release-images #22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release-images | |
| on: | |
| # Run as soon as the tag workflow finishes | |
| workflow_run: | |
| workflows: ["tag-repo-version"] | |
| types: [completed] | |
| jobs: | |
| build-and-push: | |
| # Only run if the tag workflow succeeded | |
| if: ${{ github.event.workflow_run.conclusion == 'success' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| # The commit that tag-repo-version ran on (the tag points at this) | |
| SOURCE_SHA: ${{ github.event.workflow_run.head_sha }} | |
| strategy: | |
| matrix: | |
| service: [web, worker] | |
| steps: | |
| - name: Checkout (full history for tags) | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Fetch tags | |
| run: git fetch --tags --force | |
| - name: Resolve the tag that points at the workflow SHA | |
| id: tag | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| echo "SOURCE_SHA=${SOURCE_SHA}" | |
| # Find tags that point at exactly this SHA; pick semver-ish vX.Y.Z | |
| TAG=$(git tag --points-at "${SOURCE_SHA}" | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n1 || true) | |
| if [ -z "${TAG}" ]; then | |
| echo "No vX.Y.Z tag found pointing at ${SOURCE_SHA}" | |
| echo "Known tags for debugging:" | |
| git tag --points-at "${SOURCE_SHA}" || true | |
| exit 1 | |
| fi | |
| echo "tag=${TAG}" >> "$GITHUB_OUTPUT" | |
| echo "Resolved tag: ${TAG}" | |
| - name: Check out the exact tagged revision | |
| run: git checkout ${{ steps.tag.outputs.tag }} | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build & push ${{ matrix.service }} | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: apps/${{ matrix.service }}/Dockerfile | |
| push: true | |
| platforms: linux/amd64,linux/arm64 | |
| # Tag with the resolved vX.Y.Z + "latest" | |
| tags: | | |
| ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:${{ steps.tag.outputs.tag }} | |
| ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:latest | |
| build-args: | | |
| NODE_ENV=production | |
| provenance: true | |
| sbom: true | |
| github-release: | |
| needs: build-and-push | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| # tag_name: v${{ steps.v.outputs.ver }} | |
| # name: v${{ steps.v.outputs.ver }} | |
| generate_release_notes: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| #name: release-images | |
| # | |
| #on: | |
| # # Run as soon as the tag workflow finishes | |
| # workflow_run: | |
| # workflows: ["tag-repo-version"] | |
| # types: [completed] | |
| # | |
| #jobs: | |
| # build-and-push: | |
| # # Only run if the tag workflow succeeded | |
| # if: ${{ github.event.workflow_run.conclusion == 'success' }} | |
| # runs-on: ubuntu-latest | |
| # permissions: | |
| # contents: read | |
| # packages: write | |
| # | |
| # env: | |
| # # The commit that tag-repo-version ran on (the tag points at this) | |
| # SOURCE_SHA: ${{ github.event.workflow_run.head_sha }} | |
| # | |
| # strategy: | |
| # matrix: | |
| # service: [web, worker] | |
| # | |
| # steps: | |
| # - name: Checkout (full history for tags) | |
| # uses: actions/checkout@v4 | |
| # with: | |
| # fetch-depth: 0 | |
| # | |
| # - name: Fetch tags | |
| # run: git fetch --tags --force | |
| # | |
| # - name: Resolve the tag that points at the workflow SHA | |
| # id: tag | |
| # shell: bash | |
| # run: | | |
| # set -euo pipefail | |
| # echo "SOURCE_SHA=${SOURCE_SHA}" | |
| # # Find tags that point at exactly this SHA; pick semver-ish vX.Y.Z | |
| # TAG=$(git tag --points-at "${SOURCE_SHA}" | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n1 || true) | |
| # if [ -z "${TAG}" ]; then | |
| # echo "No vX.Y.Z tag found pointing at ${SOURCE_SHA}" | |
| # echo "Known tags for debugging:" | |
| # git tag --points-at "${SOURCE_SHA}" || true | |
| # exit 1 | |
| # fi | |
| # echo "tag=${TAG}" >> "$GITHUB_OUTPUT" | |
