_TOKEN }}
          set -e
          OP_SDK_DIR=/opt/operator-sdk
          mkdir -p $OP_SDK_DIR
          if [[ ${CHE_VERSION%.*} == 7.21 ]];then
            wget https://github.com/operator-framework/operator-sdk/releases/download/v0.10.0/operator-sdk-v0.10.0-x86_64-linux-gnu -O $OP_SDK_DIR/operator-sdk 
          else
            OPERATOR_SDK=$(sed -r 's|operator-sdk:\s*(.*)|\1|' REQUIREMENTS)
            wget https://github.com/operator-framework/operator-sdk/releases/download/${OPERATOR_SDK}/operator-sdk-${OPERATOR_SDK}-x86_64-linux-gnu -O $OP_SDK_DIR/operator-sdk 
          fi
          chmod +x $OP_SDK_DIR/operator-sdk
          export PATH="$PATH:$OP_SDK_DIR"
          export QUAY_ECLIPSE_CHE_USERNAME=${{ secrets.QUAY_USERNAME }} 
          export QUAY_ECLIPSE_CHE_PASSWORD=${{ secrets.QUAY_PASSWORD }}

          # we usually do not update nightly files during major releases
          if [[ ${CHE_VERSION} == *".0" ]]; then
            ./make-release.sh ${CHE_VERSION} --release --release-olm-files --update-nightly-olm-files 
          else
            git checkout ${BRANCH}
            bash -x ./make-release.sh ${CHE_VERSION} --release --release-olm-files
          fi

          # default robot account on quay does not have permissions for application repos
          # so we provide credentials for accounts that do
          export QUAY_USERNAME_K8S=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_KUBERNETES_USERNAME }}
          export QUAY_PASSWORD_K8S=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_KUBERNETES_PASSWORD }}
          export QUAY_USERNAME_OS=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_OPENSHIFT_USERNAME }}
          export QUAY_PASSWORD_OS=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_OPENSHIFT_PASSWORD }}
          # echo "[DEBUG] Using credentials:"
          # echo "[DEBUG] QUAY_USERNAME_K8S = ${QUAY_USERNAME_K8S} and"
          # echo "[DEBUG] QUAY_USERNAME_OS = ${QUAY_USERNAME_OS}"

          # publish quay applications to:
          # https://quay.io/application/eclipse-che-operator-kubernetes/eclipse-che-preview-kubernetes?tab=releases and
          # https://quay.io/application/eclipse-che-operator-openshift/eclipse-che-preview-openshift?tab=releases
          git checkout ${CHE_VERSION}-release
          ./make-release.sh ${CHE_VERSION} --push-olm-bundles

          # perform extra checkouts to ensure branches exist locally
          git checkout ${BRANCH}
          git checkout ${CHE_VERSION}-release
          force_update=""
          if [[ ${{ github.event.inputs.forceRecreateTags }} == "true" ]]; then force_update="--force"; fi
          ./make-release.sh ${CHE_VERSION} --push-git-changes --pull-requests ${force_update}          
      - name: Create failure MM message
        if: ${{ failure() }}
        run: |
          echo "{\"text\":\":no_entry_sign: Che Operator ${{ github.event.inputs.version }} release has failed: https://github.com/eclipse-che/che-operator/actions/workflows/release.yml\"}" > mattermost.json          
      - name: Create success MM message
        run: |
          echo "{\"text\":\":white_check_mark: Che Operator ${{ github.event.inputs.version }} release PR have been created: https://github.com/eclipse-che/che-operator/pulls/che-bot\"}" > mattermost.json          
      - name: Send MM message
        if: ${{ success() }} || ${{ failure() }}
        uses: mattermost/action-mattermost-notify@1.0.2
        env:
          MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK_URL }}
          MATTERMOST_CHANNEL: eclipse-che-releases
          MATTERMOST_USERNAME: che-bot