release.yml

name: Release images

on:
    push:
        tags:
            - "web-v[0-9]+.[0-9]+.[0-9]+"
            - "bot-v[0-9]+.[0-9]+.[0-9]+"

permissions:
    actions: read
    contents: read
    packages: write

jobs:
    publish:
        name: Build and publish component image
        runs-on: ubuntu-latest
        concurrency:
            group: release-images-${{ startsWith(github.ref_name, 'bot-v') && 'bot' || 'web' }}
            cancel-in-progress: false

        steps:
            - name: Reject deleted or moved release tag
              env:
                  BEFORE_SHA: ${{ github.event.before }}
                  EVENT_DELETED: ${{ github.event.deleted }}
              run: |
                  if [ "$EVENT_DELETED" = "true" ]; then
                    echo "::error title=Release tag deleted::Release tag $GITHUB_REF_NAME was deleted. Release tags are immutable; do not delete or move published release tags."
                    exit 1
                  fi

                  if [ "$BEFORE_SHA" != "0000000000000000000000000000000000000000" ]; then
                    echo "::error title=Release tag already existed::Release tag $GITHUB_REF_NAME updates an existing tag from $BEFORE_SHA to $GITHUB_SHA. Release tags are immutable; create a newer web-vX.Y.Z or bot-vX.Y.Z tag instead."
                    exit 1
                  fi

            - name: Check out repository
              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
              with:
                  fetch-depth: 0

            - name: Set up Node.js
              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
              with:
                  node-version-file: "projects/package.json"

            - name: Validate release tag version
              id: release
              run: node projects/scripts/validate-release-tag.mjs "$GITHUB_REF_NAME" "$GITHUB_OUTPUT"

            - name: Ensure release tag is on main
              run: |
                  git fetch origin main:refs/remotes/origin/main --tags --force

                  if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
                    echo "::error title=Release tag is not on main::Release tag $GITHUB_REF_NAME points to $GITHUB_SHA, which is not reachable from origin/main. Move the tag to a main commit and push it again."
                    exit 1
                  fi

            - name: Require successful CI for the release commit
              env:
                  GITHUB_TOKEN: ${{ github.token }}
              run: node projects/scripts/require-successful-ci.mjs

            - name: Derive image metadata
              id: image
              shell: bash
              run: |
                  repository="${GITHUB_REPOSITORY,,}"
                  component="${{ steps.release.outputs.component }}"
                  image="ghcr.io/${repository}-${component}"
                  revision="$(git rev-parse HEAD)"

                  echo "name=${image}" >> "$GITHUB_OUTPUT"
                  echo "revision=${revision}" >> "$GITHUB_OUTPUT"
                  echo "cache=${image}:buildcache" >> "$GITHUB_OUTPUT"
                  echo "bot_cache=ghcr.io/${repository}-bot:buildcache" >> "$GITHUB_OUTPUT"
                  echo "web_cache=ghcr.io/${repository}-web:buildcache" >> "$GITHUB_OUTPUT"

            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

            - name: Log in to GHCR
              uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
              with:
                  registry: ghcr.io
                  username: ${{ github.actor }}
                  password: ${{ secrets.GITHUB_TOKEN }}

            - name: Build and publish image
              id: publish
              uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
              with:
                  context: ./projects
                  file: ./projects/Dockerfile
                  target: ${{ steps.release.outputs.component }}
                  platforms: linux/amd64
                  push: true
                  provenance: mode=max
                  sbom: true
                  tags: |
                      ${{ steps.image.outputs.name }}:${{ steps.release.outputs.version }}
                      ${{ steps.image.outputs.name }}:latest
                      ${{ steps.image.outputs.name }}:${{ steps.image.outputs.revision }}
                  labels: |
                      org.opencontainers.image.source=https://github.com/${{ github.repository }}
                      org.opencontainers.image.revision=${{ steps.image.outputs.revision }}
                      org.opencontainers.image.version=${{ steps.release.outputs.version }}
                      org.opencontainers.image.title=neonflux-${{ steps.release.outputs.component }}
                  cache-from: |
                      type=gha,scope=neonflux-${{ steps.release.outputs.component }}
                      type=registry,ref=${{ steps.image.outputs.bot_cache }}
                      type=registry,ref=${{ steps.image.outputs.web_cache }}
                  cache-to: type=registry,ref=${{ steps.image.outputs.cache }},mode=max,oci-mediatypes=true,compression=zstd

            - name: Verify published image by digest
              env:
                  IMAGE: ${{ steps.image.outputs.name }}
                  IMAGE_DIGEST: ${{ steps.publish.outputs.digest }}
              run: docker buildx imagetools inspect "$IMAGE@$IMAGE_DIGEST" >/dev/null

            - name: Publish release summary
              env:
                  COMPONENT: ${{ steps.release.outputs.component }}
                  IMAGE: ${{ steps.image.outputs.name }}
                  IMAGE_DIGEST: ${{ steps.publish.outputs.digest }}
                  REVISION: ${{ steps.image.outputs.revision }}
                  VERSION: ${{ steps.release.outputs.version }}
              shell: bash
              run: |
                  {
                    printf '## %s image published\n\n' "$COMPONENT"
                    printf -- '- Version: `%s`\n' "$VERSION"
                    printf -- '- Revision: `%s`\n' "$REVISION"
                    printf -- '- Digest: `%s`\n' "$IMAGE_DIGEST"
                    printf -- '- Tags: `%s`, `latest`, `%s`\n' "$VERSION" "$REVISION"
                    printf -- '- Image: `%s`\n' "$IMAGE"
                    printf -- '- Supply-chain metadata: `provenance + SBOM`\n'
                  } >> "$GITHUB_STEP_SUMMARY"