release.yml

name: Release

on:
  push:
    branches: [main]
    tags: ["v*"]

permissions:
  contents: read

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      discussions: write
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: deployah/deployah
          # 'latest' only on stable tags (no pre-release suffix like -alpha, -beta, -rc)
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable=${{ github.ref_type == 'tag' && !contains(github.ref_name, '-') }}
            type=edge,branch=${{ github.event.repository.default_branch }}
          flavor: |
            latest=false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
        with:
          buildkitd-config-inline: |
            [worker.oci]
            max-parallelism = 10

      - name: Login to Docker Hub
        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set version
        if: startsWith(github.ref, 'refs/tags/')
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"

      - name: Build artifacts
        if: startsWith(github.ref, 'refs/tags/')
        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
        with:
          targets: artifact
          provenance: false
          set: |
            artifact.cache-from=type=gha,scope=artifact
            artifact.cache-to=type=gha,mode=max,scope=artifact

      - name: Move artifacts
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          find ./dist -type f -not -name "SHA256SUMS" -exec mv {} ./dist/ \;
          find ./dist -name "SHA256SUMS" -exec cat {} \; | sort -u > ./dist/SHA256SUMS.combined
          mv ./dist/SHA256SUMS.combined ./dist/SHA256SUMS
          find ./dist -type d -empty -delete

      - name: Upload artifacts
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: deployah-artifacts
          path: ./dist/*
          if-no-files-found: error

      - name: Install Cosign
        if: startsWith(github.ref, 'refs/tags/')
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Sign release artifacts
        if: startsWith(github.ref, 'refs/tags/')
        env:
          COSIGN_YES: "true"
        run: |
          set -euo pipefail
          shopt -s nullglob
          for f in dist/*.tar.gz dist/*.sha256sum dist/SHA256SUMS; do
            cosign sign-blob --yes --bundle "${f}.sigstore.json" "$f"
          done

      - name: Build and push image
        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
        with:
          targets: image
          push: true
          sbom: true
          provenance: true
          files: |
            ./docker-bake.hcl
            cwd://${{ steps.meta.outputs.bake-file }}
          set: |
            image.cache-from=type=gha,scope=image
            image.cache-to=type=gha,mode=max,scope=image

      - name: Sync Docker Hub description
        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5
        if: github.ref_name == github.event.repository.default_branch
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          repository: deployah/deployah
          short-description: ${{ github.event.repository.description }}

      - name: GitHub Release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
        if: startsWith(github.ref, 'refs/tags/')
        with:
          draft: true
          generate_release_notes: true
          discussion_category_name: Announcements
          # TODO: add dist/*.zip once windows targets are enabled.
          files: |
            dist/*.tar.gz
            dist/*.sha256sum
            dist/SHA256SUMS
            dist/*.sigstore.json
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}