release_nightly.yml

name: release nightly

on:
  schedule:
    - cron: "15 20 * * *" # 20:15 UTC, every day
  workflow_dispatch: {}

env:
  container_registry: ghcr.io/edgelesssys
  DO_NOT_TRACK: 1

concurrency:
  group: release-nightly
  cancel-in-progress: true

jobs:
  process-inputs:
    name: Process inputs
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    outputs:
      EFFECTIVE_VERSION: ${{ steps.nightly-version.outputs.value }}
      WITHOUT_V: ${{ steps.version-info.outputs.without_v }}
      RELEASE_BRANCH: ${{ steps.version-info.outputs.release_branch }}
      WORKING_BRANCH: ${{ steps.branch.outputs.value }}
      PREVIOUS_MINOR_TAG: ${{ steps.version-info.outputs.previous_minor_tag }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          fetch-tags: true
      - name: Get working branch
        id: branch
        run: echo "value=$(git branch --show-current)" >> "$GITHUB_OUTPUT"
      - name: Determine nightly version
        id: nightly-version
        run: |
          base=$(sed 's/-.*$//' version.txt)
          echo "value=v${base}-$(date -u +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
      - name: Parse version
        id: version-info
        uses: ./.github/actions/parse_version
        with:
          version: ${{ steps.nightly-version.outputs.value }}

  cleanup-nightly-drafts:
    name: Clean up old nightly draft releases
    runs-on: ubuntu-24.04
    needs: process-inputs
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ github.token }}
    steps:
      - name: Delete existing nightly draft releases
        env:
          GH_REPO: ${{ github.repository }}
        run: |
          gh release list --repo "${GH_REPO}" --limit 10 --json tagName,isDraft \
            | jq -r '.[] | select(.isDraft == true) | .tagName' \
            | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+-[0-9]{4}-[0-9]{2}-[0-9]{2}$' \
            | while IFS= read -r nightly_version; do
                echo "Deleting nightly draft release: ${nightly_version}"
                gh release delete "${nightly_version}" --repo "${GH_REPO}" --yes
              done

  release-x86_64-linux:
    name: "release-requirement: Build and push artifacts, create nightly draft release"
    runs-on: ubuntu-24.04
    needs: [process-inputs, cleanup-nightly-drafts]
    permissions:
      contents: write
      packages: write
      id-token: write
    outputs:
      LOG_COLLECTOR_IMAGE: ${{ steps.build.outputs.log_collector_image }}
      ARTIFACTS_URL: ${{ steps.build.outputs.s3-bucket-url }}
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ needs.process-inputs.outputs.WORKING_BRANCH }}
          persist-credentials: false
      - uses: ./.github/actions/release_build_linux
        id: build
        with:
          effective_version: ${{ needs.process-inputs.outputs.EFFECTIVE_VERSION }}
          without_v: ${{ needs.process-inputs.outputs.WITHOUT_V }}
          working_branch: ${{ needs.process-inputs.outputs.WORKING_BRANCH }}
          container_registry: ${{ env.container_registry }}
          previous_tag: ${{ needs.process-inputs.outputs.PREVIOUS_MINOR_TAG }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          cachix_token: ${{ secrets.CACHIX_AUTH_TOKEN }}

  release-aarch64-darwin:
    name: "release-requirement: Build aarch64-darwin CLI"
    runs-on: macos-latest
    needs: [process-inputs, release-x86_64-linux]
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ needs.process-inputs.outputs.WORKING_BRANCH }}
          persist-credentials: false
      - uses: ./.github/actions/release_build_darwin
        with:
          effective_version: ${{ needs.process-inputs.outputs.EFFECTIVE_VERSION }}
          without_v: ${{ needs.process-inputs.outputs.WITHOUT_V }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          cachix_token: ${{ secrets.CACHIX_AUTH_TOKEN }}

