release.yaml

name: Release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing tag to release (e.g. v0.1.0); workflow_dispatch rebuilds assets for testing"
        required: true
        type: string
      draft:
        description: "Create/update the GitHub Release as a draft"
        required: false
        type: boolean
        default: false
      prerelease:
        description: "Mark the GitHub Release as a pre-release"
        required: false
        type: boolean
        default: false

permissions:
  contents: read

concurrency:
  group: release-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}
  cancel-in-progress: false

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: kollect
  PIPELINE_IMAGE_NAME: kollect-pipeline
  # ADR-0709: the Helm chart is a DIFFERENT GHCR repository from the controller image
  # (ghcr.io/<owner>/charts/kollect vs ghcr.io/<owner>/kollect), so it gets its own name
  # constant. The two happen to share the string "kollect" -- which is exactly why they
  # were confused before -- but they are not the same thing and must not share a variable.
  # The last path segment cannot change: helm push appends it, Artifact Hub requires
  # ".../chart-name", and .Chart.Name feeds the immutable Deployment selector.
  CHART_NAME: kollect

jobs:
  # Read-only gate. Verifier scripts are loaded from the default branch so a
  # candidate tag cannot supply its own eligibility logic (AUD-SEC-02).
  eligibility:
    name: release eligibility
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: read
      pull-requests: read
    outputs:
      sha: ${{ steps.prove.outputs.sha }}
      tag: ${{ steps.prove.outputs.tag }}
      version: ${{ steps.prove.outputs.version }}
    steps:
      - name: Checkout trusted gate scripts from default branch
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.repository.default_branch }}
          sparse-checkout: |
            hack/release
          sparse-checkout-cone-mode: true
          persist-credentials: false
          path: trusted-gate

      - name: Resolve tag SHA and prove reviewed-main eligibility
        id: prove
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          INPUT_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || '' }}
        run: |
          set -euo pipefail
          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
            TAG="${INPUT_TAG}"
          else
            TAG="${GITHUB_REF_NAME}"
          fi
          if [[ ! "${TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
            echo "tag must look like vX.Y.Z (got ${TAG})" >&2
            exit 1
          fi
          # Resolve via API (peels annotated tags). Do not trust a candidate checkout.
          SHA="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${TAG}" --jq .sha)"
          if [[ ! "${SHA}" =~ ^[0-9a-f]{40}$ ]]; then
            echo "failed to resolve ${TAG} to a full commit SHA" >&2
            exit 1
          fi
          bash trusted-gate/hack/release/verify-eligibility.sh "${SHA}"
          {
            echo "sha=${SHA}"
            echo "tag=${TAG}"
            echo "version=${TAG#v}"
          } >> "${GITHUB_OUTPUT}"

  release:
    name: release
    needs: eligibility
    runs-on: ubuntu-latest
    # Require a protected "release" environment (required reviewers / wait timer)
    # so write credentials cannot be obtained by stripping the eligibility job from
    # a malicious tagged workflow copy alone.
    environment: release
    # contents: write — create/update GitHub Release assets (softprops/action-gh-release, git-cliff)
    # packages: write — push container image and OCI Helm chart to GHCR
    # id-token: write — cosign keyless signing via Sigstore OIDC
    # attestations: write — publish SLSA provenance to GH attestations API
    # artifact-metadata: write — registry storage records for attested images
    permissions:
      contents: write
      packages: write
      id-token: write
      attestations: write
      artifact-metadata: write
    outputs:
      version: ${{ steps.version.outputs.version }}
      tag: ${{ steps.version.outputs.tag }}
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
          # Bind publication to the immutable SHA proven by eligibility — never the
          # mutable tag ref alone.
          ref: ${{ needs.eligibility.outputs.sha }}

