release.yaml

name: Release

on:
  push:
    branches: [main]

permissions:
  contents: write
  packages: write

jobs:
  validate:
    uses: ./.github/workflows/validate.yaml

  release:
    name: Semantic release
    needs: validate
    runs-on: ubuntu-latest
    outputs:
      new_release_published: ${{ steps.semantic.outputs.new_release_published }}
      new_release_version: ${{ steps.semantic.outputs.new_release_version }}
    steps:
      - uses: actions/checkout@v6.0.2
        with:
          persist-credentials: false

      # Preset v10 needs conventional-changelog-writer@9; semantic-release-action
      # v6 / release-notes-generator still ship writer@8. Lift the pin when those
      # move to writer@9. See conventional-changelog#1495.
      - uses: cycjimmy/semantic-release-action@v6.0.0
        id: semantic
        with:
          extra_plugins: |
            @semantic-release/changelog
            @semantic-release/git
            conventional-changelog-conventionalcommits@9.3.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-and-push:
    name: Build & push
    needs: release
    if: needs.release.outputs.new_release_published == 'true'
    runs-on: ubuntu-latest
    env:
      IMAGE_VERSION: ${{ needs.release.outputs.new_release_version }}
    steps:
      - uses: actions/checkout@v6.0.2

      - name: Install build tools
        run: ./scripts/install_tools.sh

      - name: Read manifest
        id: manifest
        run: |
          echo "image_name=$(yq e '.name' manifest.yaml)" >> "$GITHUB_OUTPUT"
          echo "registry=$(yq e '.registry' manifest.yaml)" >> "$GITHUB_OUTPUT"
          echo "format=$(yq e '.build.format' manifest.yaml)" >> "$GITHUB_OUTPUT"

      - name: Build image
        env:
          IMAGE_NAME: ${{ steps.manifest.outputs.image_name }}
          IMAGE_FORMAT: ${{ steps.manifest.outputs.format }}
        run: |
          # Build args from manifest
          BUILD_ARGS=()
          while IFS= read -r arg; do
            BUILD_ARGS+=(--build-arg "${arg}")
          done < <(yq e '.build.args[]' manifest.yaml)

          # Labels from manifest
          LABELS=()
          while IFS= read -r label; do
            if [[ -n "${label}" ]]; then
              label_key="${label%%=*}"
              label_value="${label#*=}"
              label_value="${label_value%\"}"
              label_value="${label_value#\"}"
              LABELS+=(--label "${label_key}=${label_value}")
            fi
          done < <(yq e '.build.labels[]' manifest.yaml)

          # Add version label
          LABELS+=(--label "org.opencontainers.image.version=${IMAGE_VERSION}")

          buildah build \
            --squash \
            --pull-always \
            --format "${IMAGE_FORMAT}" \
            "${BUILD_ARGS[@]}" \
            "${LABELS[@]}" \
            --tag "${IMAGE_NAME}:${IMAGE_VERSION}" \
            .

          # Save to OCI archive for pushing
          mkdir -p build
          buildah push "${IMAGE_NAME}:${IMAGE_VERSION}" "oci-archive:build/${IMAGE_NAME}.tar"

      - name: Login to GHCR
        env:
          REGISTRY: ${{ steps.manifest.outputs.registry }}
        run: skopeo login ghcr.io -u "${{ github.actor }}" -p "${{ secrets.GITHUB_TOKEN }}"

      - name: Push to registry
        env:
          IMAGE_NAME: ${{ steps.manifest.outputs.image_name }}
          REGISTRY: ${{ steps.manifest.outputs.registry }}
        run: |
          IFS='.' read -r MAJOR MINOR PATCH <<< "${IMAGE_VERSION}"
          if [ -z "${MAJOR}" ] || [ -z "${MINOR}" ] || [ -z "${PATCH}" ]; then
            echo "Error: IMAGE_VERSION '${IMAGE_VERSION}' is not valid semver (expected MAJOR.MINOR.PATCH)"
            exit 1
          fi

          # Push semantic version tag (1.2.3)
          skopeo copy "oci-archive:build/${IMAGE_NAME}.tar" "docker://${REGISTRY}:${IMAGE_VERSION}"

          # Push major.minor tag (1.2)
          skopeo copy "oci-archive:build/${IMAGE_NAME}.tar" "docker://${REGISTRY}:${MAJOR}.${MINOR}"

          # Push major tag (1)
          skopeo copy "oci-archive:build/${IMAGE_NAME}.tar" "docker://${REGISTRY}:${MAJOR}"

          # Push latest tag
          skopeo copy "oci-archive:build/${IMAGE_NAME}.tar" "docker://${REGISTRY}:latest"

      - name: Verify pushed image
        env:
          REGISTRY: ${{ steps.manifest.outputs.registry }}
        run: |
          skopeo inspect "docker://${REGISTRY}:${IMAGE_VERSION}" --format '{{.Labels}}'