publish.yml

name: Publish

run-name: "Publish: ${{ inputs.version }}: ${{ github.ref_name }}@${{ github.sha }}"

on:
  workflow_dispatch:
    inputs:
      version:
        description: novel library version and repository tag to apply (e.g. 1.0.2-post5)
        required: true
      force-version:
        description: omit check for semantic versioning
        type: boolean
        required: false

jobs:
  check:
    runs-on: ubuntu-latest

    outputs:
      git-tags: ${{ steps.tags.outputs.git-tags }}

    steps:
      - name: Check out repository
        uses: actions/checkout@v3
        with:
          #
          # Fetch ALL history s.t. tags may be sorted by date (creatordate)
          # (regardless of whether the tag or ls-remote --tags command is used)
          #
          # Note: This might be slow! ls-remote allows us to avoid this, *except*
          # that we want to sort by object creation date, which appears to require
          # a complete local clone.
          #
          fetch-depth: 0

      - name: Retrieve tags
        id: tags
        #
        # checkout does not by default load all changesets and tags
        #
        # as such, this can come up empty:
        #
        #   git tag --list
        #
        # instead, (and rather than check out repo history), we can query the remote:
        #
        #   git ls-remote -q --tags --refs --sort=-creatordate | awk -F / '{print $3}'
        #
        # *However* the "creatordate" sort above fails without a deep clone;
        # so, we'll rely on a deep clone, regardless.
        #
        run: |
          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)

          echo "git-tags<<$EOF" >> "$GITHUB_OUTPUT"

          git tag --list --sort=-creatordate >> "$GITHUB_OUTPUT"

          echo "$EOF" >> "$GITHUB_OUTPUT"

      - name: Check that tag is novel
        env:
          TAGS: ${{ steps.tags.outputs.git-tags }}
        run: |
          echo "$TAGS" |
            grep -E "^${{ inputs.version }}$" > /dev/null && {
              echo "::error::Tag ${{ inputs.version }} already exists"
              exit 1
            }

          echo "✓ Tag ${{ inputs.version }} is novel"

      - name: Check that version is semantic
        if: ${{ ! inputs.force-version }}
        env:
          SEMVAR_PATTERN: ^(?P<major>0|[1-9]\d*)\.(?P<minor>0|[1-9]\d*)\.(?P<patch>0|[1-9]\d*)(?:-(?P<prerelease>(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+(?P<buildmetadata>[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$
        shell: python
        run: |
          import os
          import re

          match = re.fullmatch(os.getenv('SEMVAR_PATTERN'), '${{ inputs.version }}')

          if not match:
              print("::error::Version ${{ inputs.version }} is non-semantic")
              raise SystemExit(1)

          items = ('='.join(item) for item in match.groupdict().items() if all(item))

          print("✓ Version ${{ inputs.version }} is semantic:", *items)

  build-push:
    runs-on: ubuntu-latest

    needs: [check]

    permissions:
      contents: read
      packages: write

    strategy:
      matrix:
        base-image:
          - name: python:3.11-bookworm
            tags: |
              ghcr.io/${{ github.repository_owner }}/fate-builder:latest
              ghcr.io/${{ github.repository_owner }}/fate-builder:bookworm
              ghcr.io/${{ github.repository_owner }}/fate-builder:py311
              ghcr.io/${{ github.repository_owner }}/fate-builder:bookworm-py311
              ghcr.io/${{ github.repository_owner }}/fate-builder:${{ inputs.version }}
              ghcr.io/${{ github.repository_owner }}/fate-builder:${{ inputs.version }}-bookworm
              ghcr.io/${{ github.repository_owner }}/fate-builder:${{ inputs.version }}-py311
              ghcr.io/${{ github.repository_owner }}/fate-builder:${{ inputs.version }}-bookworm-py311
          - name: python:3.11-slim-bookworm
            tags: |
              ghcr.io/${{ github.repository_owner }}/fate-builder:slim
              ghcr.io/${{ github.repository_owner }}/fate-builder:slim-bookworm
              ghcr.io/${{ github.repository_owner }}/fate-builder:slim-py311
              ghcr.io/${{ github.repository_owner }}/fate-builder:slim-bookworm-py311
              ghcr.io/${{ github.repository_owner }}/fate-builder:${{ inputs.version }}-slim
              ghcr.io/${{ github.repository_owner }}/fate-builder:${{ inputs.version }}-slim-bookworm
              ghcr.io/${{ github.repository_owner }}/fate-builder:${{ inputs.version }}-slim-py311
              ghcr.io/${{ github.repository_owner }}/fate-builder:${{ inputs.version }}-slim-bookworm-py311
          - name: ubuntu:22.04
            tags: |
              ghcr.io/${{ github.repository_owner }}/fate-builder:jammy
              ghcr.io/${{ github.repository_owner }}/fate-builder:jammy-py310
              ghcr.io/${{ github.repository_owner }}/fate-builder:${{ inputs.version }}-jammy
              ghcr.io/${{ github.repository_owner }}/fate-builder:${{ inputs.version }}-jammy-py310

    steps:
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Log in to the Container registry
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v4
        with:
          build-args: BASE_IMAGE=${{ matrix.base-image.name }}
          labels: org.opencontainers.image.source=https://github.com/${{ github.repository }}
          tags: ${{ matrix.base-image.tags }}
          platforms: linux/amd64,linux/arm64
          provenance: false
          push: true

      - name: Write to summary
        env:
          TAGS: ${{ matrix.base-image.tags }}
        run: |
          TAG="$(echo "$TAGS" | head -n1)"

          echo "### Image pushed :ship:" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "$TAG for ${{ matrix.base-image.name }}" >> $GITHUB_STEP_SUMMARY

  tag:
    runs-on: ubuntu-latest

    needs: [check, build-push]

    permissions:
      contents: write

    steps:
      - name: Check out repository
        uses: actions/checkout@v3

      - name: Set and push tag
        env:
          TAGS: ${{ needs.check.outputs.git-tags }}
        run: |
          git tag ${{ inputs.version }}
          git push --tags

          # write summary information
          lastTag="$(echo "$TAGS" | head -n1)"

          echo "### Version bumped :arrow_heading_up:" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "${{ github.ref_name }}@${{ github.sha }} tagged ${{ inputs.version }} over $lastTag" >> $GITHUB_STEP_SUMMARY