      - name: Confirm immutable publication SHA
        id: version
        env:
          EXPECT_SHA: ${{ needs.eligibility.outputs.sha }}
          TAG: ${{ needs.eligibility.outputs.tag }}
          VERSION: ${{ needs.eligibility.outputs.version }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          GOT="$(git rev-parse HEAD)"
          if [[ "${GOT}" != "${EXPECT_SHA}" ]]; then
            echo "checked-out HEAD ${GOT} != eligibility SHA ${EXPECT_SHA}" >&2
            exit 1
          fi
          TAG_SHA="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${TAG}" --jq .sha)"
          if [[ "${TAG_SHA}" != "${EXPECT_SHA}" ]]; then
            echo "tag ${TAG} now resolves to ${TAG_SHA}, not proven SHA ${EXPECT_SHA}" >&2
            exit 1
          fi
          echo "tag=${TAG}" >> "${GITHUB_OUTPUT}"
          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          # zizmor cache-poisoning: this tag-triggered workflow publishes runtime artifacts, so a
          # cache an untrusted event could seed must not feed the release build. Cache off.
          cache: false

      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
        with:
          version: v3.22.1

      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0

      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Log in to GHCR
        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - id: image
        run: |
          OWNER="$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')"
          IMAGE="${{ env.REGISTRY }}/${OWNER}/${{ env.IMAGE_NAME }}"
          echo "repository=${IMAGE}" >> "${GITHUB_OUTPUT}"
          # DR-FIND-07: push the controller image ONLY at the v-prefixed tag.
          # The bare "<version>" tag (e.g. :0.13.0) is intentionally omitted here.
          # Charts published before ADR-0709 occupy ghcr.io/<owner>/kollect:<version>
          # on this very repository, and ADR-0709 leaves those tags in place, so
          # publishing the image at a bare tag could still collide with a chart
          # manifest and make default/bare-tag pulls fail with
          # CreateContainerConfigError. New charts go to <owner>/charts/<chart>
          # instead (see the "Derive chart OCI coordinate" step), which is what makes
          # a *new* collision unreachable -- not this omission on its own.
          echo "tags=${IMAGE}:${{ steps.version.outputs.tag }}" >> "${GITHUB_OUTPUT}"

      - name: Build and push controller image
        id: build
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.image.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          sbom: true
          provenance: mode=max

      - name: Scan image with Trivy
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          # DR-FIND-07: scan by digest — the bare "<version>" tag is no longer
          # published for the controller image (see the `image` step above).
          image-ref: ${{ steps.image.outputs.repository }}@${{ steps.build.outputs.digest }}
          format: table
          exit-code: 1
          ignore-unfixed: true
          severity: CRITICAL,HIGH

      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Sign container image
        run: |
          cosign sign --yes \
            "${{ steps.image.outputs.repository }}@${{ steps.build.outputs.digest }}"


      - id: pipeline-image
        run: |
          OWNER="$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')"
          IMAGE="${{ env.REGISTRY }}/${OWNER}/${{ env.PIPELINE_IMAGE_NAME }}"
          echo "repository=${IMAGE}" >> "${GITHUB_OUTPUT}"
          echo "tags=${IMAGE}:${{ steps.version.outputs.version }},${IMAGE}:${{ steps.version.outputs.tag }}" >> "${GITHUB_OUTPUT}"

      - name: Build and push kollect-pipeline image
        id: pipeline-build
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: Dockerfile.pipeline
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.pipeline-image.outputs.tags }}
          cache-from: type=gha,scope=kollect-pipeline
          cache-to: type=gha,mode=max,scope=kollect-pipeline
          sbom: true
          provenance: mode=max

      - name: Scan kollect-pipeline image with Trivy
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ${{ steps.pipeline-image.outputs.repository }}:${{ steps.version.outputs.version }}
          format: table
          exit-code: 1
          ignore-unfixed: true
          severity: CRITICAL,HIGH

      - name: Sign kollect-pipeline container image
        run: |
          cosign sign --yes \
            "${{ steps.pipeline-image.outputs.repository }}@${{ steps.pipeline-build.outputs.digest }}"

      - name: Prepare dist directory
        run: mkdir -p dist

      - uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
        with:
          image: ${{ steps.image.outputs.repository }}@${{ steps.build.outputs.digest }}
          output-file: dist/sbom.spdx.json
          format: spdx-json
          registry-username: ${{ github.repository_owner }}
          registry-password: ${{ secrets.GITHUB_TOKEN }}


      - uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
        with:
          image: ${{ steps.pipeline-image.outputs.repository }}@${{ steps.pipeline-build.outputs.digest }}
          output-file: dist/sbom-pipeline.spdx.json
          format: spdx-json
          registry-username: ${{ github.repository_owner }}
          registry-password: ${{ secrets.GITHUB_TOKEN }}

      - name: Attest operator image (SLSA provenance)
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-name: ${{ steps.image.outputs.repository }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

      - name: Attest operator image (SBOM)
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-name: ${{ steps.image.outputs.repository }}
          subject-digest: ${{ steps.build.outputs.digest }}
          sbom-path: dist/sbom.spdx.json
          push-to-registry: true


      - name: Attest kollect-pipeline image (SLSA provenance)
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-name: ${{ steps.pipeline-image.outputs.repository }}
          subject-digest: ${{ steps.pipeline-build.outputs.digest }}
          push-to-registry: true

      - name: Attest kollect-pipeline image (SBOM)
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-name: ${{ steps.pipeline-image.outputs.repository }}
          subject-digest: ${{ steps.pipeline-build.outputs.digest }}
          sbom-path: dist/sbom-pipeline.spdx.json
          push-to-registry: true

      - name: Build release assets
        run: bash hack/release-assets.sh "${{ steps.version.outputs.version }}" "${{ steps.image.outputs.repository }}"

      - name: Sign GitHub Release assets
        run: bash hack/sign-release-assets.sh dist

      - name: Attest GitHub Release assets (SLSA provenance)
        id: attest-release
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-checksums: dist/checksums.txt

      - name: Export release provenance bundle
        run: cp "${{ steps.attest-release.outputs.bundle-path }}" dist/release-provenance.intoto.jsonl

      # SINGLE SOURCE OF TRUTH for the chart's OCI coordinate (ADR-0709). Every consumer --
      # `helm push`, `cosign sign`, the Artifact Hub metadata tag and the release notes --
      # reads these outputs. The coordinate used to be derived independently in three
      # places, so editing one left the others silently pointing at the old path; the
      # Artifact Hub step is soft-fail, so its copy could strand without reddening a release.
      - name: Derive chart OCI coordinate
        id: chart
        # github.repository_owner is untrusted context: it arrives through env: and is read
        # as a shell variable rather than interpolated into the script (githubactions:S7636).
        env:
          REPOSITORY_OWNER: ${{ github.repository_owner }}
        run: |
          set -euo pipefail
          # GHCR namespaces are lowercase; a GitHub owner need not be.
          OWNER="$(echo "${REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]')"
          # The chart lives under a charts/ segment, NOT next to the controller image at
          # ${REGISTRY}/${OWNER}/${IMAGE_NAME}. The image does not move: its digest is
          # pinned immutably in already-merged OLM bundles.
          CHART_BASE="${REGISTRY}/${OWNER}/charts"
          # `helm push` APPENDS the chart name, so its target is the PARENT path.
          echo "oci=oci://${CHART_BASE}" >>"${GITHUB_OUTPUT}"
          # The full chart repository, for `cosign sign` and the artifacthub.io metadata
          # tag. Derived from the same base as `oci`, so the two cannot disagree.
          echo "repository=${CHART_BASE}/${CHART_NAME}" >>"${GITHUB_OUTPUT}"

      - name: Publish and sign Helm chart (OCI)
        id: chart-publish
        env:
          CHART_OCI: ${{ steps.chart.outputs.oci }}
          CHART_REPOSITORY: ${{ steps.chart.outputs.repository }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          set -euo pipefail
          CHART_PKG="dist/${CHART_NAME}-${VERSION}.tgz"
          PUSH_OUT="$(helm push "${CHART_PKG}" "${CHART_OCI}" 2>&1)"
          echo "${PUSH_OUT}"
          DIGEST="$(echo "${PUSH_OUT}" | awk '/Digest:/{print $2; exit}')"
          if [[ -z "${DIGEST}" ]]; then
            echo "failed to extract chart digest from helm push output" >&2
            exit 1
          fi
          # Post-push assertion (ADR-0709). `helm push` reports the reference it actually
          # wrote; require it to be under the repository this workflow derived. Nothing
          # else notices a chart that lands elsewhere: cosign would happily sign whatever
          # digest came back, and the release would go green at the wrong coordinate.
          PUSHED_REF="$(echo "${PUSH_OUT}" | awk '/Pushed:/{print $2; exit}')"
          if [[ "${PUSHED_REF}" != "${CHART_REPOSITORY}:"* ]]; then
            echo "chart was pushed to '${PUSHED_REF}', which is not under the expected chart repository '${CHART_REPOSITORY}'" >&2
            exit 1
          fi
          echo "digest=${DIGEST}" >>"${GITHUB_OUTPUT}"
          CHART_REF="${CHART_REPOSITORY}@${DIGEST}"
          echo "Signing ${CHART_REF}"
          cosign sign --yes "${CHART_REF}"