  report-artifacts:
    name: Pre-release artifacts
    needs: [release-x86_64-linux, release-aarch64-darwin]
    permissions: {}
    uses: ./.github/workflows/report_artifacts.yml
    with:
      url: ${{ needs.release-x86_64-linux.outputs.ARTIFACTS_URL }}

  vuln-scan:
    name: "dependency vulnerability scan"
    uses: ./.github/workflows/vuln_scan.yml
    secrets:
      GITHUB_TOKEN_IN: ${{ secrets.GITHUB_TOKEN }}
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
    permissions:
      contents: read
      security-events: write

  nightly:
    name: "release-requirement: e2e nightly"
    uses: ./.github/workflows/e2e_nightly.yml
    secrets:
      GITHUB_TOKEN_IN: ${{ secrets.GITHUB_TOKEN }}
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
      NUNKI_CI_COMMIT_PUSH_PR: ${{ secrets.NUNKI_CI_COMMIT_PUSH_PR }}
      TEAMS_CI_WEBHOOK: ${{ secrets.TEAMS_CI_WEBHOOK }}
      CONTRAST_GHCR_READ: ${{ secrets.CONTRAST_GHCR_READ }}
    permissions:
      contents: read
      packages: write

  test:
    strategy:
      matrix:
        platform:
          - name: Metal-QEMU-SNP
            node-installer-target-conf: none
            linux-runner: SNP
            is-public: true
          - name: Metal-QEMU-SNP-GPU
            node-installer-target-conf: k3s
            linux-runner: SNP-GPU
            is-public: false
          - name: Metal-QEMU-TDX
            node-installer-target-conf: k3s
            linux-runner: TDX
            is-public: false
          - name: Metal-QEMU-TDX-GPU
            node-installer-target-conf: none
            linux-runner: TDX-GPU
            is-public: true
        cli-arch:
          - x86_64-linux
          - aarch64-darwin
      fail-fast: false
    name: "release-requirement: e2e release on ${{ matrix.platform.name }} (${{ matrix.cli-arch }})"
    runs-on: ${{ matrix.cli-arch == 'aarch64-darwin' && 'macos-latest' || matrix.platform.linux-runner }}
    # Serialize matrix entries that share a cluster (linux + darwin) to
    # avoid clashing on coordinator state and resource cleanup.
    concurrency:
      group: e2e-release-${{ matrix.platform.name }}-${{ github.run_id }}
      cancel-in-progress: false
    permissions:
      contents: read
      packages: read
      # Needed for GH OIDC -> GCP WIF federation on the darwin entries.
      id-token: write
    needs: [process-inputs, release-x86_64-linux, release-aarch64-darwin, nightly]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ needs.process-inputs.outputs.WORKING_BRANCH }}
          persist-credentials: false
      - uses: ./.github/actions/release_e2e_test
        with:
          version: ${{ needs.process-inputs.outputs.EFFECTIVE_VERSION }}
          s3_base_url: ${{ needs.release-x86_64-linux.outputs.ARTIFACTS_URL }}
          container_registry: ${{ env.container_registry }}
          platform_name: ${{ matrix.platform.name }}
          node_installer_target_conf: ${{ matrix.platform.node-installer-target-conf }}
          self_hosted: ${{ matrix.cli-arch == 'x86_64-linux' }}
          cli_arch: ${{ matrix.cli-arch }}
          is_public: ${{ matrix.platform.is-public }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          cachix_token: ${{ secrets.CACHIX_AUTH_TOKEN }}
          wif_provider: ${{ vars.GCP_WIF_PROVIDER }}
          sa_email: ${{ vars.GCP_SA_EMAIL }}
          tailscale_client_id: ${{ secrets.TAILSCALE_CLIENT_ID }}
          tailscale_client_secret: ${{ secrets.TAILSCALE_CLIENT_SECRET }}
          log_collector_image: ${{ needs.release-x86_64-linux.outputs.LOG_COLLECTOR_IMAGE }}