Release pipeline

.github/workflows/release.yaml

@@ -1,62 +1,25 @@
-name: Release
+# Release workflow is the main workflow that coordinates various GitHub workflows involved in a release of Resonate.
+name: Release Workflow
 
 on:
   release:
     types:
-      - created
-
-permissions:
-  contents: write
+      - published
+  workflow_dispatch:
 
 jobs:
-  release-linux-artifact:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-      - name: Set up Go 1.21
-        uses: actions/setup-go@v5
-        with:
-          go-version: 1.21
-      - name: Install cross-compiler for linux/arm64
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu
-      - name: Build for both amd64 and arm64
-        run: |
-          GOOS=linux GOARCH=amd64 CGO_ENABLED=1 go build -o ./bin/linux-x86_64/ ./...
-          CC=aarch64-linux-gnu-gcc GOOS=linux GOARCH=arm64 CGO_ENABLED=1 go build -o ./bin/linux-aarch64/ ./...
-          chmod +x ./bin/linux-x86_64/resonate
-          chmod +x ./bin/linux-aarch64/resonate
-          mv ./bin/linux-x86_64/resonate ./bin/resonate_linux_x86_64 
-          mv ./bin/linux-aarch64/resonate ./bin/resonate_linux_aarch64
-      - name: Upload Artifacts
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          gh release upload ${{ github.event.release.tag_name }} ./bin/resonate_linux_x86_64 --clobber
-          gh release upload ${{ github.event.release.tag_name }} ./bin/resonate_linux_aarch64 --clobber
+  publish-github-image:
+    uses: ./.github/workflows/release_publish_github_image.yaml
+    with:
+      tag: ${{ github.ref_name }}
+
+  publish-github-artifacts:
+    uses: ./.github/workflows/release_publish_github_artifacts.yaml
+    with:
+      tag: ${{ github.ref_name }}
 
-  release-darwin-artifact:
-    runs-on: macos-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: 1.21
-      - name: Build for both amd64 and arm64
-        run: |
-          GOOS=darwin GOARCH=amd64 CGO_ENABLED=1 go build -o ./bin/darwin-x86_64/ ./... 
-          GOOS=darwin GOARCH=arm64 CGO_ENABLED=1 go build -o ./bin/darwin-aarch64/ ./...
-          chmod +x ./bin/darwin-x86_64/resonate
-          chmod +x ./bin/darwin-aarch64/resonate
-          mv ./bin/darwin-x86_64/resonate ./bin/resonate_darwin_x86_64 
-          mv ./bin/darwin-aarch64/resonate ./bin/resonate_darwin_aarch64
-      - name: Upload Artifacts
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          gh release upload ${{ github.event.release.tag_name }} ./bin/resonate_darwin_x86_64 --clobber
-          gh release upload ${{ github.event.release.tag_name }} ./bin/resonate_darwin_aarch64 --clobber
+  verify-github-artifacts:
+    needs: [publish-github-image, publish-github-artifacts]
+    uses: ./.github/workflows/release_verify_artifacts.yaml
+    with:
+      tag: ${{ github.ref_name }}

.github/workflows/release_publish_github_artifacts.yaml

@@ -0,0 +1,89 @@
+name: Publish GitHub Release
+
+on:
+  workflow_call:
+    inputs:
+      tag:
+        description: "The tag version to use for verification"
+        required: true
+        type: string
+
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  release-linux-artifact:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Set up Go 1.21
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.21
+      - name: Install cross-compiler for linux/arm64
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu
+      - name: Build for both amd64 and arm64
+        run: |
+          # Build resonate binaries
+          GOOS=linux GOARCH=amd64 CGO_ENABLED=1 go build -o ./bin/linux-x86_64/ ./...
+          CC=aarch64-linux-gnu-gcc GOOS=linux GOARCH=arm64 CGO_ENABLED=1 go build -o ./bin/linux-aarch64/ ./...
+
+          # Change permissions
+          chmod +x ./bin/linux-x86_64/resonate
+          chmod +x ./bin/linux-aarch64/resonate
+
+          # Compress binaries
+          tar -czvf resonate_linux_x86_64.tar.gz ./bin/linux-x86_64/resonate
+          tar -czvf resonate_linux_aarch64.tar.gz ./bin/linux-aarch64/resonate
+
+          # Create checksums 
+          sha256sum resonate_linux_x86_64.tar.gz > resonate_linux_x86_64.tar.gz.sha256          
+          sha256sum resonate_linux_aarch64.tar.gz > resonate_linux_aarch64.tar.gz.sha256
+      - name: Upload Artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release upload ${{ inputs.tag }} resonate_linux_x86_64.tar.gz --clobber
+          gh release upload ${{ inputs.tag }} resonate_linux_x86_64.tar.gz.sha256 --clobber
+          gh release upload ${{ inputs.tag }} resonate_linux_aarch64.tar.gz --clobber
+          gh release upload ${{ inputs.tag }} resonate_linux_aarch64.tar.gz.sha256 --clobber
+
+  release-darwin-artifact:
+    runs-on: macos-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.21
+      - name: Build for both amd64 and arm64
+        run: |
+          # Build resonate binaries
+          GOOS=darwin GOARCH=amd64 CGO_ENABLED=1 go build -o ./bin/darwin-x86_64/ ./... 
+          GOOS=darwin GOARCH=arm64 CGO_ENABLED=1 go build -o ./bin/darwin-aarch64/ ./...
+
+          # Change permissions
+          chmod +x ./bin/darwin-x86_64/resonate
+          chmod +x ./bin/darwin-aarch64/resonate
+
+          # Compress binaries
+          tar -czvf resonate_darwin_x86_64.tar.gz ./bin/darwin-x86_64/resonate          
+          tar -czvf resonate_darwin_aarch64.tar.gz ./bin/darwin-aarch64/resonate
+
+          # Create checksums 
+          shasum -a 256 resonate_darwin_x86_64.tar.gz > resonate_darwin_x86_64.tar.gz.sha256
+          shasum -a 256 resonate_darwin_aarch64.tar.gz > resonate_darwin_aarch64.tar.gz.sha256
+      - name: Upload Artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release upload ${{ inputs.tag }} resonate_darwin_x86_64.tar.gz --clobber
+          gh release upload ${{ inputs.tag }} resonate_darwin_x86_64.tar.gz.sha256 --clobber
+          gh release upload ${{ inputs.tag }} resonate_darwin_aarch64.tar.gz --clobber
+          gh release upload ${{ inputs.tag }} resonate_darwin_aarch64.tar.gz.sha256 --clobber