      - name: Guard against image/chart GHCR tag collision (DR-FIND-07)
        env:
          IMAGE_REPO: ${{ steps.image.outputs.repository }}
          IMAGE_TAGS: ${{ steps.image.outputs.tags }}
          VERSION: ${{ steps.version.outputs.version }}
          IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
          CHART_DIGEST: ${{ steps.chart-publish.outputs.digest }}
        run: |
          set -euo pipefail
          # DR-FIND-07 regression guard. RETAINED after ADR-0709 on purpose: the chart
          # now goes to ghcr.io/<owner>/charts/<chart>, so a live collision is
          # unreachable, but the guard costs nothing and fails closed.
          #
          # It is also not purely historical. The bare "<version>" tags 0.14.0-0.19.0
          # that the chart published on the IMAGE repo path before the move stay in
          # ghcr.io/<owner>/kollect permanently (ADR-0709 leaves them in place). Tagging
          # the controller image at a bare "<version>" would therefore still collide with
          # a chart manifest that is really there, and a default/bare-tag pull would fail
          # with CreateContainerConfigError exactly as before.
          #
          # (1) Primary guard: the controller image tag list must NOT contain the
          #     bare "<repo>:<version>" tag path charts occupy on this repository.
          #     This is the real collision condition (a shared tag path between two
          #     artifact kinds) and uses only values already produced by the workflow
          #     — no crane/oras.
          BARE_TAG="${IMAGE_REPO}:${VERSION}"
          if printf '%s' "${IMAGE_TAGS}" | tr ',' '\n' | grep -Fxq "${BARE_TAG}"; then
            echo "DR-FIND-07: controller image is tagged ${BARE_TAG}, the bare-tag path Helm charts occupy on the image repository — the image and a chart manifest would clobber each other. Publish the image at the v-prefixed tag only." >&2
            exit 1
          fi
          # (2) Sanity compare: the image manifest digest and the chart OCI manifest
          #     digest must differ. These are always distinct artifact types, so this
          #     is a belt-and-suspenders check, NOT the primary collision detector.
          if [[ "${IMAGE_DIGEST}" == "${CHART_DIGEST}" ]]; then
            echo "DR-FIND-07: controller image digest equals chart digest (${IMAGE_DIGEST}) — the same artifact was published for both." >&2
            exit 1
          fi
          echo "DR-FIND-07 guard passed: image tags='${IMAGE_TAGS}' do not include the bare chart tag path '${BARE_TAG}'; image/chart digests differ."

      - name: Generate changelog
        id: cliff
        uses: orhun/git-cliff-action@a9a95522b26fe6403f7bb24031f21fb573d0f5ff # v4.9.1
        with:
          version: v2.14.2
          config: hack/release/cliff.toml
          args: --latest --strip header
          github_token: ${{ secrets.GITHUB_TOKEN }}

      - name: Assemble release notes
        env:
          CLIFF_CHANGELOG: ${{ steps.cliff.outputs.content }}
          VERSION: ${{ steps.version.outputs.version }}
          TAG: ${{ steps.version.outputs.tag }}
          IMAGE_REPO: ${{ steps.image.outputs.repository }}
          IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
          PIPELINE_IMAGE_REPO: ${{ steps.pipeline-image.outputs.repository }}
          PIPELINE_IMAGE_DIGEST: ${{ steps.pipeline-build.outputs.digest }}
          CHART_OCI: ${{ steps.chart.outputs.oci }}
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: |
          chmod +x hack/assemble-release-notes.sh
          printf '%s\n' "${CLIFF_CHANGELOG}" >"${RUNNER_TEMP}/changelog.md"
          CHANGELOG_SECTION="${RUNNER_TEMP}/changelog.md" \
            bash hack/assemble-release-notes.sh "${RUNNER_TEMP}/release-body.md"

