release-images.yml

name: release-images

on:
  # Run as soon as the tag workflow finishes
  workflow_run:
    workflows: ["tag-repo-version"]
    types: [completed]

jobs:
  build-and-push:
    # Only run if the tag workflow succeeded
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    env:
      # The commit that tag-repo-version ran on (the tag points at this)
      SOURCE_SHA: ${{ github.event.workflow_run.head_sha }}

    strategy:
      matrix:
        service: [web, worker]

    steps:
      - name: Checkout (full history for tags)
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Fetch tags
        run: git fetch --tags --force

      - name: Resolve the tag that points at the workflow SHA
        id: tag
        shell: bash
        run: |
          set -euo pipefail
          echo "SOURCE_SHA=${SOURCE_SHA}"
          # Find tags that point at exactly this SHA; pick semver-ish vX.Y.Z
          TAG=$(git tag --points-at "${SOURCE_SHA}" | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n1 || true)
          if [ -z "${TAG}" ]; then
            echo "No vX.Y.Z tag found pointing at ${SOURCE_SHA}"
            echo "Known tags for debugging:"
            git tag --points-at "${SOURCE_SHA}" || true
            exit 1
          fi
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
          echo "Resolved tag: ${TAG}"

      - name: Check out the exact tagged revision
        run: git checkout ${{ steps.tag.outputs.tag }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build & push ${{ matrix.service }}
        uses: docker/build-push-action@v6
        with:
          context: .
          file: apps/${{ matrix.service }}/Dockerfile
          push: true
          platforms: linux/amd64,linux/arm64
          # Tag with the resolved vX.Y.Z + "latest"
          tags: |
            ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:${{ steps.tag.outputs.tag }}
            ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:latest
          build-args: |
            NODE_ENV=production
          provenance: true
          sbom: true

  github-release:
    needs: build-and-push
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
#          tag_name: v${{ steps.v.outputs.ver }}
#          name: v${{ steps.v.outputs.ver }}
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}







#name: release-images
#
#on:
#  # Run as soon as the tag workflow finishes
#  workflow_run:
#    workflows: ["tag-repo-version"]
#    types: [completed]
#
#jobs:
#  build-and-push:
#    # Only run if the tag workflow succeeded
#    if: ${{ github.event.workflow_run.conclusion == 'success' }}
#    runs-on: ubuntu-latest
#    permissions:
#      contents: read
#      packages: write
#
#    env:
#      # The commit that tag-repo-version ran on (the tag points at this)
#      SOURCE_SHA: ${{ github.event.workflow_run.head_sha }}
#
#    strategy:
#      matrix:
#        service: [web, worker]
#
#    steps:
#      - name: Checkout (full history for tags)
#        uses: actions/checkout@v4
#        with:
#          fetch-depth: 0
#
#      - name: Fetch tags
#        run: git fetch --tags --force
#
#      - name: Resolve the tag that points at the workflow SHA
#        id: tag
#        shell: bash
#        run: |
#          set -euo pipefail
#          echo "SOURCE_SHA=${SOURCE_SHA}"
#          # Find tags that point at exactly this SHA; pick semver-ish vX.Y.Z
#          TAG=$(git tag --points-at "${SOURCE_SHA}" | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n1 || true)
#          if [ -z "${TAG}" ]; then
#            echo "No vX.Y.Z tag found pointing at ${SOURCE_SHA}"
#            echo "Known tags for debugging:"
#            git tag --points-at "${SOURCE_SHA}" || true
#            exit 1
#          fi
#          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
#          echo "Resolved tag: ${TAG}"
#
#      - name: Check out the exact tagged revision
#        run: git checkout ${{ steps.tag.outputs.tag }}
#
#      - name: Set up QEMU
#        uses: docker/setup-qemu-action@v3
#
#      - name: Set up Buildx
#        uses: docker/setup-buildx-action@v3
#
#      - name: Log in to GHCR
#        uses: docker/login-action@v3
#        with:
#          registry: ghcr.io
#          username: ${{ github.actor }}
#          password: ${{ secrets.GITHUB_TOKEN }}
#
#      - name: Build & push ${{ matrix.service }}
#        uses: docker/build-push-action@v6
#        with:
#          context: .
#          file: apps/${{ matrix.service }}/Dockerfile
#          push: true
#          platforms: linux/amd64,linux/arm64
#          # Tag with the resolved vX.Y.Z + "latest"
#          tags: |
#            ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:${{ steps.tag.outputs.tag }}
#            ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:latest
#          build-args: |
#            NODE_ENV=production
#          provenance: true
#          sbom: true
#
#  github-release:
#    needs: build-and-push
#    runs-on: ubuntu-latest
#    permissions:
#      contents: write
#    steps:
#      - name: Read version from repo-version package
#        id: v
#        run: |
#          FILE=packages/repo-version/package.json
#          if [ ! -f "$FILE" ]; then
#            echo "::error::$FILE not found"; exit 1
#          fi
#          VER=$(jq -r .version "$FILE")
#          if [ -z "$VER" ] || [ "$VER" = "null" ]; then
#            echo "::error::version missing in $FILE"; exit 1
#          fi
#          echo "ver=$VER" >> "$GITHUB_OUTPUT"
#          echo "Resolved version: $VER"
#
#      - name:
#          Guard: version must be present
#        run: |
#          if [ -z "${{ steps.v.outputs.ver }}" ]; then
#            echo "::error::Empty version output"; exit 1
#          fi
#
#      # (Optional) Create the tag using the SAME id
#      - name: Create tag if missing and push
#        env:
#          VER: ${{ steps.v.outputs.ver }}
#        run: |
#          set -euo pipefail
#          TAG="v${VER}"
#          git fetch --tags --force
#          if git ls-remote --tags origin | grep -q "refs/tags/$TAG$"; then
#            echo "Tag $TAG already exists on origin; nothing to do."
#            exit 0
#          fi
#          git tag -a "$TAG" -m "Release $TAG"
#          git push origin "$TAG"
#
#      - name: Create GitHub Release
#        uses: softprops/action-gh-release@v2
#        with:
#          tag_name: ${{ github.ref_name }}
#          name: ${{ github.ref_name }}
#          generate_release_notes: true
#        env:
#          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


#name: release-images
#on:
#  push:
#    tags: ['v*.*.*']  # build on release tags; adjust if you want main pushes too
#
#jobs:
#  build-and-push:
#    runs-on: ubuntu-latest
#    permissions:
#      contents: read
#      packages: write
#    strategy:
#      matrix:
#        service: [web, worker]
#    steps:
#      - uses: actions/checkout@v4
#
#      - uses: docker/setup-qemu-action@v3
#      - uses: docker/setup-buildx-action@v3
#
#      - uses: docker/login-action@v3
#        with:
#          registry: ghcr.io
#          username: ${{ github.actor }}
#          password: ${{ secrets.GITHUB_TOKEN }}
#
#      - name: Build & push ${{ matrix.service }}
#        uses: docker/build-push-action@v6
#        with:
#          context: .
#          file: apps/${{ matrix.service }}/Dockerfile
#          push: true
#          platforms: linux/amd64,linux/arm64
#          tags: |
#            ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:${{ github.ref_name }}
#            ghcr.io/${{ github.repository_owner }}/kurrier-${{ matrix.service }}:latest
#          build-args: |
#            NODE_ENV=production
#          provenance: true
#          sbom: true