release.yaml

---
name: Release
on: [push, pull_request]
permissions: read-all
jobs:
  main:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
      - id: goversion
        run: echo "goversion=$(cat .go-version)" >> "$GITHUB_OUTPUT"
      - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
        with:
          go-version: ${{ steps.goversion.outputs.goversion }}
      - name: release
        run: |
          set -euo pipefail

          git config --global user.email "github-action@etcd.io"
          git config --global user.name "Github Action"
          gpg --batch --gen-key <<EOF
          %no-protection
          Key-Type: 1
          Key-Length: 2048
          Subkey-Type: 1
          Subkey-Length: 2048
          Name-Real: Github Action
          Name-Email: github-action@etcd.io
          Expire-Date: 0
          EOF
          DRY_RUN=true ./scripts/release.sh --no-upload --no-docker-push --in-place 3.6.99
      - name: test-image
        run: |
          VERSION=3.6.99 ./scripts/test_images.sh
      - name: save-image
        run: |
          docker image save -o /tmp/etcd-img.tar gcr.io/etcd-development/etcd
      - name: upload-image
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
          name: etcd-img
          path: /tmp/etcd-img.tar
          retention-days: 1
  trivy-scan:
    needs: main
    strategy:
      fail-fast: false
      matrix:
        platforms: [amd64, arm64, ppc64le, s390x]
    permissions:
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
    runs-on: ubuntu-latest
    steps:
      - name: get-image
        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
        with:
          name: etcd-img
          path: /tmp
      - name: load-image
        run: |
          docker load < /tmp/etcd-img.tar
      - name: trivy-scan
        uses: aquasecurity/trivy-action@595be6a0f6560a0a8fc419ddf630567fc623531d # v0.22.0
        with:
          image-ref: 'gcr.io/etcd-development/etcd:v3.6.99-${{ matrix.platforms }}'
          severity: 'CRITICAL,HIGH'
          format: 'sarif'
          output: 'trivy-results-${{ matrix.platforms }}.sarif'
      - name: upload scan results
        uses: github/codeql-action/upload-sarif@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff # v3.25.8
        with:
          sarif_file: 'trivy-results-${{ matrix.platforms }}.sarif'