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          tag_name: ${{ steps.version.outputs.tag }}
          name: kollect ${{ steps.version.outputs.version }}
          body_path: ${{ runner.temp }}/release-body.md
          draft: ${{ github.event_name == 'workflow_dispatch' && inputs.draft || false }}
          prerelease: ${{ github.event_name == 'workflow_dispatch' && inputs.prerelease || false }}
          files: |
            dist/install-crds.yaml
            dist/install.yaml
            dist/kollect-${{ steps.version.outputs.version }}.tgz
            dist/sbom.spdx.json
            dist/sbom-pipeline.spdx.json
            dist/checksums.txt
            dist/release-provenance.intoto.jsonl
            dist/*.sigstore.json

      # Artifact Hub repository metadata is pure discoverability: it must never gate
      # the core publish. Both steps therefore run AFTER "Publish GitHub Release" and
      # are soft-fail (ADR-0708: "soft-fail hub jobs preserve tag-release success").
      # Before this ordering, an oras download/login/push failure aborted the job
      # after the images and chart were already pushed and cosign-signed, leaving a
      # tag with signed GHCR artifacts but no GitHub Release and none of its assets.
      - name: Set up oras
        id: setup-oras
        continue-on-error: true
        uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2 (includes 1.3.2)
        with:
          version: "1.3.2"

      - name: Push Artifact Hub metadata
        id: push-artifacthub-metadata
        continue-on-error: true
        if: ${{ steps.setup-oras.outcome == 'success' }}
        # Secrets and untrusted GitHub contexts are passed through `env:` and
        # referenced as shell variables; expanding them inline in the `run:`
        # body would leak the token into the rendered script and open a script
        # injection path (githubactions:S7636).
        env:
          REGISTRY: ${{ env.REGISTRY }}
          # ADR-0709 step 1: the metadata tag belongs on the CHART repository Artifact Hub
          # tracks, not on the controller image repository. It used to be built from
          # env.IMAGE_NAME — the image variable — which happens to share the string
          # "kollect" with the chart, so the mistake was invisible. Read the coordinate
          # from the `chart` step instead of re-deriving it: this step is soft-fail, so a
          # stranded target loses Verified Publisher without reddening the release.
          CHART_REPOSITORY: ${{ steps.chart.outputs.repository }}
          REGISTRY_USER: ${{ github.actor }}
          REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          echo "${REGISTRY_PASSWORD}" | oras login "${REGISTRY}" \
            --username "${REGISTRY_USER}" --password-stdin
          oras push \
            "${CHART_REPOSITORY}:artifacthub.io" \
            --config /dev/null:application/vnd.cncf.artifacthub.config.v1+yaml \
            artifacthub-repo.yml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml

      - name: Report Artifact Hub metadata push outcome
        if: ${{ always() }}
        # Soft-fail too: no step placed after the signed publish may abort the
        # release job, reporting steps included.
        continue-on-error: true
        # Soft-fail must not mean invisible. `continue-on-error` forces
        # steps.<id>.conclusion to "success", so the real result is only readable
        # from steps.<id>.outcome — surface it as an annotation plus a job-summary
        # line so a failed push is obvious without opening the logs.
        env:
          SETUP_OUTCOME: ${{ steps.setup-oras.outcome }}
          PUSH_OUTCOME: ${{ steps.push-artifacthub-metadata.outcome }}
        run: |
          set -euo pipefail
          if [[ "${SETUP_OUTCOME}" == "success" && "${PUSH_OUTCOME}" == "success" ]]; then
            echo "- Artifact Hub repository metadata pushed (\`:artifacthub.io\`)." \
              >>"${GITHUB_STEP_SUMMARY}"
            exit 0
          fi
          echo "::warning title=Artifact Hub metadata not published::oras setup=${SETUP_OUTCOME}, push=${PUSH_OUTCOME}. The release itself is unaffected; re-run the Artifact Hub push manually or on the next tag."
          {
            echo "- :warning: **Artifact Hub repository metadata was NOT published**"
            echo "  (oras setup: \`${SETUP_OUTCOME}\`, push: \`${PUSH_OUTCOME}\`)."
            echo "  Discoverability only — the release, its assets and signatures are unaffected."
          } >>"${GITHUB_STEP_SUMMARY}"

