release-images #24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release-images | |
| on: | |
| workflow_run: | |
| workflows: ["tag-repo-version"] | |
| types: [completed] | |
| jobs: | |
| build-and-push: | |
| if: ${{ github.event.workflow_run.conclusion == 'success' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| # <-- expose the resolved tag as a job-level output | |
| outputs: | |
| tag: ${{ steps.tag.outputs.tag }} | |
| env: | |
| SOURCE_SHA: ${{ github.event.workflow_run.head_sha }} | |
| strategy: | |
| matrix: | |
| service: [web, worker] | |
| steps: | |
| - name: Checkout (full history for tags) | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Fetch tags | |
| run: git fetch --tags --force | |
| - name: Resolve the tag that points at the workflow SHA | |
| id: tag | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| echo "SOURCE_SHA=${SOURCE_SHA}" | |
| TAG="$(git tag --points-at "${SOURCE_SHA}" \ | |
| | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \ | |
| | head -n1 || true)" | |
| if [ -z "${TAG}" ]; then | |
| echo "No vX.Y.Z tag found for ${SOURCE_SHA}" | |
| git tag --points-at "${SOURCE_SHA}" || true | |
| exit 1 | |
| fi | |
| echo "tag=${TAG}" >> "$GITHUB_OUTPUT" | |
| echo "Resolved tag: ${TAG}" | |
| - name: Checkout the exact tag | |
| run: git checkout ${{ steps.tag.outputs.tag }} | |
| - uses: docker/setup-qemu-action@v3 | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Login to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build & push ${{ matrix.service }} | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: apps/${{ matrix.service }}/Dockerfile | |
| push: true | |
| platforms: linux/amd64,linux/arm64 | |
| tags: | | |
| ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:${{ steps.tag.outputs.tag }} | |
| ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:latest | |
| build-args: | | |
| NODE_ENV=production | |
| provenance: true | |
| sbom: true | |
| github-release: | |
| needs: build-and-push | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| # only run if a tag was actually resolved | |
| if: ${{ needs.build-and-push.outputs.tag != '' }} | |
| steps: | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: ${{ needs.build-and-push.outputs.tag }} # <-- use the output | |
| name: ${{ needs.build-and-push.outputs.tag }} | |
| generate_release_notes: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| #name: release-images | |
| # | |
| #on: | |
| # # Run as soon as the tag workflow finishes | |
| # workflow_run: | |
| # workflows: ["tag-repo-version"] | |
| # types: [completed] | |
| # | |
| #jobs: | |
| # build-and-push: | |
| # # Only run if the tag workflow succeeded | |
| # if: ${{ github.event.workflow_run.conclusion == 'success' }} | |
| # runs-on: ubuntu-latest | |
| # permissions: | |
| # contents: read | |
| # packages: write | |
| # | |
| # env: | |
| # # The commit that tag-repo-version ran on (the tag points at this) | |
| # SOURCE_SHA: ${{ github.event.workflow_run.head_sha }} | |
| # | |
| # strategy: | |
| # matrix: | |
| # service: [web, worker] | |
| # | |
| # steps: | |
| # - name: Checkout (full history for tags) | |
| # uses: actions/checkout@v4 | |
| # with: | |
| # fetch-depth: 0 | |
| # | |
| # - name: Fetch tags | |
| # run: git fetch --tags --force | |
| # | |
| # - name: Resolve the tag that points at the workflow SHA | |
| # id: tag | |
| # shell: bash | |
| # run: | | |
| # set -euo pipefail | |
| # echo "SOURCE_SHA=${SOURCE_SHA}" | |
| # # Find tags that point at exactly this SHA; pick semver-ish vX.Y.Z | |
| # TAG=$(git tag --points-at "${SOURCE_SHA}" | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n1 || true) | |
| # if [ -z "${TAG}" ]; then | |
| # echo "No vX.Y.Z tag found pointing at ${SOURCE_SHA}" | |
| # echo "Known tags for debugging:" | |
| # git tag --points-at "${SOURCE_SHA}" || true | |
| # exit 1 | |
| # fi | |
| # echo "tag=${TAG}" >> "$GITHUB_OUTPUT" | |
| # echo "Resolved tag: ${TAG}" | |
| # | |
| # - name: Check out the exact tagged revision | |
| # run: git checkout ${{ steps.tag.outputs.tag }} | |
| # | |
| # - name: Set up QEMU | |
| # uses: docker/setup-qemu-action@v3 | |
| # | |
| # - name: Set up Buildx | |
| # uses: docker/setup-buildx-action@v3 | |
| # | |
| # - name: Log in to GHCR | |
| # uses: docker/login-action@v3 | |
| # with: | |
| # registry: ghcr.io | |
| # username: ${{ github.actor }} | |
| # password: ${{ secrets.GITHUB_TOKEN }} | |
| # | |
| # - name: Build & push ${{ matrix.service }} | |
| # uses: docker/build-push-action@v6 | |
| # with: | |
| # context: . | |
| # file: apps/${{ matrix.service }}/Dockerfile | |
| # push: true | |
| # platforms: linux/amd64,linux/arm64 | |
| # # Tag with the resolved vX.Y.Z + "latest" | |
| # tags: | | |
| # ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:${{ steps.tag.outputs.tag }} | |
| # ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:latest | |
| # build-args: | | |
| # NODE_ENV=production | |
| # provenance: true | |
| # sbom: true | |
| # | |
| # github-release: | |
| # needs: build-and-push | |
| # runs-on: ubuntu-latest | |
| # permissions: | |
| # contents: write | |
| # steps: | |
| # - name: Create GitHub Release | |
| # uses: softprops/action-gh-release@v2 | |
| # with: | |
| # tag_name: ${{ github.ref_name }} | |
| # name: ${{ github.ref_name }} | |
| ## tag_name: v${{ steps.v.outputs.ver }} | |
| ## name: v${{ steps.v.outputs.ver }} | |
| # generate_release_notes: true | |
| # env: | |
| # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |