From e4fb5c952af944110e5b679526042f5302d30f30 Mon Sep 17 00:00:00 2001
From: Anurag Mittal <1321012+anurag4DSB@users.noreply.github.com>
Date: Thu, 22 Oct 2026 18:00:54 +0200
Subject: [PATCH] CLDSRV-1027: Release from the epic, no GitHub release

The official release workflow does not run from an epic branch, so the
BNaaS D1 epic carries its own copy of it. The copy creates only the git
tag, with the job token, where the original creates a GitHub release. A
first check refuses a tag that is not X.Y.Z-bnaas.N, or that already
exists, before any image is pushed, so neither a typo nor a rerun can
overwrite a released image.

It also builds scality-kms:<tag>-federation itself instead of starting a
scality-kms release, which would create a GitHub release in scality-kms.
The image holds the proprietary SafeNet library and this repository is
public, so the clone keeps no token and the build log stays quiet. The
push needs the Write role for scality/cloudserver on the scality-kms
package. The GitHub App token is limited to reading scality-kms.
Everything else stays as in development.

The copy exists only on the epic, and the final merge drops it.
---
 .github/workflows/release.yaml | 80 +++++++++++++++++++++++++++-------
 1 file changed, 65 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ad63cecfb0..d40a37c951 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -16,6 +16,21 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
+      # Epic copy: refuse a non-epic tag before any image is pushed.
+      - name: Refuse a tag that is not an epic tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.event.inputs.tag }}
+        run: |
+          if ! [[ "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+-bnaas\.[0-9]+$ ]]; then
+            echo "::error::$TAG is not an X.Y.Z-bnaas.N epic tag"
+            exit 1
+          fi
+          if gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$TAG" --silent 2>/dev/null; then
+            echo "::error::Tag $TAG already exists"
+            exit 1
+          fi
+
       - name: Checkout
         uses: actions/checkout@v4
 
@@ -78,15 +93,14 @@ jobs:
           cache-from: type=gha,scope=federation
           cache-to: type=gha,mode=max,scope=federation
 
-      - name: Create Release
-        uses: softprops/action-gh-release@v2
+      # Epic copy: create the tag only, with no GitHub release.
+      - name: Create the tag
         env:
-          GITHUB_TOKEN: ${{ github.token }}
-        with:
-          name: Release ${{ github.event.inputs.tag }}
-          tag_name: ${{ github.event.inputs.tag }}
-          generate_release_notes: true
-          target_commitish: ${{ github.sha }}
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.event.inputs.tag }}
+        run: |
+          gh api "repos/$GITHUB_REPOSITORY/git/refs" \
+            -f ref="refs/tags/$TAG" -f sha="$GITHUB_SHA"
 
   trigger-kms-release:
     runs-on: ubuntu-latest
@@ -100,12 +114,48 @@ jobs:
           app-id: ${{ vars.ACTIONS_APP_ID }}
           private-key: ${{ secrets.ACTIONS_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
+          repositories: scality-kms
+          permission-contents: read
+
+      # Epic copy: build scality-kms here instead of starting a scality-kms
+      # release, which would create a GitHub release in scality-kms. The
+      # image holds the proprietary SafeNet library and this repository is
+      # public, so the clone keeps no token and the build log stays quiet.
+      - name: Checkout scality-kms
+        id: kms-checkout
+        uses: actions/checkout@v4
+        with:
+          repository: scality/scality-kms
+          ref: main
+          token: ${{ steps.app-token.outputs.token }}
+          path: scality-kms
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ github.token }}
 
-      - name: Trigger scality-kms release workflow
+      - name: Build and push scality-kms image
+        uses: docker/build-push-action@v5
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          gh workflow run release.yaml \
-            --repo scality/scality-kms \
-            --ref main \
-            --field cloudserver-version=${{ github.event.inputs.tag }}
+          BUILDKIT_PROGRESS: quiet
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        with:
+          push: true
+          context: scality-kms
+          provenance: false
+          build-args: |
+            CLOUDSERVER_TAG=${{ github.event.inputs.tag }}-federation
+          tags: |
+            ghcr.io/${{ github.repository_owner }}/scality-kms:${{ github.event.inputs.tag }}-federation
+          labels: |
+            git.repository=${{ github.repository }}
+            git.commit-sha=${{ github.sha }}
+            scality-kms.commit-sha=${{ steps.kms-checkout.outputs.commit }}