| # echo "Resolved tag: ${TAG}" | |
| # | |
| # - name: Check out the exact tagged revision | |
| # run: git checkout ${{ steps.tag.outputs.tag }} | |
| # | |
| # - name: Set up QEMU | |
| # uses: docker/setup-qemu-action@v3 | |
| # | |
| # - name: Set up Buildx | |
| # uses: docker/setup-buildx-action@v3 | |
| # | |
| # - name: Log in to GHCR | |
| # uses: docker/login-action@v3 | |
| # with: | |
| # registry: ghcr.io | |
| # username: ${{ github.actor }} | |
| # password: ${{ secrets.GITHUB_TOKEN }} | |
| # | |
| # - name: Build & push ${{ matrix.service }} | |
| # uses: docker/build-push-action@v6 | |
| # with: | |
| # context: . | |
| # file: apps/${{ matrix.service }}/Dockerfile | |
| # push: true | |
| # platforms: linux/amd64,linux/arm64 | |
| # # Tag with the resolved vX.Y.Z + "latest" | |
| # tags: | | |
| # ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:${{ steps.tag.outputs.tag }} | |
| # ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:latest | |
| # build-args: | | |
| # NODE_ENV=production | |
| # provenance: true | |
| # sbom: true | |
| # | |
| # github-release: | |
| # needs: build-and-push | |
| # runs-on: ubuntu-latest | |
| # permissions: | |
| # contents: write | |
| # steps: | |
| # - name: Read version from repo-version package | |
| # id: v | |
| # run: | | |
| # FILE=packages/repo-version/package.json | |
| # if [ ! -f "$FILE" ]; then | |
| # echo "::error::$FILE not found"; exit 1 | |
| # fi | |
| # VER=$(jq -r .version "$FILE") | |
| # if [ -z "$VER" ] || [ "$VER" = "null" ]; then | |
| # echo "::error::version missing in $FILE"; exit 1 | |
| # fi | |
| # echo "ver=$VER" >> "$GITHUB_OUTPUT" | |
| # echo "Resolved version: $VER" | |
| # | |
| # - name: | |
| # Guard: version must be present | |
| # run: | | |
| # if [ -z "${{ steps.v.outputs.ver }}" ]; then | |
| # echo "::error::Empty version output"; exit 1 | |
| # fi | |
| # | |
| # # (Optional) Create the tag using the SAME id | |
| # - name: Create tag if missing and push | |
| # env: | |
| # VER: ${{ steps.v.outputs.ver }} | |
| # run: | | |
| # set -euo pipefail | |
| # TAG="v${VER}" | |
| # git fetch --tags --force | |
| # if git ls-remote --tags origin | grep -q "refs/tags/$TAG$"; then | |
| # echo "Tag $TAG already exists on origin; nothing to do." | |
| # exit 0 | |
| # fi | |
| # git tag -a "$TAG" -m "Release $TAG" | |
| # git push origin "$TAG" | |
| # | |
| # - name: Create GitHub Release | |
| # uses: softprops/action-gh-release@v2 | |
| # with: | |
| # tag_name: ${{ github.ref_name }} | |
| # name: ${{ github.ref_name }} | |
| # generate_release_notes: true | |
| # env: | |
| # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| #name: release-images | |
| #on: | |
| # push: | |
| # tags: ['v*.*.*'] # build on release tags; adjust if you want main pushes too | |
| # | |
| #jobs: | |
| # build-and-push: | |
| # runs-on: ubuntu-latest | |
| # permissions: | |
| # contents: read | |
| # packages: write | |
| # strategy: | |
| # matrix: | |
| # service: [web, worker] | |
| # steps: | |
| # - uses: actions/checkout@v4 | |
| # | |
| # - uses: docker/setup-qemu-action@v3 | |
| # - uses: docker/setup-buildx-action@v3 | |
| # | |
| # - uses: docker/login-action@v3 | |
| # with: | |
| # registry: ghcr.io | |
| # username: ${{ github.actor }} | |
| # password: ${{ secrets.GITHUB_TOKEN }} | |
| # | |
| # - name: Build & push ${{ matrix.service }} | |
| # uses: docker/build-push-action@v6 | |
| # with: | |
| # context: . | |
| # file: apps/${{ matrix.service }}/Dockerfile | |
| # push: true | |
| # platforms: linux/amd64,linux/arm64 | |
| # tags: | | |
| # ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:${{ github.ref_name }} | |
| # ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:latest | |
| # build-args: | | |
| # NODE_ENV=production | |
| # provenance: true | |
| # sbom: true |