release.yml

name: release

on:
  workflow_dispatch:
    inputs:
      bump:
        description: "Version bump from the newest tag (ignored when version is set)"
        type: choice
        options: [patch, minor, major]
        default: patch
      version:
        description: "Explicit version, e.g. 0.11.0 (overrides bump)"
        type: string
      latest:
        description: "Also push the :latest tag"
        type: boolean
        default: true
      draft:
        description: "Create the GitHub Release as a draft"
        type: boolean
        default: true
      discussion:
        description: "Create a discussion for this release"
        type: boolean
        default: false
      discussion_category:
        description: "Discussion category"
        type: choice
        options: [Announcements, General, Ideas, "Q&A", Support]
        default: Announcements

env:
  IMAGE: ghcr.io/${{ github.repository_owner }}/crosswatch
  DOCKERHUB_IMAGE: docker.io/${{ github.repository_owner }}/crosswatch

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      discussions: write
    steps:
      - name: Check branch
        if: github.ref_name != 'main'
        run: |
          echo "Run this from the main branch, got ${{ github.ref_name }}"
          exit 1

      - name: Check Docker Hub credentials
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          if [ -z "${DOCKERHUB_USERNAME}" ] || [ -z "${DOCKERHUB_TOKEN}" ]; then
            echo "Missing DOCKERHUB_USERNAME or DOCKERHUB_TOKEN repository secret"
            exit 1
          fi

      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Resolve version
        id: ver
        env:
          IN_VERSION: ${{ inputs.version }}
          IN_BUMP: ${{ inputs.bump }}
        run: |
          set -euo pipefail

          last="$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -n1)"
          echo "Newest tag: ${last:-none}"

          if [ -n "${IN_VERSION}" ]; then
            version="${IN_VERSION#v}"
          else
            base="${last#v}"
            base="${base:-0.0.0}"
            IFS=. read -r major minor patch <<< "${base}"
            case "${IN_BUMP}" in
              major) major=$((major + 1)); minor=0; patch=0 ;;
              minor) minor=$((minor + 1)); patch=0 ;;
              patch) patch=$((patch + 1)) ;;
              *) echo "Unknown bump ${IN_BUMP}"; exit 1 ;;
            esac
            version="${major}.${minor}.${patch}"
          fi

          if ! [[ "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Not a valid version: ${version}"
            exit 1
          fi

          if git rev-parse -q --verify "refs/tags/v${version}" >/dev/null; then
            echo "Tag v${version} already exists"
            exit 1
          fi

          if [ -n "${IN_VERSION}" ]; then
            if [ -n "${last}" ]; then
              IFS=. read -r prev_major prev_minor _prev_patch <<< "${last#v}"
              IFS=. read -r new_major new_minor _new_patch <<< "${version}"
              if [ "${prev_major}" = "${new_major}" ] && [ "${prev_minor}" = "${new_minor}" ]; then
                kind="Update"
              else
                kind="Release"
              fi
            else
              kind="Release"
            fi
          elif [ "${IN_BUMP}" = "patch" ]; then
            kind="Update"
          else
            kind="Release"
          fi

          echo "Releasing v${version} as ${kind} ${version}"
          echo "version=${version}" >> "$GITHUB_OUTPUT"
          echo "tag=v${version}" >> "$GITHUB_OUTPUT"
          echo "previous=${last}" >> "$GITHUB_OUTPUT"
          echo "title=${kind} ${version}" >> "$GITHUB_OUTPUT"

      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: |
            ${{ env.IMAGE }}
            ${{ env.DOCKERHUB_IMAGE }}
          tags: |
            type=raw,value=${{ steps.ver.outputs.version }}
            type=raw,value=latest,enable=${{ inputs.latest }}
          labels: |
            org.opencontainers.image.version=${{ steps.ver.outputs.version }}

      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          platforms: linux/amd64,linux/arm64
          build-args: |
            APP_VERSION=${{ steps.ver.outputs.tag }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Tag release
        env:
          TAG: ${{ steps.ver.outputs.tag }}
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag -a "${TAG}" -m "${TAG}"
          git push origin "${TAG}"

      - name: Publish GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ steps.ver.outputs.tag }}
          TITLE: ${{ steps.ver.outputs.title }}
          PREVIOUS: ${{ steps.ver.outputs.previous }}
          DRAFT: ${{ inputs.draft }}
          LATEST: ${{ inputs.latest }}
          DISCUSSION: ${{ inputs.discussion }}
          DISCUSSION_CATEGORY: ${{ inputs.discussion_category }}
        run: |
          set -euo pipefail
          args=(--title "${TITLE}" --generate-notes --verify-tag)
          if [ -n "${PREVIOUS}" ]; then args+=(--notes-start-tag "${PREVIOUS}"); fi
          if [ "${DRAFT}" = "true" ]; then args+=(--draft); fi
          if [ "${LATEST}" = "true" ]; then args+=(--latest); fi
          if [ "${DISCUSSION}" = "true" ]; then
            if [ "${DRAFT}" = "true" ]; then
              echo "Draft releases cannot open a discussion, skipping"
            else
              args+=(--discussion-category "${DISCUSSION_CATEGORY}")
            fi
          fi
          gh release create "${TAG}" "${args[@]}"

      - name: Summary
        run: |
          {
            echo "### Released ${{ steps.ver.outputs.tag }}"
            echo
            echo '```'
            echo "docker pull ${{ env.IMAGE }}:${{ steps.ver.outputs.version }}"
            echo "docker pull ${{ env.DOCKERHUB_IMAGE }}:${{ steps.ver.outputs.version }}"
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"