.github/workflows/publish.yml → .github/workflows/release_publish_github_image.yaml

@@ -1,15 +1,15 @@
-# ref: https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions#upgrading-a-workflow-that-accesses-a-registry-using-a-personal-access-token
-name: Create and publish a Docker image
+name: Publish GitHub Docker image
 
-# Configures this workflow to run every time a change is pushed to the branch called `release-*`.
-# This aligns with the release branching change coming in v1.0.0 for hot fixes.
 on:
-  push:
-    branches: ["release-*"]
+  workflow_call:
+    inputs:
+      tag:
+        description: 'The tag version to use for the release'
+        required: true
+        type: string
+
   workflow_dispatch:
 
-# Defines two custom environment variables for the workflow. These are used for the Container
-# registry domain, and a name for the Docker image that this workflow builds.
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
@@ -26,7 +26,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      # Add support for more platforms with QEMU (optional)
+      # Add support for more platforms with QEMU
       # https://github.com/docker/setup-qemu-action
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -52,13 +52,14 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-
-      # This step uses the `docker/build-push-action` action to build the image, based on your
+          tags: |
+            type=raw,value=${{ inputs.tag }}
+            type=raw,value=latest
+
+      # This step uses the `docker/build-push-action` action to build the image, based on our
       # repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
       # It uses the `context` parameter to define the build's context as the set of files located
-      # in the specified path. For more information,
-      # see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the
-      # `docker/build-push-action` repository. It uses the `tags` and `labels` parameters to tag
+      # in the specified path. It uses the `tags` and `labels` parameters to tag
       # and label the image with the output from the "meta" step.
       - name: Build and push Docker image
         uses: docker/build-push-action@v5
@@ -68,3 +69,5 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          provenance: true
+          sbom: true

.github/workflows/release_verify_artifacts.yaml

@@ -0,0 +1,61 @@
+name: Verify GitHub Artifacts
+
+on:
+  workflow_call:
+    inputs:
+      tag:
+        description: 'The tag version to use for verification'
+        required: true
+        type: string
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  seed:
+    runs-on: ubuntu-latest
+    steps:
+    - id: seed
+      name: Set random seed
+      run: echo seed=$RANDOM >> $GITHUB_OUTPUT
+    outputs:
+      seed: ${{ inputs.seed || steps.seed.outputs.seed }}
+
+
+  verify-github-image:
+    runs-on: ubuntu-latest
+    needs: [seed]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+      - name: Download and test GHCR image
+        run: |
+          # Login to GHCR
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+
+          # Pull the test image
+          docker pull ghcr.io/guergabo/resonate:${{ inputs.tag }}
+
+          # Run the test image
+          docker run --rm ghcr.io/guergabo/resonate:${{ inputs.tag }} dst run --seed ${{ needs.seed.outputs.seed }} --aio-store sqlite
+
+
+  verify-github-release:
+    runs-on: ubuntu-latest
+    needs: [seed]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+      - name: Download and test GH release
+        run: |
+          # Download the release artifact
+          curl -L -O "https://github.com/guergabo/resonate/releases/download/${{ inputs.tag }}/resonate_linux_x86_64.tar.gz"
+
+          # Extract the artifact
+          tar -xzf resonate_linux_x86_64.tar.gz
+
+          # Run the extracted artifact
+          ./bin/linux-x86_64/resonate dst run --seed ${{ needs.seed.outputs.seed }} --aio-store sqlite

CONTRIBUTING.md

@@ -101,4 +101,4 @@ Here are some areas where your contributions would be valuable:
 * Enhancements to our testing and reliability efforts.
 * Add support for the following databases: MySQL, Elasticsearch, MongoDB.
 
-Thank you for your contributions and support in building a better Resonate! 🚀
+Thank you for your contributions and support in building a better Resonate! 🚀