release.yml

name: release

on:
  push:
    branches:
      - main
    tags:
      - v*

env:
  IMAGE: ghcr.io/grampelberg/kty

concurrency:
  group: |-
    release-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  check:
    uses: ./.github/workflows/check.yml

  build:
    permissions:
      packages: write

    uses: ./.github/workflows/build.yml
    secrets:
      POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}

  merge:
    runs-on: ubuntu-latest

    permissions:
      packages: write

    needs:
      - build

    steps:
      - uses: actions/checkout@v4
      - name: tags
        run: git fetch --prune --unshallow --tags

      - name: fetch digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-*

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: buildx
        uses: docker/setup-buildx-action@v3

      - uses: taiki-e/install-action@v2
        with:
          tool: just,git-cliff
      - name: get version
        id: version
        run: echo "version=$(just --evaluate version)" >> "${GITHUB_OUTPUT}"

      - name: meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.IMAGE }}
          tags: |
            type=ref,event=tag
            type=semver,pattern={{version}}
            type=raw,value=${{ steps.version.outputs.version }},enable=true
            type=raw,value=unstable,enable={{is_default_branch}}
            type=sha

      - name: login
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: taiki-e/install-action@just

      - name: extract binary
        run: just extract-from-digests

      - uses: actions/upload-artifact@v4
        if: ${{ github.event_name != 'pull_request' }}
        with:
          name: kty-docker-binaries
          path: /tmp/bins/*
          retention-days: 1

      - name: push image
        working-directory: /tmp/digests
        run: |
          cp */* .
          rm -rf digests-*
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ env.IMAGE }}@sha256:%s ' *)

      - name: inspect image
        run: |
          docker buildx imagetools inspect ${{ env.IMAGE }}:${{ steps.meta.outputs.version }}

  helm:
    runs-on: ubuntu-latest
    needs:
      - build

    permissions:
      packages: write

    steps:
      - uses: actions/checkout@v4

      - name: Install toolchain
        run: rustup show active-toolchain
      - uses: Swatinem/rust-cache@v2
      - uses: cargo-bins/cargo-binstall@main
      - uses: jdx/mise-action@v2
        with:
          experimental: true

      - uses: actions/download-artifact@v4
        with:
          path: /tmp/chart
          name: helm

      - name: upload
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: just helm-upload

  release:
    runs-on: ubuntu-latest
    needs:
      - check
      - merge

    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/download-artifact@v4
        with:
          path: /tmp/binaries
          pattern: kty-*
          merge-multiple: true

      - uses: actions/download-artifact@v4
        with:
          path: /tmp/chart
          name: helm

      - uses: taiki-e/install-action@v2
        with:
          tool: git-cliff

      - name: changelog
        if: startsWith(github.ref, 'refs/tags/')
        run: git cliff -o CHANGELOG.md -l

      - name: changelog
        if: github.ref == 'refs/heads/main'
        run: git cliff -o CHANGELOG.md -u

      - name: versioned release
        uses: softprops/action-gh-release@v2
        if: startsWith(github.ref, 'refs/tags/')
        with:
          token: ${{ secrets.RELEASE_TOKEN }}
          body_path: CHANGELOG.md
          files: |-
            /tmp/binaries/*

      - name: unstable release
        uses: softprops/action-gh-release@v2
        if: github.ref == 'refs/heads/main'
        with:
          body_path: CHANGELOG.md
          name: unstable
          prerelease: true
          tag_name: unstable
          files: |-
            /tmp/binaries/*
            /tmp/chart/*