  operatorhub-pr:
    name: OperatorHub PR
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [eligibility, release]
    if: ${{ !cancelled() && needs.release.result == 'success' && github.event_name == 'push' }}
    # secrets.OPERATORHUB_PAT is a cross-repo write credential for two third-party
    # repositories. Like the `release` job above, gate it behind the protected
    # environment so the token cannot be reached by a tagged workflow copy that
    # strips the eligibility job. NOTE: OPERATORHUB_PAT must be stored as a
    # `release` ENVIRONMENT secret — a repo-level secret is not visible here and
    # the step below self-skips on an empty token.
    environment: release
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # Bind to the immutable SHA proven by eligibility, never the mutable tag
          # ref — the tag can be repointed between the release job and this one.
          ref: ${{ needs.eligibility.outputs.sha }}
          persist-credentials: false

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          # zizmor cache-poisoning: this tag-triggered workflow publishes runtime artifacts, so a
          # cache an untrusted event could seed must not feed the release build. Cache off.
          cache: false

      # DIST-OH-02: hack/operatorhub-pr.sh validates the bundle with the modern OperatorHub
      # validator set before pushing anything to a third-party repo, and hard-fails without
      # operator-sdk. Install it here so that validation actually runs.
      - name: Install operator-sdk (OLM bundle validators)
        # Soft-fail like the submission step it serves: OperatorHub submission is
        # discoverability only and must never fail the release pipeline. If the download
        # fails, operatorhub-pr.sh still refuses to submit an unvalidated bundle and the
        # outcome is reported as a warning — it fails closed, never silently open.
        continue-on-error: true
        env:
          OPERATOR_SDK_VERSION: v1.42.3
        run: bash hack/install-operator-sdk.sh ./bin

      - name: Generate OLM bundle and create OperatorHub PRs
        id: operatorhub
        continue-on-error: true
        env:
          VERSION: ${{ needs.release.outputs.version }}
          IMAGE_DIGEST: ${{ needs.release.outputs.digest }}
          GH_TOKEN: ${{ secrets.OPERATORHUB_PAT }}
          FORK_OWNER: platformrelay
        run: |
          set -euo pipefail
          if [[ -z "${GH_TOKEN}" ]]; then
            echo "OPERATORHUB_PAT not configured; skipping OperatorHub submission."
            exit 0
          fi
          chmod +x hack/operatorhub-pr.sh
          hack/operatorhub-pr.sh

      - name: Report OperatorHub submission outcome
        if: ${{ always() }}
        # Reporting must not be able to fail the job it reports on.
        continue-on-error: true
        # `continue-on-error` pins steps.<id>.conclusion to "success"; only
        # steps.<id>.outcome carries the truth. Surface a failed submission as an
        # annotation and a job-summary line instead of a silently green job.
        env:
          OPERATORHUB_OUTCOME: ${{ steps.operatorhub.outcome }}
        run: |
          set -euo pipefail
          if [[ "${OPERATORHUB_OUTCOME}" == "success" ]]; then
            echo "- OperatorHub submission step completed." >>"${GITHUB_STEP_SUMMARY}"
            exit 0
          fi
          echo "::warning title=OperatorHub submission did not complete::hack/operatorhub-pr.sh outcome=${OPERATORHUB_OUTCOME}. The release itself is unaffected; re-run the submission manually."
          {
            echo "- :warning: **OperatorHub PRs were NOT created**"
            echo "  (\`hack/operatorhub-pr.sh\` outcome: \`${OPERATORHUB_OUTCOME}\`)."
            echo "  Discoverability only — the release, its assets and signatures are unaffected."
          } >>"${GITHUB_STEP_SUMMARY}"